Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
tor-browser-windows-x86_64-portable-14.0.2.exe

Overview

General Information

Sample name:tor-browser-windows-x86_64-portable-14.0.2.exe
Analysis ID:1561393
MD5:0d471709feba575823c5d89293bddf62
SHA1:23a969daff09442e725aafa81864c6eeae706cfb
SHA256:eec8d8dbdc517184ddfa7353ed89e4ac4d2e6c2fefef2a8c4e2c81bb4b6a9047
Tags:exeuser-smica83
Infos:

Detection

Score:36
Range:0 - 100
Whitelisted:false
Confidence:20%

Signatures

AI detected suspicious sample
Found pyInstaller with non standard icon
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 92.2% probability
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txtJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\wheel-0.43.0.dist-info\LICENSE.txtJump to behavior
Source: tor-browser-windows-x86_64-portable-14.0.2.exeStatic PE information: certificate valid
Source: tor-browser-windows-x86_64-portable-14.0.2.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: Binary string: D:\a\1\b\bin\amd64\python312.pdb source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2185017528.00007FF8A8C74000.00000040.00000001.01000000.00000004.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2192284158.00007FF8B8CB1000.00000040.00000001.01000000.00000010.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2177832756.00007FF8A824F000.00000040.00000001.01000000.00000017.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2192521953.00007FF8B8F71000.00000040.00000001.01000000.00000007.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2191580810.00007FF8B8B07000.00000040.00000001.01000000.0000000B.sdmp
Source: Binary string: D:\a\1\b\libssl-3.pdbEE source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2186211945.00007FF8A9355000.00000040.00000001.01000000.00000012.sdmp
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICOpenSSL 3.0.11 19 Sep 20233.0.11built on: Wed Sep 27 22:33:28 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC;CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL || WITHIN_ARENA(temp->next)assertion failed: (char **)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) || WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/*0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_push_octet_ptrOSSL_PARAM_BLD_to_param..\s\crypto\params.c source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2182879352.00007FF8A86E2000.00000040.00000001.01000000.0000000C.sdmp
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: tor-browser-windows-x86_64-portable-14.0.2.exe, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2182879352.00007FF8A86E2000.00000040.00000001.01000000.0000000C.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2189868208.00007FF8B7891000.00000040.00000001.01000000.00000013.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2193635662.00007FF8BA4F1000.00000040.00000001.01000000.0000000D.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2192912021.00007FF8B93C1000.00000040.00000001.01000000.00000009.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067053849.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2193430091.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2193117388.00007FF8B9841000.00000040.00000001.01000000.0000000E.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067053849.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2193430091.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2190666664.00007FF8B7E51000.00000040.00000001.01000000.0000000F.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_wmi.pdb''&GCTL source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2193117388.00007FF8B9841000.00000040.00000001.01000000.0000000E.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074767443.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2171414817.000001E56A270000.00000002.00000001.01000000.00000006.sdmp
Source: Binary string: D:\a\1\b\libssl-3.pdb source: tor-browser-windows-x86_64-portable-14.0.2.exe, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2186211945.00007FF8A9355000.00000040.00000001.01000000.00000012.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2190383413.00007FF8B7E11000.00000040.00000001.01000000.00000011.sdmp
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E21583C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,0_2_00007FF6E21583C0
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E2159280 FindFirstFileExW,FindClose,0_2_00007FF6E2159280
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E2171874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF6E2171874
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF6E2159280 FindFirstFileExW,FindClose,2_2_00007FF6E2159280
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF6E21583C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,2_2_00007FF6E21583C0
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF6E2171874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,2_2_00007FF6E2171874
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficDNS traffic detected: DNS query: steamcomunty.com
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2129611983.000001E56AFBC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2175029093.000001E56B590000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://.../back.jpeg
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2180285327.00007FF8A82B6000.00000040.00000001.01000000.00000014.sdmpString found in binary or memory: http://.css
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2180285327.00007FF8A82B6000.00000040.00000001.01000000.00000014.sdmpString found in binary or memory: http://.jpg
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2157228187.000001E56ACCA000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2161879195.000001E56B840000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2161759995.000001E56AF35000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2162298286.000001E56AE33000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149539299.000001E56AF23000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153413787.000001E56AF34000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2173816582.000001E56AE95000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153114034.000001E56B837000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2152249008.000001E56AE24000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2161058354.000001E56ACCD000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149862292.000001E56AE24000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2162109762.000001E56AE2D000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2162148100.000001E56AF46000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2162039857.000001E56B8C7000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2173601470.000001E56AE24000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150126891.000001E56AE8F000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149569427.000001E56AF27000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2167795749.000001E56AE24000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148185759.000001E56AE8B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2163561460.000001E56AF35000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149286844.000001E56AF43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074006705.000001F713774000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digi
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2075005559.000001F713774000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.co
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069227190.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068513556.000001F713780000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067899965.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069138202.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067543952.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068931999.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2072627396.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067206085.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068341888.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074006705.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069363713.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068056387.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068513556.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074584535.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068622239.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074151483.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2075005559.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068931999.000001F713780000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074767443.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2076128292.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2076128292.000001F713780000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074584535.000001F713774000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTruste
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069227190.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067899965.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069138202.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067543952.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068931999.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2072627396.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067206085.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068341888.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074006705.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069363713.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068056387.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068513556.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074584535.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068622239.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074151483.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2075005559.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069363713.000001F713780000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074767443.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2076128292.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068239339.000001F713774000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069227190.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067899965.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069138202.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067543952.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068931999.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2072627396.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067206085.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068341888.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074006705.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069363713.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068056387.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068513556.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074584535.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068622239.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074151483.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2075005559.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069363713.000001F713780000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074767443.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2076128292.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068239339.000001F713774000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069227190.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068513556.000001F713780000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067899965.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069138202.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067543952.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068931999.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2072627396.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067206085.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068341888.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074006705.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069363713.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068056387.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068513556.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074584535.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068622239.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074151483.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2075005559.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068931999.000001F713780000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074767443.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2076128292.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2076128292.000001F713780000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2114566288.000001E56A7F2000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2161385770.000001E56A88C000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2130028800.000001E56A801000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2172865160.000001E56A88C000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149208172.000001E56ACD6000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2107034964.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2156098513.000001E56A883000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2104574533.000001E56A80A000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2157050109.000001E56ACDC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2103900550.000001E56A872000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2156782904.000001E56A883000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150028790.000001E56ACD7000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2105396074.000001E56A802000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2107421454.000001E56ACDC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148970004.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2105173612.000001E56A74D000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2103030917.000001E56A811000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2102113414.000001E56A86B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2130331062.000001E56A802000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2106010766.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2160536074.000001E56ACDC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2114566288.000001E56A7F2000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2152076176.000001E56A84F000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2158628343.000001E56A869000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153324985.000001E56A850000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2130028800.000001E56A801000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2107034964.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2101993721.000001E56AC60000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2104574533.000001E56A80A000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2103924625.000001E56A84F000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2151896115.000001E56A835000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2105396074.000001E56A802000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148970004.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2105173612.000001E56A74D000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2156887893.000001E56A85F000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2103030917.000001E56A811000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2130331062.000001E56A802000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2106010766.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2151092176.000001E56A833000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2101993721.000001E56AC21000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148526607.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150587578.000001E56A80C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.activestate.com/recipes/577916/
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2157228187.000001E56ACCA000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2147860222.000001E56AFBC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153154739.000001E56AFD5000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2161058354.000001E56ACCD000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2129611983.000001E56AFBC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2154308290.000001E56AFF7000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149766092.000001E56ACC1000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2152165593.000001E56AFBC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153907383.000001E56ACC8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153247356.000001E56AEB5000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2152076176.000001E56A84F000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2157943368.000001E56AEB5000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2158628343.000001E56A869000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153324985.000001E56A850000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2130028800.000001E56A801000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2172791241.000001E56A86B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2129134474.000001E56AE34000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149389775.000001E56AEAA000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150748061.000001E56AEB3000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2151896115.000001E56A835000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148970004.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148185759.000001E56AE8B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2156887893.000001E56A85F000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2130331062.000001E56A802000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150126891.000001E56AEAB000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2151092176.000001E56A833000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2161842516.000001E56AEB5000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2161275510.000001E56A86B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148526607.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150587578.000001E56A80C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2160021059.000001E56AC9A000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148451310.000001E568804000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2152512812.000001E56AC84000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2161017939.000001E56880F000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2163326632.000001E56ACA1000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2167119705.000001E568810000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2165643490.000001E568810000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2151836860.000001E56AC83000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2164191574.000001E568810000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150431006.000001E56AC5D000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2154096280.000001E56AC99000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2151174414.000001E56AC7F000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2169600066.000001E568810000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2171072782.000001E568811000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148451310.000001E568804000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2161017939.000001E56880F000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2167119705.000001E568810000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2165643490.000001E568810000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2164191574.000001E568810000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2169600066.000001E568810000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2171072782.000001E568811000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crlj
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2157228187.000001E56ACCA000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2147860222.000001E56AFBC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153154739.000001E56AFD5000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2161058354.000001E56ACCD000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2129611983.000001E56AFBC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2154308290.000001E56AFF7000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149766092.000001E56ACC1000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2152165593.000001E56AFBC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153907383.000001E56ACC8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2129611983.000001E56AF7B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149071492.000001E56AF7B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2155264452.000001E56AF84000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2162148100.000001E56AF46000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2162526793.000001E56AF4A000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149286844.000001E56AF43000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2129611983.000001E56AF46000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2158550064.000001E56AF44000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2129611983.000001E56AF7B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149071492.000001E56AF7B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2155264452.000001E56AF84000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crlS
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2129611983.000001E56AF7B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149071492.000001E56AF7B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2155264452.000001E56AF84000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2162148100.000001E56AF46000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2162526793.000001E56AF4A000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149286844.000001E56AF43000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2129611983.000001E56AF46000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2158550064.000001E56AF44000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2129611983.000001E56AF7B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149071492.000001E56AF7B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2155264452.000001E56AF84000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crlN
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2129611983.000001E56AF7B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149071492.000001E56AF7B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2155264452.000001E56AF84000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153247356.000001E56AEB5000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2157943368.000001E56AEB5000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2129134474.000001E56AE34000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149389775.000001E56AEAA000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150748061.000001E56AEB3000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148185759.000001E56AE8B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150126891.000001E56AEAB000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2161842516.000001E56AEB5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2129611983.000001E56AF7B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149071492.000001E56AF7B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2155264452.000001E56AF84000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crlJ
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069227190.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068513556.000001F713780000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067899965.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069138202.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067543952.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068931999.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2072627396.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067206085.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068341888.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074006705.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069363713.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068056387.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068513556.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074584535.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068622239.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074151483.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2075005559.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068931999.000001F713780000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074767443.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2076128292.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2076128292.000001F713780000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069227190.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067899965.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069138202.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067543952.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068931999.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2072627396.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067206085.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068341888.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074006705.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069363713.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068056387.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068513556.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074584535.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068622239.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074151483.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2075005559.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069363713.000001F713780000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074767443.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2076128292.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068239339.000001F713774000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069227190.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067899965.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069138202.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067543952.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068931999.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2072627396.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067206085.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068341888.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074006705.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069363713.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068056387.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068513556.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074584535.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068622239.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074151483.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2075005559.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069363713.000001F713780000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074767443.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2076128292.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068239339.000001F713774000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068239339.000001F713774000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069227190.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067899965.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069138202.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067543952.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068931999.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2072627396.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067206085.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068341888.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074006705.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069363713.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068056387.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068513556.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074584535.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068622239.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074151483.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2075005559.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069363713.000001F713780000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074767443.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2076128292.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068239339.000001F713774000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2157228187.000001E56ACCA000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2173816582.000001E56AE95000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2161058354.000001E56ACCD000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150126891.000001E56AE8F000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148185759.000001E56AE8B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149766092.000001E56ACC1000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2161675441.000001E56AE90000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153907383.000001E56ACC8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/eax/eax-spec.pdf
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2161879195.000001E56B840000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2162298286.000001E56AE33000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153114034.000001E56B837000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2152249008.000001E56AE24000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149862292.000001E56AE24000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2162109762.000001E56AE2D000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148254781.000001E56AE24000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2152249008.000001E56AE24000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149862292.000001E56AE24000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2162148100.000001E56AF46000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2173601470.000001E56AE24000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2167795749.000001E56AE24000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149286844.000001E56AF43000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148254781.000001E56AE24000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2158550064.000001E56AF44000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153981511.000001E56A900000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149492998.000001E56B8CA000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2173601470.000001E56AE14000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2167985819.000001E56B8CB000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149862292.000001E56ADE4000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148786147.000001E56ADE4000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2152428525.000001E56AF64000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2175805119.000001E56B801000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2162039857.000001E56B8CB000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2155753188.000001E56A900000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2152656393.000001E56AE03000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2162526793.000001E56AF65000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2167873972.000001E56A900000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148970004.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174922062.000001E56B480000.00000004.00001000.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2162344319.000001E56B8CB000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2175168827.000001E56B6C4000.00000004.00001000.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148063041.000001E56B8B1000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2163064550.000001E56AF66000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148123811.000001E56AF53000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2175168827.000001E56B77C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2129611983.000001E56AF46000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148123811.000001E56AF53000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2175029093.000001E56B590000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2173078145.000001E56AA10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/library/itertools.html#recipes
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174404351.000001E56B040000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://foo/bar.tar.gz
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174404351.000001E56B040000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://foo/bar.tgz
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2175029093.000001E56B590000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://goo.gl/zeJZl.
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149129206.000001E56A567000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2152108173.000001E56A5D0000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2151591074.000001E56A5BA000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2152544966.000001E56A5D1000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149722324.000001E56A5B9000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2156205098.000001E56A5D7000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150211375.000001E56A5BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2158655483.000001E56A8AB000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2114566288.000001E56A7F2000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2130028800.000001E56A801000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2152904773.000001E56A89E000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148970004.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2130331062.000001E56A802000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2151092176.000001E56A833000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2156530452.000001E56A8A2000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2151506305.000001E56A878000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2151986261.000001E56A882000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148526607.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2155076119.000001E56A8A2000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150587578.000001E56A80C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/mail/
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2152249008.000001E56ADA5000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2114031169.000001E56ADA4000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148254781.000001E56AD80000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2114031169.000001E56ADE4000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149862292.000001E56ADE4000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148786147.000001E56ADE4000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2129134474.000001E56ADE4000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2152656393.000001E56AE03000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2129134474.000001E56AD84000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150297802.000001E56ADFF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2180285327.00007FF8A82B6000.00000040.00000001.01000000.00000014.sdmpString found in binary or memory: http://html4/loose.dtd
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174922062.000001E56B480000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ipinfo.io/
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2172694753.000001E56A7EF000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2152249008.000001E56AE24000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149862292.000001E56AE24000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2162226312.000001E56AE25000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149312596.000001E56A7C9000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148254781.000001E56AE24000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2155609929.000001E56A7DB000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2160114525.000001E56A7EE000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153078336.000001E56A7D4000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2173644199.000001E56AE28000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153823881.000001E56A7DA000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2158988561.000001E56A7ED000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2175029093.000001E56B590000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://mail.python.org/pipermail/python-dev/2012-June/120787.html.
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2152076176.000001E56A84F000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2158628343.000001E56A869000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153324985.000001E56A850000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2130028800.000001E56A801000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2172791241.000001E56A86B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2151896115.000001E56A835000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148970004.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2156887893.000001E56A85F000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2130331062.000001E56A802000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2151092176.000001E56A833000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2161275510.000001E56A86B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148526607.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150587578.000001E56A80C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.accv.es
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2147860222.000001E56AFBC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153154739.000001E56AFD5000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2129611983.000001E56AFBC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2154238899.000001E56B00D000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2152165593.000001E56AFBC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.accv.es0
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2152076176.000001E56A84F000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2158628343.000001E56A869000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153324985.000001E56A850000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2130028800.000001E56A801000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2172791241.000001E56A86B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2151896115.000001E56A835000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148970004.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2156887893.000001E56A85F000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2130331062.000001E56A802000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2151092176.000001E56A833000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2161275510.000001E56A86B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148526607.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150587578.000001E56A80C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.accv.esls
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069227190.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067899965.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069138202.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067543952.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068931999.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2072627396.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067206085.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068341888.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074006705.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069363713.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068056387.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068513556.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074584535.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068622239.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074151483.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2075005559.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069363713.000001F713780000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074767443.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2076128292.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068239339.000001F713774000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069227190.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068513556.000001F713780000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067899965.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069138202.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067543952.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068931999.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2072627396.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067206085.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068341888.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074006705.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069363713.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068056387.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068513556.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074584535.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068622239.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074151483.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2075005559.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068931999.000001F713780000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074767443.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2076128292.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2076128292.000001F713780000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069227190.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068513556.000001F713780000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067899965.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069138202.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067543952.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068931999.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2072627396.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067206085.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068341888.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074006705.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069363713.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068056387.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068513556.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074584535.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068622239.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074151483.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2075005559.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068931999.000001F713780000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074767443.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2076128292.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2076128292.000001F713780000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069227190.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067899965.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069138202.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067543952.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068931999.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2072627396.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067206085.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068341888.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074006705.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069363713.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068056387.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068513556.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074584535.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068622239.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074151483.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2075005559.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069363713.000001F713780000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074767443.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2076128292.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068239339.000001F713774000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0X
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174641409.000001E56B270000.00000004.00001000.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174776532.000001E56B370000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://opensource.apple.com/source/CF/CF-744.18/CFBinaryPList.c
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2163257172.000001E56AFC4000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2147860222.000001E56AFBC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148451310.000001E568804000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153154739.000001E56AFD5000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2161017939.000001E56880F000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2167119705.000001E568810000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2165643490.000001E568810000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2129611983.000001E56AFBC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2164191574.000001E568810000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2154707992.000001E56AFDF000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2152165593.000001E56AFBC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2162689823.000001E56AFE7000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2169600066.000001E568810000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2171072782.000001E568811000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148451310.000001E568804000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2161017939.000001E56880F000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2167119705.000001E568810000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2165643490.000001E568810000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2164191574.000001E568810000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2169600066.000001E568810000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2171072782.000001E568811000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/L
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148451310.000001E568804000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2161017939.000001E56880F000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2167119705.000001E568810000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2165643490.000001E568810000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2164191574.000001E568810000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2169600066.000001E568810000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2171072782.000001E568811000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/r
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2161759995.000001E56AF35000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149539299.000001E56AF23000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153413787.000001E56AF34000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2162148100.000001E56AF46000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2162526793.000001E56AF4A000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149569427.000001E56AF27000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2163561460.000001E56AF35000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149286844.000001E56AF43000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174050961.000001E56AF35000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2158550064.000001E56AF44000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150876302.000001E56AF33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc4880
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2175168827.000001E56B734000.00000004.00001000.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2161759995.000001E56AF35000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149539299.000001E56AF23000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153413787.000001E56AF34000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149569427.000001E56AF27000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2163561460.000001E56AF35000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2163734222.000001E56AF3F000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2175168827.000001E56B77C000.00000004.00001000.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150876302.000001E56AF33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc5297
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2161879195.000001E56B840000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2176379375.000001E56B848000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2162977462.000001E56B847000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153114034.000001E56B837000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc5869
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174922062.000001E56B480000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2172719318.000001E56A7FD000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149312596.000001E56A7C9000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2163370388.000001E56A7FA000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2155609929.000001E56A7DB000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2160114525.000001E56A7EE000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153078336.000001E56A7D4000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153823881.000001E56A7DA000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2158988561.000001E56A7ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://web.cs.ucdavis.edu/~rogaway/ocb/license.htm
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2152076176.000001E56A84F000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2158628343.000001E56A869000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153324985.000001E56A850000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2130028800.000001E56A801000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2172791241.000001E56A86B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2147860222.000001E56AFBC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153154739.000001E56AFD5000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2151896115.000001E56A835000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148970004.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2129611983.000001E56AFBC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2156887893.000001E56A85F000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2130331062.000001E56A802000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2151092176.000001E56A833000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2154238899.000001E56B00D000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2161275510.000001E56A86B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2152165593.000001E56AFBC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148526607.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150587578.000001E56A80C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2147860222.000001E56AFBC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153154739.000001E56AFD5000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2129611983.000001E56AFBC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2152165593.000001E56AFBC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2147860222.000001E56AFBC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153154739.000001E56AFD5000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2129611983.000001E56AFBC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2154238899.000001E56B00D000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2152165593.000001E56AFBC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2147860222.000001E56AFBC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153154739.000001E56AFD5000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2129611983.000001E56AFBC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2152165593.000001E56AFBC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2154478823.000001E56AFEA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/legislacion_c.htm
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2147860222.000001E56AFBC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153154739.000001E56AFD5000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2129611983.000001E56AFBC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2154238899.000001E56B00D000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2152165593.000001E56AFBC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2147860222.000001E56AFBC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153154739.000001E56AFD5000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2129611983.000001E56AFBC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2152165593.000001E56AFBC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/legislacion_c.htmQ
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2147860222.000001E56AFBC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153154739.000001E56AFD5000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2129611983.000001E56AFBC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2154238899.000001E56B00D000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2152165593.000001E56AFBC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2154478823.000001E56AFEA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es00
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2078426244.000001F713776000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2077333202.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2078506788.000001F713783000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2078426244.000001F713776000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2077333202.000001F713776000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2078326949.000001F713783000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2077231097.000001F713782000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174641409.000001E56B270000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2129134474.000001E56AE34000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150126891.000001E56AE8F000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2154933151.000001E56B7CA000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148185759.000001E56AE8B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2156146494.000001E56B7D1000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2161675441.000001E56AE90000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2161759995.000001E56AF35000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2162298286.000001E56AE33000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149539299.000001E56AF23000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153413787.000001E56AF34000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2152249008.000001E56AE24000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149862292.000001E56AE24000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2162109762.000001E56AE2D000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2162039857.000001E56B8C7000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149569427.000001E56AF27000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2163561460.000001E56AF35000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148254781.000001E56AE24000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148063041.000001E56B8B1000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174050961.000001E56AF35000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150876302.000001E56AF33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069227190.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067899965.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069138202.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067543952.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068931999.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2072627396.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067206085.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068341888.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074006705.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069363713.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068056387.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068513556.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074584535.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068622239.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074151483.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2075005559.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069363713.000001F713780000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074767443.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2076128292.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068239339.000001F713774000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153220403.000001E56B7E9000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2156624969.000001E56A737000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2154340783.000001E56B7EC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2175744097.000001E56B7F5000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149635986.000001E56A736000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2130028800.000001E56A730000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.firmaprofesional.com/cps0
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149208172.000001E56AD4B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149599042.000001E56AD50000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2107421454.000001E56AD4B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150028790.000001E56AD51000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2155036826.000001E56AD5C000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2106193421.000001E56AD4B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2151003021.000001E56AD5B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2169901438.000001E56A724000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153357373.000001E56A717000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2154971098.000001E56A717000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2169693402.000001E56A717000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cps
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2158411254.000001E56AF7B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2129611983.000001E56AF7B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149071492.000001E56AF7B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2168852886.000001E56AF7B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2162526793.000001E56AF7B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2170527644.000001E56AF7C000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174223261.000001E56AF82000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cps0
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2172719318.000001E56A7FD000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149312596.000001E56A7C9000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2163370388.000001E56A7FA000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2155609929.000001E56A7DB000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2160114525.000001E56A7EE000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153078336.000001E56A7D4000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153823881.000001E56A7DA000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2158988561.000001E56A7ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.rfc-editor.org/info/rfc7253
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2161879195.000001E56B840000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2176379375.000001E56B848000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2162977462.000001E56B847000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153114034.000001E56B837000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.tarsnap.com/scrypt/scrypt-slides.pdf
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2113515594.000001E56AEDC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153247356.000001E56AEB5000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149389775.000001E56AEAA000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150748061.000001E56AEB3000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2129134474.000001E56AEDC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2161148538.000001E56AEC5000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148185759.000001E56AE8B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150126891.000001E56AEAB000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2129611983.000001E56AF46000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148123811.000001E56AF53000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2173943318.000001E56AED7000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2155976220.000001E56AEBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wwwsearch.sf.net/):
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174922062.000001E56B480000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://api.ipify.org
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174922062.000001E56B480000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://api.ipify.orgp
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2076536809.000001F713774000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://badge.fury.io/py/autocommand)
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2076536809.000001F713774000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://badge.fury.io/py/autocommand.svg)
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2084693821.000001F713776000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2077514468.000001F713776000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2086559680.000001F713776000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2078525874.000001F713776000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2085644461.000001F713776000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2083238326.000001F71377C000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2084047965.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://blog.jaraco.com/skeleton
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2173168524.000001E56AB20000.00000004.00001000.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2172988120.000001E56A910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bugs.python.org/issue44497.
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2070948869.000001F713774000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cryptography.io
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2070948869.000001F713774000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cryptography.io/
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2070948869.000001F713774000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cryptography.io/en/latest/changelog/
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2070948869.000001F713774000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cryptography.io/en/latest/installation/
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2070948869.000001F713774000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cryptography.io/en/latest/security/
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.to/martinheinz/tour-of-python-itertools-4122
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2114566288.000001E56A7F2000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2130028800.000001E56A801000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2107034964.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2172839435.000001E56A879000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2105396074.000001E56A802000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148970004.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2105173612.000001E56A74D000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2130331062.000001E56A802000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2106010766.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2151092176.000001E56A833000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2151506305.000001E56A878000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148526607.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150587578.000001E56A80C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2076536809.000001F713774000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/argparse.html#description
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2076536809.000001F713774000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/argparse.html#epilog
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093166951.000001E56A51A000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093130528.000001E56A526000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2171306040.000001E56A160000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093166951.000001E56A51A000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093130528.000001E56A526000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2171306040.000001E56A1DC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093166951.000001E56A51A000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093130528.000001E56A526000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2171306040.000001E56A1DC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093166951.000001E56A51A000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093130528.000001E56A526000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2171306040.000001E56A1DC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093166951.000001E56A51A000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093130528.000001E56A526000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2171306040.000001E56A1DC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093166951.000001E56A51A000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2171527925.000001E56A410000.00000004.00001000.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093130528.000001E56A526000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093166951.000001E56A51A000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2171527925.000001E56A410000.00000004.00001000.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093130528.000001E56A526000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093166951.000001E56A51A000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093130528.000001E56A526000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2171306040.000001E56A1DC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2170035952.000001E56A520000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093166951.000001E56A51A000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2171669708.000001E56A521000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093130528.000001E56A526000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2166624295.000001E56A511000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093279273.000001E56A520000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093254721.000001E56A51B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2078525874.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#module-importlib.resources
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2077514468.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.metadata.html
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/itertools.html#itertools-recipes
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149208172.000001E56AD4B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150028790.000001E56AD4B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153543011.000001E56AD4B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2154542928.000001E56AD4C000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2151036781.000001E56AD4B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/multiprocessing.html
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2077514468.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/reference/import.html#finders-and-loaders
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174922062.000001E56B480000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2076443518.000001F713774000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://fsf.org/
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2173168524.000001E56AB20000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2076536809.000001F713774000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Lucretiel/autocommand
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2076536809.000001F713774000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Lucretiel/autocommand/issues
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2084693821.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Lucretiel/autocommand/issues/18
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149539299.000001E56AF23000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2171644995.000001E56A514000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2170035952.000001E56A520000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093166951.000001E56A51A000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2171669708.000001E56A521000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093130528.000001E56A526000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2166624295.000001E56A511000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093279273.000001E56A520000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093254721.000001E56A51B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2084693821.000001F713776000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2077514468.000001F713776000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2086559680.000001F713776000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2078525874.000001F713776000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2085644461.000001F713776000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2083238326.000001F71377C000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2084047965.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/astral-sh/ruff
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/bbayles
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/erikrose
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2175029093.000001E56B590000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/giampaolo/psutil/issues/875.
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2083374271.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jaraco/inflect
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2083238326.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jaraco/inflect/actions/workflows/main.yml/badge.svg
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2083238326.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jaraco/inflect/actions?query=workflow%3A%22tests%22
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2084047965.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jaraco/jaraco.collections
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2084047965.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jaraco/jaraco.collections/actions/workflows/main.yml/badge.svg
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2084047965.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jaraco/jaraco.collections/actions?query=workflow%3A%22tests%22
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2084693821.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jaraco/jaraco.context
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2084693821.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jaraco/jaraco.context/actions/workflows/main.yml/badge.svg
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2084693821.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jaraco/jaraco.context/actions?query=workflow%3A%22tests%22
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2085644461.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jaraco/jaraco.functools
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2085644461.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jaraco/jaraco.functools/actions/workflows/main.yml/badge.svg
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2085644461.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jaraco/jaraco.functools/actions?query=workflow%3A%22tests%22
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2172988120.000001E56A910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jaraco/jaraco.functools/issues/5
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2086559680.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jaraco/jaraco.text
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2086559680.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jaraco/jaraco.text/actions/workflows/main.yml/badge.svg
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2086559680.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jaraco/jaraco.text/actions?query=workflow%3A%22tests%22
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2084693821.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jaraco/keyring/commit/a85a7cbc6c909f8121660ed1f7b487f99a1c2bf7
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/more-itertools/more-itertools
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/more-itertools/more-itertools/graphs/contributors
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174641409.000001E56B270000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/platformdirs/platformdirs
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2175029093.000001E56B590000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/psf/requests/pull/6710
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2070948869.000001F713774000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyca/cryptography
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2070948869.000001F713774000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyca/cryptography/
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2070948869.000001F713774000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyca/cryptography/actions?query=workflow%3ACI
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2070948869.000001F713774000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyca/cryptography/issues
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2070948869.000001F713774000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2173168524.000001E56AB20000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/packaging
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2173168524.000001E56AB20000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/packagingR
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2173168524.000001E56AB20000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools/issues/1024.
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2172244793.000001E56A610000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools/issues/417#issuecomment-392298401
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2172988120.000001E56A910000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools/issues/new?template=distutils-deprecation.yml
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093166951.000001E56A51A000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093130528.000001E56A526000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2171306040.000001E56A1DC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093254721.000001E56A51B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2171644995.000001E56A514000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2170035952.000001E56A520000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093166951.000001E56A51A000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2171669708.000001E56A521000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093130528.000001E56A526000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2166624295.000001E56A511000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093279273.000001E56A520000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093254721.000001E56A51B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2114566288.000001E56A7F2000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2101568663.000001E56A813000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2130028800.000001E56A801000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2164410235.000001E56A819000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2107034964.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2098749871.000001E56A7FD000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2104574533.000001E56A80A000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2105396074.000001E56A802000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148970004.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2105173612.000001E56A74D000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2103030917.000001E56A811000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2130331062.000001E56A802000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2106010766.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2098411305.000001E56A7DB000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2098528400.000001E56A7C7000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148526607.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2156852481.000001E56A812000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2099464201.000001E56A815000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150587578.000001E56A80C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/issues/86361.
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2077514468.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/importlib_metadata
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2077514468.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/importlib_metadata/actions/workflows/main.yml/badge.svg
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2077514468.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/importlib_metadata/actions?query=workflow%3A%22tests%22
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2077514468.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/importlib_metadata/issues
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2078525874.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/importlib_resources
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2078525874.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/importlib_resources/actions/workflows/main.yml/badge.svg
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2078525874.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/importlib_resources/actions?query=workflow%3A%22tests%22
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2171644995.000001E56A514000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2170035952.000001E56A520000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093166951.000001E56A51A000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2171669708.000001E56A521000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093130528.000001E56A526000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2166624295.000001E56A511000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093279273.000001E56A520000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093254721.000001E56A51B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174922062.000001E56B480000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2129134474.000001E56AE34000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149351816.000001E56AE55000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2113842358.000001E56AE34000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2161969456.000001E56AE56000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148254781.000001E56AE24000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174922062.000001E56B480000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2175029093.000001E56B590000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/3290
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2175029093.000001E56B590000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/329020
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2160831903.000001E56AF28000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2170062046.000001E56ADEC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2161759995.000001E56AF2D000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2114031169.000001E56ADE4000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2157977161.000001E56AF1F000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2152249008.000001E56ADE4000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2160279326.000001E56ADEA000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149862292.000001E56ADE4000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148786147.000001E56ADE4000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149539299.000001E56AF23000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2129134474.000001E56ADE4000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2163491408.000001E56ADEC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149129206.000001E56A567000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149569427.000001E56AF27000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2151591074.000001E56A5BA000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149722324.000001E56A5B9000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2160831903.000001E56AF21000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2156325520.000001E56A5BC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150211375.000001E56A5BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2160831903.000001E56AF28000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2170062046.000001E56ADEC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2161759995.000001E56AF2D000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2114031169.000001E56ADE4000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2152249008.000001E56ADE4000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2160279326.000001E56ADEA000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149862292.000001E56ADE4000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148786147.000001E56ADE4000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149539299.000001E56AF23000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2129134474.000001E56ADE4000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2163491408.000001E56ADEC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149569427.000001E56AF27000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2154971098.000001E56A717000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail/
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153247356.000001E56AEB5000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2129134474.000001E56AE34000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149389775.000001E56AEAA000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150748061.000001E56AEB3000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2113842358.000001E56AE34000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148185759.000001E56AE8B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150126891.000001E56AEAB000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2169972366.000001E56AEBB000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2155976220.000001E56AEBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150211375.000001E56A5BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2164410235.000001E56A846000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149208172.000001E56AD4B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2130028800.000001E56A801000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2167668397.000001E56A846000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149599042.000001E56AD50000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2129134474.000001E56AE34000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150028790.000001E56AD51000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2152428525.000001E56AF64000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2155036826.000001E56AD5C000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2160500937.000001E56A837000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149351816.000001E56AE55000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2162526793.000001E56AF65000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2151896115.000001E56A835000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148970004.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2173739155.000001E56AE5A000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2130331062.000001E56A802000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149766092.000001E56ACC1000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2161969456.000001E56AE56000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148254781.000001E56AE24000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2168852886.000001E56AF65000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2151092176.000001E56A833000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/get
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2114566288.000001E56A7F2000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2130028800.000001E56A801000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2172839435.000001E56A879000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148970004.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2130331062.000001E56A802000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2151092176.000001E56A833000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2151506305.000001E56A878000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148526607.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150587578.000001E56A80C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/post
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2084693821.000001F713776000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2077514468.000001F713776000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2086559680.000001F713776000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2078525874.000001F713776000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2085644461.000001F713776000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2083238326.000001F71377C000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2084047965.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/badge/skeleton-2024-informational
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2084693821.000001F713776000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2077514468.000001F713776000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2086559680.000001F713776000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2078525874.000001F713776000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2085644461.000001F713776000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2083238326.000001F71377C000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2084047965.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/charliermarsh/ruff/main/assets
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2077514468.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/pypi/pyversions/importlib_metadata.svg
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2078525874.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/pypi/pyversions/importlib_resources.svg
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2083238326.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/pypi/pyversions/inflect.svg
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2084047965.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/pypi/pyversions/jaraco.collections.svg
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2084693821.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/pypi/pyversions/jaraco.context.svg
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2085644461.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/pypi/pyversions/jaraco.functools.svg
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2086559680.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/pypi/pyversions/jaraco.text.svg
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2070948869.000001F713774000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/pypi/v/cryptography.svg
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2077514468.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/pypi/v/importlib_metadata.svg
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2078525874.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/pypi/v/importlib_resources.svg
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2083238326.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/pypi/v/inflect.svg
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2084047965.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/pypi/v/jaraco.collections.svg
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2084693821.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/pypi/v/jaraco.context.svg
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2085644461.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/pypi/v/jaraco.functools.svg
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2086559680.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/pypi/v/jaraco.text.svg
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2077514468.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://importlib-metadata.readthedocs.io/
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2077514468.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://importlib-metadata.readthedocs.io/en/latest/?badge=latest
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2078525874.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://importlib-resources.readthedocs.io/
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2078525874.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://importlib-resources.readthedocs.io/en/latest/?badge=latest
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2173078145.000001E56AA10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://importlib-resources.readthedocs.io/en/latest/using.html#migrating-from-legacy
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2083238326.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://inflect.readthedocs.io/en/latest/?badge=latest
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2084047965.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://jaracocollections.readthedocs.io/en/latest/?badge=latest
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2084693821.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://jaracocontext.readthedocs.io/en/latest/?badge=latest
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2085644461.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://jaracofunctools.readthedocs.io/en/latest/?badge=latest
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2083374271.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://jaracotext.readthedocs.io/en/latest/#jaraco.text.WordSet
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2086559680.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://jaracotext.readthedocs.io/en/latest/?badge=latest
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153907383.000001E56ACC8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://json.org
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2114566288.000001E56A7F2000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2130028800.000001E56A801000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2107034964.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2104574533.000001E56A80A000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2168090340.000001E56A80F000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2105396074.000001E56A802000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148970004.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2105173612.000001E56A74D000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2158384713.000001E56A80E000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2130331062.000001E56A802000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2106010766.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2104280080.000001E56AC9D000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2104990087.000001E56ACB4000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2168350841.000001E56A810000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148526607.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150587578.000001E56A80C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mahler:8092/site-updates.py
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2070948869.000001F713774000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mail.python.org/mailman/listinfo/cryptography-dev
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://martinheinz.dev/blog/16
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.SequenceView
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.adjacent
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.all_equal
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.all_unique
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.always_iterable
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.always_reversible
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.batched
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.before_and_after
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.bucket
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.chunked
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.chunked_even
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.circular_shifts
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.classify_unique
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.collapse
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.combination_index
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.combination_with_replacement
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.consecutive_groups
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.constrained_batches
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.consume
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.consumer
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.convolve
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.count_cycle
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.countable
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.dft
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.difference
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.distinct_combinations
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.distinct_permutations
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.distribute
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.divide
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.dotproduct
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.doublestarmap
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.duplicates_everseen
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.duplicates_justseen
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.exactly_n
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.factor
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.filter_except
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.filter_map
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.first
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.first_true
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.flatten
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.gray_product
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.groupby_transform
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.grouper
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.ichunked
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.idft
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.iequals
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.ilen
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.interleave
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.interleave_evenly
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.interleave_longest
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.intersperse
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.is_sorted
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.islice_extended
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.iter_except
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.iter_index
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.iter_suppress
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.iterate
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.join_mappings
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.last
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.locate
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.longest_common_prefix
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.lstrip
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.make_decorator
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.map_except
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.map_reduce
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.mark_ends
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.matmul
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.minmax
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.ncycles
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.nth
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.nth_combination
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.nth_combination_with_replace
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.nth_or_last
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.nth_permutation
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.nth_product
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.numeric_range
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.one
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.only
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.outer_product
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.pad_none
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.padded
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.pairwise
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.partial_product
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.partition
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.partitions
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.peekable
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.permutation_index
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.polynomial_derivative
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.polynomial_eval
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.polynomial_from_roots
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.powerset
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.powerset_of_sets
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.prepend
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.product_index
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.quantify
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.random_combination
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.random_combination_with_repl
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.random_permutation
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.random_product
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.repeat_each
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.repeat_last
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.repeatfunc
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.replace
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.reshape
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.rlocate
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.roundrobin
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.rstrip
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.run_length
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.sample
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.seekable
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.set_partitions
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.side_effect
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.sieve
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.sliced
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.sliding_window
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.sort_together
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.split_after
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.split_at
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.split_before
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.split_into
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.split_when
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.spy
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.stagger
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.strictly_n
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.strip
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.subslices
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.substrings
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.substrings_indexes
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.sum_of_squares
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.tabulate
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.tail
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.take
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.takewhile_inclusive
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.time_limited
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.totient
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.transpose
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.triplewise
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.unique
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.unique_everseen
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.unique_in_window
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.unique_justseen
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.unique_to_each
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.unzip
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.value_chain
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.windowed
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.windowed_complete
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.with_iter
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.zip_broadcast
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.zip_equal
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.zip_offset
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://more-itertools.readthedocs.io/en/stable/versions.html
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2162344319.000001E56B8C2000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2176546711.000001E56B8C2000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148063041.000001E56B8B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2114031169.000001E56ADE4000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149862292.000001E56ADE4000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148786147.000001E56ADE4000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2110237158.000001E56AE03000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2129134474.000001E56ADE4000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2107209870.000001E56ADF9000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2152656393.000001E56AE03000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174641409.000001E56B270000.00000004.00001000.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2107944208.000001E56ADFB000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150297802.000001E56ADFF000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2167795749.000001E56AE04000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/guides/packaging-namespace-packages/.
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174776532.000001E56B370000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/specifications/core-metadata/
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174404351.000001E56B040000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/specifications/entry-points/
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2114566288.000001E56A7F2000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2130028800.000001E56A801000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2107034964.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2156098513.000001E56A883000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2107209870.000001E56ADF9000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2156782904.000001E56A883000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148970004.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2130331062.000001E56A802000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2159836039.000001E56A88D000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2151092176.000001E56A833000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2151506305.000001E56A878000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2151986261.000001E56A882000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148526607.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150587578.000001E56A80C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/specifications/pyproject-toml/#declaring-project-metadata-the
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2114031169.000001E56ADE4000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149862292.000001E56ADE4000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148786147.000001E56ADE4000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2110237158.000001E56AE03000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2129134474.000001E56ADE4000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2107209870.000001E56ADF9000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2152656393.000001E56AE03000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2107944208.000001E56ADFB000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174404351.000001E56B040000.00000004.00001000.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150297802.000001E56ADFF000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2167795749.000001E56AE04000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2084693821.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://path.readthedocs.io/en/latest/api.html
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2101568663.000001E56A86B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2173078145.000001E56AA10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://peps.python.org/pep-0205/
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2185017528.00007FF8A8C74000.00000040.00000001.01000000.00000004.sdmpString found in binary or memory: https://peps.python.org/pep-0263/
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174776532.000001E56B370000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://peps.python.org/pep-0685/
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pip.pypa.io/en/stable/
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174532215.000001E56B140000.00000004.00001000.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174776532.000001E56B370000.00000004.00001000.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174404351.000001E56B040000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/build/).
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2070948869.000001F713774000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/cryptography/
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2077514468.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/importlib_metadata
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2078525874.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/importlib_resources
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2083238326.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/inflect
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2084047965.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/jaraco.collections
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2084693821.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/jaraco.context
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2085644461.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/jaraco.functools
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2086559680.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/jaraco.text
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2083519654.000001F713783000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2083374271.000001F713776000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2083238326.000001F713783000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/word2number/
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2070948869.000001F713774000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://readthedocs.org/projects/cryptography/badge/?version=latest
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2077514468.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://readthedocs.org/projects/importlib-metadata/badge/?version=latest
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2078525874.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://readthedocs.org/projects/importlib-resources/badge/?version=latest
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2083238326.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://readthedocs.org/projects/inflect/badge/?version=latest
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2084047965.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://readthedocs.org/projects/jaracocollections/badge/?version=latest
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2084693821.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://readthedocs.org/projects/jaracocontext/badge/?version=latest
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2085644461.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://readthedocs.org/projects/jaracofunctools/badge/?version=latest
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2086559680.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://readthedocs.org/projects/jaracotext/badge/?version=latest
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://readthedocs.org/projects/more-itertools/badge/?version=latest
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2173168524.000001E56AB20000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://refspecs.linuxfoundation.org/elf/gabi4
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2114566288.000001E56A7F2000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2130028800.000001E56A801000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2172839435.000001E56A879000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148970004.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2130331062.000001E56A802000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2151092176.000001E56A833000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2151506305.000001E56A878000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148526607.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150587578.000001E56A80C000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2175029093.000001E56B590000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://requests.readthedocs.io
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174641409.000001E56B270000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174641409.000001E56B270000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/0Y2k
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174641409.000001E56B270000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/pA2k
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2109889076.000001E56AE5B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2107421454.000001E56AE54000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2107353225.000001E56AF02000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2113515594.000001E56AEDC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2129134474.000001E56AEDC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2107353225.000001E56AEAA000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150431006.000001E56AC5D000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2107353225.000001E56AF02000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174776532.000001E56B370000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174776532.000001E56B370000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages0
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2107353225.000001E56AEAA000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2107353225.000001E56AF02000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr;
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2107353225.000001E56AEAA000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2107353225.000001E56AF02000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr;r
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2078525874.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.readthedocs.io/en/latest/pkg_resources.html
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150126891.000001E56AE8F000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148185759.000001E56AE8B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2161675441.000001E56AE90000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2162763177.000001E56AE99000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2175029093.000001E56B590000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/questions/4457745#4457745.
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174776532.000001E56B370000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://steamcomunty.com
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2176719353.000001E56C010000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://steamcomunty.com/software/AI-Setup4k
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174776532.000001E56B370000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://steamcomunty.comfo
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2077514468.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/badges/package/pypi/importlib-metadata
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2078525874.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/badges/package/pypi/importlib-resources
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2083238326.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/badges/package/pypi/inflect
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2084047965.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/badges/package/pypi/jaraco.collections
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2084693821.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/badges/package/pypi/jaraco.context
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2085644461.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/badges/package/pypi/jaraco.functools
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2086559680.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/badges/package/pypi/jaraco.text
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2083519654.000001F713783000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2083374271.000001F713776000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2083238326.000001F713783000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/subscription/pkg/pypi-PROJECT?utm_source=pypi-PROJECT&utm_medium=referral&utm_c
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2077514468.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/subscription/pkg/pypi-importlib-metadata?utm_source=pypi-importlib-metadata&utm
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2078525874.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/subscription/pkg/pypi-importlib-resources?utm_source=pypi-importlib-resources&u
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2083238326.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/subscription/pkg/pypi-inflect?utm_source=pypi-inflect&utm_medium=readme
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2084047965.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/subscription/pkg/pypi-jaraco.collections?utm_source=pypi-jaraco.collections&utm
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2084693821.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/subscription/pkg/pypi-jaraco.context?utm_source=pypi-jaraco.context&utm_medium=
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2085644461.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/subscription/pkg/pypi-jaraco.functools?utm_source=pypi-jaraco.functools&utm_med
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2086559680.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/subscription/pkg/pypi-jaraco.text?utm_source=pypi-jaraco.text&utm_medium=readme
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2086559680.000001F713776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/subscription/pkg/pypi-jaraco.text?utm_source=pypi-jaraco.text&utm_medium=referr
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149208172.000001E56ACD6000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2157050109.000001E56ACDC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150028790.000001E56ACD7000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2160536074.000001E56ACDC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2161879195.000001E56B840000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2162298286.000001E56AE33000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153114034.000001E56B837000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2152249008.000001E56AE24000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149862292.000001E56AE24000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2162109762.000001E56AE2D000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148254781.000001E56AE24000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc3610
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2161759995.000001E56AF35000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2162298286.000001E56AE33000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149539299.000001E56AF23000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153413787.000001E56AF34000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2152249008.000001E56AE24000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149862292.000001E56AE24000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2162109762.000001E56AE2D000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2162039857.000001E56B8C7000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149569427.000001E56AF27000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2163561460.000001E56AF35000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148254781.000001E56AE24000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148063041.000001E56B8B1000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174050961.000001E56AF35000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150876302.000001E56AF33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc5297
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2105521390.000001E56AD5B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150948403.000001E56A74E000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2107421454.000001E56AD4B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2107034964.000001E56A738000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2106193421.000001E56AD4B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2158080452.000001E56A750000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2105173612.000001E56A74D000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2106010766.000001E56A74C000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2104990087.000001E56AD4B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2155439540.000001E56A74F000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149635986.000001E56A736000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc7231#section-4.3.6)
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2157977161.000001E56AF1F000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149129206.000001E56A567000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2151591074.000001E56A5BA000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149722324.000001E56A5B9000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2160831903.000001E56AF21000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2156325520.000001E56A5BC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150211375.000001E56A5BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174922062.000001E56B480000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174922062.000001E56B480000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxyp
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174922062.000001E56B480000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174922062.000001E56B480000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings0
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2114566288.000001E56A7F2000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2130028800.000001E56A801000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2107034964.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2156098513.000001E56A883000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2101993721.000001E56AC60000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2104574533.000001E56A80A000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2103900550.000001E56A872000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2156782904.000001E56A883000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2105396074.000001E56A802000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148970004.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2105173612.000001E56A74D000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2103030917.000001E56A811000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2130331062.000001E56A802000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2106010766.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2151092176.000001E56A833000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2101993721.000001E56AC21000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2151506305.000001E56A878000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2151986261.000001E56A882000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148526607.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150587578.000001E56A80C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www-cs-faculty.stanford.edu/~knuth/fasc2a.ps.gz
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2071478189.000001F713774000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.apache.org/licenses/
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2071478189.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2071553150.000001F713782000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2071478189.000001F713781000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.bbayles.com/index/decorator_factory
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.gidware.com/real-world-more-itertools/
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153981511.000001E56A900000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2155753188.000001E56A900000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2167873972.000001E56A900000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148970004.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149442481.000001E56A8FF000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148526607.000001E56A809000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ietf.org/rfc/rfc2898.txt
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074151483.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2184936820.00007FF8A8839000.00000004.00000001.01000000.0000000C.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2186571704.00007FF8A9398000.00000004.00000001.01000000.00000012.sdmpString found in binary or memory: https://www.openssl.org/H
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2114566288.000001E56A7F2000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2130028800.000001E56A801000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2172839435.000001E56A879000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148970004.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2130331062.000001E56A802000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2151092176.000001E56A833000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2151506305.000001E56A878000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148526607.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150587578.000001E56A80C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2114566288.000001E56A7F2000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2130028800.000001E56A801000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2107034964.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2104574533.000001E56A80A000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2168090340.000001E56A80F000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2105396074.000001E56A802000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148970004.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2105173612.000001E56A74D000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2158384713.000001E56A80E000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2130331062.000001E56A802000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2106010766.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2104280080.000001E56AC9D000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2104990087.000001E56ACB4000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2168350841.000001E56A810000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148526607.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150587578.000001E56A80C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2171306040.000001E56A160000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2185017528.00007FF8A8D72000.00000040.00000001.01000000.00000004.sdmpString found in binary or memory: https://www.python.org/psf/license/
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2185017528.00007FF8A8C74000.00000040.00000001.01000000.00000004.sdmpString found in binary or memory: https://www.python.org/psf/license/)
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149208172.000001E56AD4B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153247356.000001E56AEB5000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2157943368.000001E56AEB5000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149599042.000001E56AD50000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2129134474.000001E56AE34000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149389775.000001E56AEAA000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150748061.000001E56AEB3000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150028790.000001E56AD51000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2156295858.000001E56AD54000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2113842358.000001E56AE34000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148185759.000001E56AE8B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150126891.000001E56AEAB000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2161842516.000001E56AEB5000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2154542928.000001E56AD54000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2173897049.000001E56AEB9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2154340783.000001E56B7D4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wwww.certigna.fr/autorites/
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2157228187.000001E56ACCA000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2161058354.000001E56ACCD000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149766092.000001E56ACC1000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153907383.000001E56ACC8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2154340783.000001E56B7D4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wwww.certigna.fr/autorites/W
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2160831903.000001E56AF28000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2170062046.000001E56ADEC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2161759995.000001E56AF2D000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2114031169.000001E56ADE4000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2152249008.000001E56ADE4000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2160279326.000001E56ADEA000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149862292.000001E56ADE4000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148786147.000001E56ADE4000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149539299.000001E56AF23000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2129134474.000001E56ADE4000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2163491408.000001E56ADEC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149569427.000001E56AF27000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://yahoo.com/
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49711
Source: unknownNetwork traffic detected: HTTP traffic on port 49711 -> 443
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E2175C000_2_00007FF6E2175C00
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E21769640_2_00007FF6E2176964
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E21589E00_2_00007FF6E21589E0
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E21510000_2_00007FF6E2151000
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E2161B500_2_00007FF6E2161B50
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E21764180_2_00007FF6E2176418
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E21708C80_2_00007FF6E21708C8
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E2173C100_2_00007FF6E2173C10
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E2162C100_2_00007FF6E2162C10
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E215ACAD0_2_00007FF6E215ACAD
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E215A47B0_2_00007FF6E215A47B
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E2165D300_2_00007FF6E2165D30
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E21621640_2_00007FF6E2162164
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E21619440_2_00007FF6E2161944
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E21639A40_2_00007FF6E21639A4
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E216DA5C0_2_00007FF6E216DA5C
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E215A2DB0_2_00007FF6E215A2DB
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E2161F600_2_00007FF6E2161F60
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E21617400_2_00007FF6E2161740
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E21687940_2_00007FF6E2168794
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E21598000_2_00007FF6E2159800
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E21718740_2_00007FF6E2171874
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E21740AC0_2_00007FF6E21740AC
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E21680E40_2_00007FF6E21680E4
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E21708C80_2_00007FF6E21708C8
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E216E5700_2_00007FF6E216E570
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E2161D540_2_00007FF6E2161D54
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E21635A00_2_00007FF6E21635A0
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E2169EA00_2_00007FF6E2169EA0
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E2175E7C0_2_00007FF6E2175E7C
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E216DEF00_2_00007FF6E216DEF0
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E21797280_2_00007FF6E2179728
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF6E21769642_2_00007FF6E2176964
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF6E21510002_2_00007FF6E2151000
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF6E2161B502_2_00007FF6E2161B50
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF6E21764182_2_00007FF6E2176418
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF6E21708C82_2_00007FF6E21708C8
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF6E2175C002_2_00007FF6E2175C00
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF6E2173C102_2_00007FF6E2173C10
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF6E2162C102_2_00007FF6E2162C10
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF6E215ACAD2_2_00007FF6E215ACAD
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF6E215A47B2_2_00007FF6E215A47B
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF6E2165D302_2_00007FF6E2165D30
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF6E21621642_2_00007FF6E2162164
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF6E21619442_2_00007FF6E2161944
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF6E21639A42_2_00007FF6E21639A4
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF6E21589E02_2_00007FF6E21589E0
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF6E216DA5C2_2_00007FF6E216DA5C
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF6E215A2DB2_2_00007FF6E215A2DB
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF6E2161F602_2_00007FF6E2161F60
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF6E21617402_2_00007FF6E2161740
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF6E21687942_2_00007FF6E2168794
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF6E21598002_2_00007FF6E2159800
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF6E21718742_2_00007FF6E2171874
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF6E21740AC2_2_00007FF6E21740AC
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF6E21680E42_2_00007FF6E21680E4
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF6E21708C82_2_00007FF6E21708C8
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF6E216E5702_2_00007FF6E216E570
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF6E2161D542_2_00007FF6E2161D54
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF6E21635A02_2_00007FF6E21635A0
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF6E2169EA02_2_00007FF6E2169EA0
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF6E2175E7C2_2_00007FF6E2175E7C
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF6E216DEF02_2_00007FF6E216DEF0
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF6E21797282_2_00007FF6E2179728
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A81412F02_2_00007FF8A81412F0
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A81418A02_2_00007FF8A81418A0
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A8292B302_2_00007FF8A8292B30
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A828C9302_2_00007FF8A828C930
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A82969102_2_00007FF8A8296910
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A82667102_2_00007FF8A8266710
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A8290F002_2_00007FF8A8290F00
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A82AFF002_2_00007FF8A82AFF00
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A82A95002_2_00007FF8A82A9500
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A826DF702_2_00007FF8A826DF70
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A82AB7602_2_00007FF8A82AB760
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A82927502_2_00007FF8A8292750
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A826B3502_2_00007FF8A826B350
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A82A09402_2_00007FF8A82A0940
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A82759402_2_00007FF8A8275940
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A82B1BB02_2_00007FF8A82B1BB0
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A8263DB02_2_00007FF8A8263DB0
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A826A5B02_2_00007FF8A826A5B0
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A82A7DA02_2_00007FF8A82A7DA0
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A82747A02_2_00007FF8A82747A0
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A8296F902_2_00007FF8A8296F90
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A82AC3902_2_00007FF8A82AC390
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A826C9902_2_00007FF8A826C990
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A82B09F02_2_00007FF8A82B09F0
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A8265BF02_2_00007FF8A8265BF0
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A82769F02_2_00007FF8A82769F0
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A8289DE02_2_00007FF8A8289DE0
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A82ADBC02_2_00007FF8A82ADBC0
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A82942302_2_00007FF8A8294230
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A828FA302_2_00007FF8A828FA30
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A828F6202_2_00007FF8A828F620
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A8272A202_2_00007FF8A8272A20
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A82A70102_2_00007FF8A82A7010
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A828B6702_2_00007FF8A828B670
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A828A8602_2_00007FF8A828A860
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A8295C502_2_00007FF8A8295C50
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A82A06502_2_00007FF8A82A0650
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A82AF4502_2_00007FF8A82AF450
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A827BA502_2_00007FF8A827BA50
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A82A76B02_2_00007FF8A82A76B0
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A82AE8B02_2_00007FF8A82AE8B0
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A82974A02_2_00007FF8A82974A0
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A82B22802_2_00007FF8A82B2280
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A82A7AF02_2_00007FF8A82A7AF0
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A82946E02_2_00007FF8A82946E0
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A828E0E02_2_00007FF8A828E0E0
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A82912E02_2_00007FF8A82912E0
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A828B2C02_2_00007FF8A828B2C0
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A82678BB2_2_00007FF8A82678BB
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A82620C02_2_00007FF8A82620C0
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A8277EC02_2_00007FF8A8277EC0
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A8837B302_2_00007FF8A8837B30
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A8F310002_2_00007FF8A8F31000
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A93972002_2_00007FF8A9397200
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A9308AA02_2_00007FF8A9308AA0
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A92D1A0F2_2_00007FF8A92D1A0F
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A92D1CC12_2_00007FF8A92D1CC1
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A92D16FE2_2_00007FF8A92D16FE
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A92D8BE02_2_00007FF8A92D8BE0
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A92D143D2_2_00007FF8A92D143D
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A933CDA02_2_00007FF8A933CDA0
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A92D27162_2_00007FF8A92D2716
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A92D11812_2_00007FF8A92D1181
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A92D16132_2_00007FF8A92D1613
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A92D262B2_2_00007FF8A92D262B
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A92D17F82_2_00007FF8A92D17F8
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A9310F902_2_00007FF8A9310F90
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A92F62902_2_00007FF8A92F6290
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A92D1AD72_2_00007FF8A92D1AD7
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A92D1EE72_2_00007FF8A92D1EE7
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A92D1D982_2_00007FF8A92D1D98
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A92D1B542_2_00007FF8A92D1B54
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A934A7402_2_00007FF8A934A740
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A92D11722_2_00007FF8A92D1172
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A92D1FE62_2_00007FF8A92D1FE6
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A931D9602_2_00007FF8A931D960
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A93199A02_2_00007FF8A93199A0
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A931DE302_2_00007FF8A931DE30
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A92D15412_2_00007FF8A92D1541
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A92D15912_2_00007FF8A92D1591
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A9315DC02_2_00007FF8A9315DC0
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A92FBD802_2_00007FF8A92FBD80
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A92D21F32_2_00007FF8A92D21F3
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A92D24EB2_2_00007FF8A92D24EB
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A92D149C2_2_00007FF8A92D149C
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: String function: 00007FF8A934CE79 appears 38 times
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: String function: 00007FF6E2152910 appears 34 times
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: String function: 00007FF8A934D545 appears 35 times
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: String function: 00007FF8A934D551 appears 60 times
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: String function: 00007FF8A92D132A appears 436 times
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: String function: 00007FF6E2152710 appears 104 times
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: String function: 00007FF8A934CD8F appears 253 times
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: String function: 00007FF8A934CDA1 appears 973 times
Source: _overlapped.pyd.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: python3.dll.0.drStatic PE information: No import functions for PE file found
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069227190.000001F713774000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs tor-browser-windows-x86_64-portable-14.0.2.exe
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067899965.000001F713774000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs tor-browser-windows-x86_64-portable-14.0.2.exe
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069138202.000001F713774000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs tor-browser-windows-x86_64-portable-14.0.2.exe
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067543952.000001F713774000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs tor-browser-windows-x86_64-portable-14.0.2.exe
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068931999.000001F713774000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs tor-browser-windows-x86_64-portable-14.0.2.exe
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067206085.000001F713774000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_asyncio.pyd. vs tor-browser-windows-x86_64-portable-14.0.2.exe
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068341888.000001F713774000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs tor-browser-windows-x86_64-portable-14.0.2.exe
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2069363713.000001F713774000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_wmi.pyd. vs tor-browser-windows-x86_64-portable-14.0.2.exe
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068056387.000001F713774000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_decimal.pyd. vs tor-browser-windows-x86_64-portable-14.0.2.exe
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068513556.000001F713774000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_multiprocessing.pyd. vs tor-browser-windows-x86_64-portable-14.0.2.exe
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074584535.000001F713774000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepyexpat.pyd. vs tor-browser-windows-x86_64-portable-14.0.2.exe
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068622239.000001F713774000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_overlapped.pyd. vs tor-browser-windows-x86_64-portable-14.0.2.exe
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074151483.000001F713774000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibsslH vs tor-browser-windows-x86_64-portable-14.0.2.exe
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067053849.000001F713774000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs tor-browser-windows-x86_64-portable-14.0.2.exe
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074767443.000001F713774000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepython3.dll. vs tor-browser-windows-x86_64-portable-14.0.2.exe
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2076128292.000001F713774000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs tor-browser-windows-x86_64-portable-14.0.2.exe
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2068239339.000001F713774000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs tor-browser-windows-x86_64-portable-14.0.2.exe
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2191738950.00007FF8B8B14000.00000004.00000001.01000000.0000000B.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs tor-browser-windows-x86_64-portable-14.0.2.exe
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2191973191.00007FF8B8B4C000.00000004.00000001.01000000.0000000A.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs tor-browser-windows-x86_64-portable-14.0.2.exe
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2190857640.00007FF8B7E68000.00000004.00000001.01000000.0000000F.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs tor-browser-windows-x86_64-portable-14.0.2.exe
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2180136487.00007FF8A825A000.00000004.00000001.01000000.00000017.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs tor-browser-windows-x86_64-portable-14.0.2.exe
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2193031502.00007FF8B93D8000.00000004.00000001.01000000.00000009.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs tor-browser-windows-x86_64-portable-14.0.2.exe
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2193286849.00007FF8B984C000.00000004.00000001.01000000.0000000E.sdmpBinary or memory string: OriginalFilename_wmi.pyd. vs tor-browser-windows-x86_64-portable-14.0.2.exe
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2192397727.00007FF8B8CBC000.00000004.00000001.01000000.00000010.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs tor-browser-windows-x86_64-portable-14.0.2.exe
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2190564749.00007FF8B7E42000.00000004.00000001.01000000.00000011.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs tor-browser-windows-x86_64-portable-14.0.2.exe
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2184936820.00007FF8A8839000.00000004.00000001.01000000.0000000C.sdmpBinary or memory string: OriginalFilenamelibcryptoH vs tor-browser-windows-x86_64-portable-14.0.2.exe
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2186571704.00007FF8A9398000.00000004.00000001.01000000.00000012.sdmpBinary or memory string: OriginalFilenamelibsslH vs tor-browser-windows-x86_64-portable-14.0.2.exe
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2192848999.00007FF8B8F94000.00000004.00000001.01000000.00000007.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs tor-browser-windows-x86_64-portable-14.0.2.exe
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2190027837.00007FF8B78C3000.00000004.00000001.01000000.00000013.sdmpBinary or memory string: OriginalFilenamepyexpat.pyd. vs tor-browser-windows-x86_64-portable-14.0.2.exe
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2186150546.00007FF8A8F32000.00000004.00000001.01000000.00000004.sdmpBinary or memory string: OriginalFilenamepython312.dll. vs tor-browser-windows-x86_64-portable-14.0.2.exe
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2171414817.000001E56A270000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: OriginalFilenamepython3.dll. vs tor-browser-windows-x86_64-portable-14.0.2.exe
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2193797736.00007FF8BA4FC000.00000004.00000001.01000000.0000000D.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs tor-browser-windows-x86_64-portable-14.0.2.exe
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2193529097.00007FF8BA257000.00000002.00000001.01000000.00000005.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs tor-browser-windows-x86_64-portable-14.0.2.exe
Source: libcrypto-3.dll.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.9989650991958289
Source: libssl-3.dll.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.9923451741536459
Source: python312.dll.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.9994210643762751
Source: _ec_ws.pyd.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.9980750902889246
Source: _brotli.cp312-win_amd64.pyd.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.994288643715342
Source: unicodedata.pyd.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.9942978533094812
Source: classification engineClassification label: sus36.winEXE@3/192@1/1
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882Jump to behavior
Source: tor-browser-windows-x86_64-portable-14.0.2.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: tor-browser-windows-x86_64-portable-14.0.2.exeString found in binary or memory: t xml:space=.gif" border="0"</body> </html> overflow:hidden;img src="http://addEventListenerresponsible for s.js"></script> /favicon.ico" />operating system" style="width:1target="_blank">State Universitytext-align:left; document.write(, including the around t
Source: tor-browser-windows-x86_64-portable-14.0.2.exeString found in binary or memory: set-addPolicy
Source: tor-browser-windows-x86_64-portable-14.0.2.exeString found in binary or memory: id-cmc-addExtensions
Source: tor-browser-windows-x86_64-portable-14.0.2.exeString found in binary or memory: can't send non-None value to a just-started coroutine
Source: tor-browser-windows-x86_64-portable-14.0.2.exeString found in binary or memory: when smaller code objects and pyc files are desired as well as suppressing the extra visual location indicators when the interpreter displays tracebacks. These variables have equivalent command-line parameters (see --help for details): PYTHONDEBUG
Source: tor-browser-windows-x86_64-portable-14.0.2.exeString found in binary or memory: when smaller code objects and pyc files are desired as well as suppressing the extra visual location indicators when the interpreter displays tracebacks. These variables have equivalent command-line parameters (see --help for details): PYTHONDEBUG
Source: tor-browser-windows-x86_64-portable-14.0.2.exeString found in binary or memory: --help
Source: tor-browser-windows-x86_64-portable-14.0.2.exeString found in binary or memory: --help
Source: tor-browser-windows-x86_64-portable-14.0.2.exeString found in binary or memory: can't send non-None value to a just-started async generator
Source: tor-browser-windows-x86_64-portable-14.0.2.exeString found in binary or memory: can't send non-None value to a just-started generator
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile read: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe "C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe"
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeProcess created: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe "C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe"
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeProcess created: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe "C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe"Jump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeSection loaded: libffi-8.dllJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeSection loaded: libcrypto-3.dllJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeSection loaded: libssl-3.dllJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeSection loaded: pdh.dllJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeSection loaded: kernel.appcore.dllJump to behavior
Source: tor-browser-windows-x86_64-portable-14.0.2.exeStatic PE information: certificate valid
Source: tor-browser-windows-x86_64-portable-14.0.2.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: tor-browser-windows-x86_64-portable-14.0.2.exeStatic file information: File size 14451360 > 1048576
Source: tor-browser-windows-x86_64-portable-14.0.2.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: tor-browser-windows-x86_64-portable-14.0.2.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: tor-browser-windows-x86_64-portable-14.0.2.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: tor-browser-windows-x86_64-portable-14.0.2.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: tor-browser-windows-x86_64-portable-14.0.2.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: tor-browser-windows-x86_64-portable-14.0.2.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: tor-browser-windows-x86_64-portable-14.0.2.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: tor-browser-windows-x86_64-portable-14.0.2.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: D:\a\1\b\bin\amd64\python312.pdb source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2185017528.00007FF8A8C74000.00000040.00000001.01000000.00000004.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2192284158.00007FF8B8CB1000.00000040.00000001.01000000.00000010.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2177832756.00007FF8A824F000.00000040.00000001.01000000.00000017.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2192521953.00007FF8B8F71000.00000040.00000001.01000000.00000007.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2191580810.00007FF8B8B07000.00000040.00000001.01000000.0000000B.sdmp
Source: Binary string: D:\a\1\b\libssl-3.pdbEE source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2186211945.00007FF8A9355000.00000040.00000001.01000000.00000012.sdmp
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICOpenSSL 3.0.11 19 Sep 20233.0.11built on: Wed Sep 27 22:33:28 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC;CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL || WITHIN_ARENA(temp->next)assertion failed: (char **)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) || WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/*0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_push_octet_ptrOSSL_PARAM_BLD_to_param..\s\crypto\params.c source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2182879352.00007FF8A86E2000.00000040.00000001.01000000.0000000C.sdmp
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: tor-browser-windows-x86_64-portable-14.0.2.exe, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2182879352.00007FF8A86E2000.00000040.00000001.01000000.0000000C.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2189868208.00007FF8B7891000.00000040.00000001.01000000.00000013.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2193635662.00007FF8BA4F1000.00000040.00000001.01000000.0000000D.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2192912021.00007FF8B93C1000.00000040.00000001.01000000.00000009.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067053849.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2193430091.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2193117388.00007FF8B9841000.00000040.00000001.01000000.0000000E.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2067053849.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2193430091.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2190666664.00007FF8B7E51000.00000040.00000001.01000000.0000000F.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_wmi.pdb''&GCTL source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2193117388.00007FF8B9841000.00000040.00000001.01000000.0000000E.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2074767443.000001F713774000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2171414817.000001E56A270000.00000002.00000001.01000000.00000006.sdmp
Source: Binary string: D:\a\1\b\libssl-3.pdb source: tor-browser-windows-x86_64-portable-14.0.2.exe, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2186211945.00007FF8A9355000.00000040.00000001.01000000.00000012.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2190383413.00007FF8B7E11000.00000040.00000001.01000000.00000011.sdmp
Source: tor-browser-windows-x86_64-portable-14.0.2.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: tor-browser-windows-x86_64-portable-14.0.2.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: tor-browser-windows-x86_64-portable-14.0.2.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: tor-browser-windows-x86_64-portable-14.0.2.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: tor-browser-windows-x86_64-portable-14.0.2.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A8837B30 EntryPoint,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect,2_2_00007FF8A8837B30
Source: VCRUNTIME140.dll.0.drStatic PE information: section name: _RDATA
Source: libffi-8.dll.0.drStatic PE information: section name: UPX2
Source: _rust.pyd.0.drStatic PE information: section name: UPX2
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A8145D06 push r12; ret 2_2_00007FF8A8145D08
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A8145DF7 push r10; retf 2_2_00007FF8A8145DFA
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A8148DBF push rsp; retf 2_2_00007FF8A8148DC0
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A8145E18 push rsp; ret 2_2_00007FF8A8145E1C
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A8145E67 push rdi; iretd 2_2_00007FF8A8145E69
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A814763E push rbp; retf 2_2_00007FF8A8147657
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A8145EB4 push rsp; iretd 2_2_00007FF8A8145EB5
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A8147689 push r12; ret 2_2_00007FF8A81476CD
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A81482D8 push rdi; iretd 2_2_00007FF8A81482DA
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A8149327 push rsp; ret 2_2_00007FF8A8149328
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A8145F01 push r12; ret 2_2_00007FF8A8145F10
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A8147F67 push rbp; iretq 2_2_00007FF8A8147F68
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A8148F42 push rsp; iretq 2_2_00007FF8A8148F43
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A8145F56 push r12; ret 2_2_00007FF8A8145F73
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A8145F7B push r8; ret 2_2_00007FF8A8145F83
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A8145FB9 push r10; ret 2_2_00007FF8A8145FCC
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A8148419 push r10; retf 2_2_00007FF8A8148485
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A8145C31 push r10; ret 2_2_00007FF8A8145C33
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A8147FFF push r12; ret 2_2_00007FF8A814804A
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A8146859 push rsi; ret 2_2_00007FF8A8146890
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A814808B push r12; iretd 2_2_00007FF8A814809F
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A8145CE0 push r10; retf 2_2_00007FF8A8145CE2
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A8145CE5 push r8; ret 2_2_00007FF8A8145CEB
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A8145CED push rdx; ret 2_2_00007FF8A8145CF7
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A92F4541 push rcx; ret 2_2_00007FF8A92F4542
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1

Persistence and Installation Behavior

barindex
Found pyInstaller with non standard icon
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeProcess created: "C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe"
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_SHA256.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_keccak.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\PublicKey\_curve25519.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\_multiprocessing.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_poly1305.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\PublicKey\_ed25519.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\_wmi.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\libssl-3.dllJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_cbc.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\_cffi_backend.cp312-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_ofb.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\_ssl.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\charset_normalizer\md__mypyc.cp312-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\select.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\cryptography\hazmat\bindings\_rust.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_RIPEMD160.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_BLAKE2b.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\VCRUNTIME140.dllJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\python312.dllJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_MD2.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_aes.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\_ctypes.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_ARC4.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\PublicKey\_curve448.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\PublicKey\_ed448.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Util\_cpuid_c.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_SHA224.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_SHA512.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\_socket.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\_lzma.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\unicodedata.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\libffi-8.dllJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\python3.dllJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_des.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_MD4.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\_bz2.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\pyexpat.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Math\_modexp.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_pkcs1_decode.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_ocb.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_cfb.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_SHA384.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\_brotli.cp312-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_ctr.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\_asyncio.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\_decimal.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_ghash_portable.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\charset_normalizer\md.cp312-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_ecb.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\psutil\_psutil_windows.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_BLAKE2s.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_chacha20.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_blowfish.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Util\_strxor.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\_queue.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_SHA1.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\_overlapped.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_ghash_clmul.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\libcrypto-3.dllJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\_hashlib.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\PublicKey\_ec_ws.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Protocol\_scrypt.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_des3.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_arc2.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_aesni.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_MD5.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_Salsa20.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_cast.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txtJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63882\wheel-0.43.0.dist-info\LICENSE.txtJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E2155830 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,0_2_00007FF6E2155830
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_keccak.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_SHA256.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\_multiprocessing.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\PublicKey\_curve25519.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_poly1305.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\_wmi.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\PublicKey\_ed25519.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_cbc.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\_cffi_backend.cp312-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\charset_normalizer\md__mypyc.cp312-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_ofb.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\_ssl.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\select.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\cryptography\hazmat\bindings\_rust.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_RIPEMD160.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_BLAKE2b.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\python312.dllJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_MD2.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_aes.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\_ctypes.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_ARC4.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\PublicKey\_curve448.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\PublicKey\_ed448.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Util\_cpuid_c.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_SHA224.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_SHA512.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\_socket.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\_lzma.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\unicodedata.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\python3.dllJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_des.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\_bz2.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_MD4.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\pyexpat.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Math\_modexp.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_pkcs1_decode.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_ocb.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_cfb.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_SHA384.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\_brotli.cp312-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_ctr.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\_asyncio.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\_decimal.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_ghash_portable.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\charset_normalizer\md.cp312-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_ecb.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\psutil\_psutil_windows.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_BLAKE2s.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_chacha20.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_blowfish.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Util\_strxor.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\_queue.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\_overlapped.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_SHA1.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_ghash_clmul.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\_hashlib.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\PublicKey\_ec_ws.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_des3.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Protocol\_scrypt.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_arc2.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_MD5.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_aesni.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_Salsa20.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_cast.pydJump to dropped file
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_0-17287
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeAPI coverage: 5.1 %
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E21583C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,0_2_00007FF6E21583C0
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E2159280 FindFirstFileExW,FindClose,0_2_00007FF6E2159280
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E2171874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF6E2171874
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF6E2159280 FindFirstFileExW,FindClose,2_2_00007FF6E2159280
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF6E21583C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,2_2_00007FF6E21583C0
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF6E2171874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,2_2_00007FF6E2171874
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2070223440.000001F713774000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
Source: tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2164410235.000001E56A846000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2114566288.000001E56A7F2000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2130028800.000001E56A801000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2167668397.000001E56A846000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2107034964.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2160500937.000001E56A837000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2151896115.000001E56A835000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2105396074.000001E56A802000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E215D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF6E215D12C
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A8837B30 EntryPoint,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect,2_2_00007FF8A8837B30
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E2173480 GetProcessHeap,0_2_00007FF6E2173480
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeProcess token adjusted: DebugJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeProcess token adjusted: DebugJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E215D30C SetUnhandledExceptionFilter,0_2_00007FF6E215D30C
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E215C8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00007FF6E215C8A0
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E215D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF6E215D12C
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E216A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF6E216A614
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF6E215D30C SetUnhandledExceptionFilter,2_2_00007FF6E215D30C
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF6E215C8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FF6E215C8A0
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF6E215D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FF6E215D12C
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF6E216A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FF6E216A614
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A8143068 IsProcessorFeaturePresent,00007FF8BA2419C0,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,00007FF8BA2419C0,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FF8A8143068
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A92D2135 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FF8A92D2135
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A92D1CBC SetUnhandledExceptionFilter,2_2_00007FF8A92D1CBC
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 2_2_00007FF8A934DA5C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FF8A934DA5C
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeProcess created: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe "C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe"Jump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E2179570 cpuid 0_2_00007FF6E2179570
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\PublicKey VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\PublicKey VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\PublicKey VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\PublicKey VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Util VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\certifi VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\cryptography-43.0.3.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\cryptography-43.0.3.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\cryptography-43.0.3.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\cryptography-43.0.3.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\cryptography-43.0.3.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\cryptography-43.0.3.dist-info\license_files VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\cryptography-43.0.3.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\backports.tarfile-1.2.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\backports.tarfile-1.2.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\backports.tarfile-1.2.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\importlib_metadata-8.0.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\importlib_metadata-8.0.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\importlib_metadata-8.0.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\importlib_metadata-8.0.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\importlib_resources-6.4.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\importlib_resources-6.4.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\inflect-7.3.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\inflect-7.3.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\inflect-7.3.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\jaraco.collections-5.1.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\jaraco.collections-5.1.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\jaraco.collections-5.1.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\jaraco.context-5.3.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\jaraco.context-5.3.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\jaraco.context-5.3.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\jaraco.context-5.3.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\jaraco.context-5.3.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\jaraco.functools-4.0.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\jaraco.functools-4.0.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\jaraco.functools-4.0.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\jaraco.text-3.12.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\jaraco.text-3.12.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\jaraco.text-3.12.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\more_itertools-10.3.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\more_itertools-10.3.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\more_itertools-10.3.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\packaging-24.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\packaging-24.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\packaging-24.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\packaging-24.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\packaging-24.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\packaging-24.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\platformdirs-4.2.2.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\platformdirs-4.2.2.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\platformdirs-4.2.2.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\platformdirs-4.2.2.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\tomli-2.0.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\tomli-2.0.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\tomli-2.0.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\typeguard-4.3.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\typeguard-4.3.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\typing_extensions-4.12.2.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\typing_extensions-4.12.2.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\zipp-3.19.2.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\zipp-3.19.2.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\zipp-3.19.2.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\zipp-3.19.2.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\typeguard-4.3.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\typeguard-4.3.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\typeguard-4.3.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\typeguard-4.3.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\wheel-0.43.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\wheel-0.43.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\wheel-0.43.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\_bz2.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\_lzma.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\_hashlib.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\jaraco VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\_queue.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\_wmi.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\select.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\jaraco\text\Lorem ipsum.txt VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\jaraco\text\Lorem ipsum.txt VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63882 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E215D010 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00007FF6E215D010
Source: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exeCode function: 0_2_00007FF6E2175C00 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,0_2_00007FF6E2175C00

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Command and Scripting Interpreter		1
DLL Side-Loading		11
Process Injection		11
Process Injection		OS Credential Dumping2
System Time Discovery		Remote Services1
Archive Collected Data		12
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault Accounts2
Native API		Boot or Logon Initialization Scripts1
DLL Side-Loading		1
Deobfuscate/Decode Files or Information		LSASS Memory21
Security Software Discovery		Remote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)21
Obfuscated Files or Information		Security Account Manager1
File and Directory Discovery		SMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook11
Software Packing		NTDS22
System Information Discovery		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
DLL Side-Loading		LSA SecretsInternet Connection DiscoverySSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
tor-browser-windows-x86_64-portable-14.0.2.exe5%ReversingLabs

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_ARC4.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_Salsa20.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_chacha20.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_pkcs1_decode.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_aes.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_aesni.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_arc2.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_blowfish.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_cast.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_cbc.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_cfb.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_ctr.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_des.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_des3.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_ecb.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_eksblowfish.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_ocb.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_ofb.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_BLAKE2b.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_BLAKE2s.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_MD2.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_MD4.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_MD5.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_RIPEMD160.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_SHA1.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_SHA224.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_SHA256.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_SHA384.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_SHA512.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_ghash_clmul.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_ghash_portable.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_keccak.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_poly1305.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Math\_modexp.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Protocol\_scrypt.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\PublicKey\_curve25519.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\PublicKey\_curve448.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\PublicKey\_ec_ws.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\PublicKey\_ed25519.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\PublicKey\_ed448.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Util\_cpuid_c.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Util\_strxor.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\VCRUNTIME140.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\_asyncio.pyd3%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\_brotli.cp312-win_amd64.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\_bz2.pyd3%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\_cffi_backend.cp312-win_amd64.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\_ctypes.pyd3%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\_decimal.pyd3%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\_hashlib.pyd3%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\_lzma.pyd3%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\_multiprocessing.pyd3%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\_overlapped.pyd3%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\_queue.pyd3%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\_socket.pyd3%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\_ssl.pyd3%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\_wmi.pyd3%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\charset_normalizer\md.cp312-win_amd64.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\charset_normalizer\md__mypyc.cp312-win_amd64.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\cryptography\hazmat\bindings\_rust.pyd5%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\libcrypto-3.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\libffi-8.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\libssl-3.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\psutil\_psutil_windows.pyd3%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\pyexpat.pyd3%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\python3.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\python312.dll5%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\select.pyd3%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\autocommand-2.2.2.dist-info\METADATA0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\tomli-2.0.1.dist-info\METADATA0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63882\unicodedata.pyd3%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://ocsp.accv.esls0%Avira URL Cloudsafe
https://steamcomunty.comfo0%Avira URL Cloudsafe
https://api.ipify.orgp0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
steamcomunty.com
104.21.35.75
truefalse
    		unknown

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    https://github.com/pypa/packagingRtor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2173168524.000001E56AB20000.00000004.00001000.00020000.00000000.sdmpfalse
      		high
      https://steamcomunty.comfotor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174776532.000001E56B370000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://github.com/jaraco/keyring/commit/a85a7cbc6c909f8121660ed1f7b487f99a1c2bf7tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2084693821.000001F713776000.00000004.00000020.00020000.00000000.sdmpfalse
        		high
        https://github.com/giampaolo/psutil/issues/875.tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2175029093.000001E56B590000.00000004.00001000.00020000.00000000.sdmpfalse
          		high
          https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.filter_excepttor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpfalse
            		high
            https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagestor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174776532.000001E56B370000.00000004.00001000.00020000.00000000.sdmpfalse
              		high
              https://readthedocs.org/projects/jaracofunctools/badge/?version=latesttor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2085644461.000001F713776000.00000004.00000020.00020000.00000000.sdmpfalse
                		high
                http://ocsp.accv.eslstor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2152076176.000001E56A84F000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2158628343.000001E56A869000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153324985.000001E56A850000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2130028800.000001E56A801000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2172791241.000001E56A86B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2151896115.000001E56A835000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148970004.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2156887893.000001E56A85F000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2130331062.000001E56A802000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2151092176.000001E56A833000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2161275510.000001E56A86B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148526607.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150587578.000001E56A80C000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.zip_broadcasttor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpfalse
                  		high
                  https://github.com/jaraco/jaraco.text/actions?query=workflow%3A%22tests%22tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2086559680.000001F713776000.00000004.00000020.00020000.00000000.sdmpfalse
                    		high
                    https://docs.python.org/3/library/importlib.html#module-importlib.resourcestor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2078525874.000001F713776000.00000004.00000020.00020000.00000000.sdmpfalse
                      		high
                      https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2171644995.000001E56A514000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2170035952.000001E56A520000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093166951.000001E56A51A000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2171669708.000001E56A521000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093130528.000001E56A526000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2166624295.000001E56A511000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093279273.000001E56A520000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093254721.000001E56A51B000.00000004.00000020.00020000.00000000.sdmpfalse
                        		high
                        https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.random_producttor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpfalse
                          		high
                          https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.groupby_transformtor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpfalse
                            		high
                            https://importlib-metadata.readthedocs.io/tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2077514468.000001F713776000.00000004.00000020.00020000.00000000.sdmpfalse
                              		high
                              https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.sliding_windowtor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2114566288.000001E56A7F2000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2130028800.000001E56A801000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2107034964.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2172839435.000001E56A879000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2105396074.000001E56A802000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148970004.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2105173612.000001E56A74D000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2130331062.000001E56A802000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2106010766.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2151092176.000001E56A833000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2151506305.000001E56A878000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148526607.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150587578.000001E56A80C000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  https://github.com/pypa/packagingtor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2173168524.000001E56AB20000.00000004.00001000.00020000.00000000.sdmpfalse
                                    		high
                                    http://www.accv.es/legislacion_c.htmQtor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2147860222.000001E56AFBC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153154739.000001E56AFD5000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2129611983.000001E56AFBC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2152165593.000001E56AFBC000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      https://blog.jaraco.com/skeletontor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2084693821.000001F713776000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2077514468.000001F713776000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2086559680.000001F713776000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2078525874.000001F713776000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2085644461.000001F713776000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2083238326.000001F71377C000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2084047965.000001F713776000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        https://tools.ietf.org/html/rfc3610tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2161879195.000001E56B840000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2162298286.000001E56AE33000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153114034.000001E56B837000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2152249008.000001E56AE24000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149862292.000001E56AE24000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2162109762.000001E56AE2D000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148254781.000001E56AE24000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.all_uniquetor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.partial_producttor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high
                                              https://img.shields.io/pypi/pyversions/inflect.svgtor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2083238326.000001F71377C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.map_excepttor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.takewhile_inclusivetor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://tidelift.com/subscription/pkg/pypi-jaraco.text?utm_source=pypi-jaraco.text&utm_medium=readmetor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2086559680.000001F713776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filenametor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093166951.000001E56A51A000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093130528.000001E56A526000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2171306040.000001E56A160000.00000004.00001000.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.powersettor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.zip_offsettor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxytor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174922062.000001E56B480000.00000004.00001000.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://github.com/jaraco/jaraco.context/actions?query=workflow%3A%22tests%22tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2084693821.000001F713776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://pypi.org/project/build/).tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174532215.000001E56B140000.00000004.00001000.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174776532.000001E56B370000.00000004.00001000.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174404351.000001E56B040000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://wwww.certigna.fr/autorites/0mtor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2157228187.000001E56ACCA000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2161058354.000001E56ACCD000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149766092.000001E56ACC1000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153907383.000001E56ACC8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.pad_nonetor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://dev.to/martinheinz/tour-of-python-itertools-4122tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readertor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2171644995.000001E56A514000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2170035952.000001E56A520000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093166951.000001E56A51A000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2171669708.000001E56A521000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093130528.000001E56A526000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2166624295.000001E56A511000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093279273.000001E56A520000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093254721.000001E56A51B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://github.com/python/cpython/issues/86361.tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2114566288.000001E56A7F2000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2101568663.000001E56A813000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2130028800.000001E56A801000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2164410235.000001E56A819000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2107034964.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2098749871.000001E56A7FD000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2104574533.000001E56A80A000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2105396074.000001E56A802000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148970004.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2105173612.000001E56A74D000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2103030917.000001E56A811000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2130331062.000001E56A802000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2106010766.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2098411305.000001E56A7DB000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2098528400.000001E56A7C7000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148526607.000001E56A809000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2156852481.000001E56A812000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2099464201.000001E56A815000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150587578.000001E56A80C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://tidelift.com/subscription/pkg/pypi-inflect?utm_source=pypi-inflect&utm_medium=readmetor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2083238326.000001F71377C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              http://mail.python.org/pipermail/python-dev/2012-June/120787.html.tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2172694753.000001E56A7EF000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2152249008.000001E56AE24000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149862292.000001E56AE24000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2162226312.000001E56AE25000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149312596.000001E56A7C9000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148254781.000001E56AE24000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2155609929.000001E56A7DB000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2160114525.000001E56A7EE000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153078336.000001E56A7D4000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2173644199.000001E56AE28000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153823881.000001E56A7DA000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2158988561.000001E56A7ED000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2175029093.000001E56B590000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=maintor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2070948869.000001F713774000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_moduletor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093166951.000001E56A51A000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2171527925.000001E56A410000.00000004.00001000.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093130528.000001E56A526000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_cachestor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093166951.000001E56A51A000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2171527925.000001E56A410000.00000004.00001000.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093130528.000001E56A526000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://img.shields.io/pypi/v/inflect.svgtor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2083238326.000001F71377C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://cryptography.io/en/latest/installation/tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2070948869.000001F713774000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.ncyclestor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            https://github.com/pypa/setuptools/issues/417#issuecomment-392298401tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2172244793.000001E56A610000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.consumetor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                https://jaracotext.readthedocs.io/en/latest/?badge=latesttor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2086559680.000001F713776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.split_whentor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.consumertor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      http://www.cert.fnmt.es/dpcs/tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2129134474.000001E56AE34000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150126891.000001E56AE8F000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2154933151.000001E56B7CA000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148185759.000001E56AE8B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2156146494.000001E56B7D1000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2161675441.000001E56AE90000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://google.com/mailtor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2160831903.000001E56AF28000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2170062046.000001E56ADEC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2161759995.000001E56AF2D000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2114031169.000001E56ADE4000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2152249008.000001E56ADE4000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2160279326.000001E56ADEA000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149862292.000001E56ADE4000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148786147.000001E56ADE4000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149539299.000001E56AF23000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2129134474.000001E56ADE4000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2163491408.000001E56ADEC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149569427.000001E56AF27000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          https://img.shields.io/pypi/v/importlib_metadata.svgtor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2077514468.000001F713776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.nth_combination_with_replacetor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              https://github.com/pyca/cryptography/issuestor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2070948869.000001F713774000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.interspersetor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  https://readthedocs.org/projects/inflect/badge/?version=latesttor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2083238326.000001F71377C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    http://html4/loose.dtdtor-browser-windows-x86_64-portable-14.0.2.exe, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2180285327.00007FF8A82B6000.00000040.00000001.01000000.00000014.sdmpfalse
                                                                                                                      		high
                                                                                                                      https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.collapsetor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        https://tools.ietf.org/html/rfc7231#section-4.3.6)tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2105521390.000001E56AD5B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150948403.000001E56A74E000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2107421454.000001E56AD4B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2107034964.000001E56A738000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2106193421.000001E56AD4B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2158080452.000001E56A750000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2105173612.000001E56A74D000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2106010766.000001E56A74C000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2104990087.000001E56AD4B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2155439540.000001E56A74F000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149635986.000001E56A736000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          https://api.ipify.orgptor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174922062.000001E56B480000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                          • Avira URL Cloud: safe
                                                                                                                          		unknown
                                                                                                                          https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.onetor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            https://pypi.org/project/jaraco.texttor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2086559680.000001F713776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spector-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093166951.000001E56A51A000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093130528.000001E56A526000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2171306040.000001E56A1DC000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                https://github.com/urllib3/urllib3/issues/2920tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174922062.000001E56B480000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_datator-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2170035952.000001E56A520000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093166951.000001E56A51A000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2171669708.000001E56A521000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093130528.000001E56A526000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2166624295.000001E56A511000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093279273.000001E56A520000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2093254721.000001E56A51B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    https://github.com/jaraco/jaraco.functools/actions?query=workflow%3A%22tests%22tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2085644461.000001F713776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.countabletor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.matmultor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.prependtor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            https://github.com/python/importlib_metadata/actions?query=workflow%3A%22tests%22tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2077514468.000001F713776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.product_indextor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.set_partitionstor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  http://www.quovadisglobal.com/cps0tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2158411254.000001E56AF7B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2129611983.000001E56AF7B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2149071492.000001E56AF7B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2168852886.000001E56AF7B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2162526793.000001E56AF7B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2170527644.000001E56AF7C000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2174223261.000001E56AF82000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.onlytor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      https://cryptography.io/en/latest/changelog/tor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2070948869.000001F713774000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.buckettor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                          		high
                                                                                                                                                          https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.distinct_permutationstor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                            		high
                                                                                                                                                            https://mail.python.org/mailman/listinfo/cryptography-devtor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2070948869.000001F713774000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                              		high
                                                                                                                                                              https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.split_intotor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                		high
                                                                                                                                                                https://github.com/jaraco/inflect/actions/workflows/main.yml/badge.svgtor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2083238326.000001F71377C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                  		high
                                                                                                                                                                  https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.nth_combinationtor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                    		high
                                                                                                                                                                    https://readthedocs.org/projects/jaracocontext/badge/?version=latesttor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2084693821.000001F713776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                      		high
                                                                                                                                                                      https://readthedocs.org/projects/more-itertools/badge/?version=latesttor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                        		high
                                                                                                                                                                        http://.jpgtor-browser-windows-x86_64-portable-14.0.2.exe, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2180285327.00007FF8A82B6000.00000040.00000001.01000000.00000014.sdmpfalse
                                                                                                                                                                          		high
                                                                                                                                                                          https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbcator-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2173168524.000001E56AB20000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                            		high
                                                                                                                                                                            https://github.com/pypa/setuptools/issues/1024.tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2173168524.000001E56AB20000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                              		high
                                                                                                                                                                              https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.constrained_batchestor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                		high
                                                                                                                                                                                https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.split_aftertor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		high
                                                                                                                                                                                  https://img.shields.io/pypi/pyversions/jaraco.functools.svgtor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2085644461.000001F713776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                    		high
                                                                                                                                                                                    https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.repeat_eachtor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                      		high
                                                                                                                                                                                      https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.iter_indextor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                        		high
                                                                                                                                                                                        http://ocsp.accv.es0tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2147860222.000001E56AFBC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153154739.000001E56AFD5000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2129611983.000001E56AFBC000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2154238899.000001E56B00D000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2152165593.000001E56AFBC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                          		high
                                                                                                                                                                                          https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.interleave_evenlytor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                            		high
                                                                                                                                                                                            https://stackoverflow.com/questions/4457745#4457745.tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2150126891.000001E56AE8F000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2148185759.000001E56AE8B000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2161675441.000001E56AE90000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2162763177.000001E56AE99000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000002.2175029093.000001E56B590000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                              		high
                                                                                                                                                                                              http://www.quovadisglobal.com/cpstor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2169901438.000001E56A724000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2153357373.000001E56A717000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2154971098.000001E56A717000.00000004.00000020.00020000.00000000.sdmp, tor-browser-windows-x86_64-portable-14.0.2.exe, 00000002.00000003.2169693402.000001E56A717000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                		high
                                                                                                                                                                                                https://tidelift.com/badges/package/pypi/jaraco.texttor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2086559680.000001F713776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                  		high
                                                                                                                                                                                                  https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.ichunkedtor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                    		high
                                                                                                                                                                                                    https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.is_sortedtor-browser-windows-x86_64-portable-14.0.2.exe, 00000000.00000003.2087234578.000001F71377C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                      		high

                                                                                                                                                                                                      World Map of Contacted IPs

                                                                                                                                                                                                      • No. of IPs < 25%
                                                                                                                                                                                                      • 25% < No. of IPs < 50%
                                                                                                                                                                                                      • 50% < No. of IPs < 75%
                                                                                                                                                                                                      • 75% < No. of IPs

                                                                                                                                                                                                      Public IPs

                                                                                                                                                                                                      IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                      104.21.35.75
                                                                                                                                                                                                      		steamcomunty.comUnited States
                                                                                                                                                                                                      		13335CLOUDFLARENETUSfalse

                                                                                                                                                                                                      General Information

                                                                                                                                                                                                      Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                                      Analysis ID:1561393
                                                                                                                                                                                                      Start date and time:2024-11-23 10:31:10 +01:00
                                                                                                                                                                                                      Joe Sandbox product:CloudBasic
                                                                                                                                                                                                      Overall analysis duration:0h 8m 32s
                                                                                                                                                                                                      Hypervisor based Inspection enabled:false
                                                                                                                                                                                                      Report type:full
                                                                                                                                                                                                      Cookbook file name:default.jbs
                                                                                                                                                                                                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                      Number of analysed new started processes analysed:5
                                                                                                                                                                                                      Number of new started drivers analysed:0
                                                                                                                                                                                                      Number of existing processes analysed:0
                                                                                                                                                                                                      Number of existing drivers analysed:0
                                                                                                                                                                                                      Number of injected processes analysed:0
                                                                                                                                                                                                      Technologies:
                                                                                                                                                                                                      • HCA enabled
                                                                                                                                                                                                      • EGA enabled
                                                                                                                                                                                                      • AMSI enabled
                                                                                                                                                                                                      Analysis Mode:default
                                                                                                                                                                                                      Analysis stop reason:Timeout
                                                                                                                                                                                                      Sample name:tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                      Detection:SUS
                                                                                                                                                                                                      Classification:sus36.winEXE@3/192@1/1
                                                                                                                                                                                                      EGA Information:
                                                                                                                                                                                                      • Successful, ratio: 100%
                                                                                                                                                                                                      HCA Information:Failed
                                                                                                                                                                                                      Cookbook Comments:
                                                                                                                                                                                                      • Found application associated with file extension: .exe

                                                                                                                                                                                                      Warnings

                                                                                                                                                                                                      • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
                                                                                                                                                                                                      • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                                                                      • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                                                                                                                                                                      • VT rate limit hit for: tor-browser-windows-x86_64-portable-14.0.2.exe

                                                                                                                                                                                                      Simulations

                                                                                                                                                                                                      Behavior and APIs

                                                                                                                                                                                                      ⊘No simulations

                                                                                                                                                                                                      Joe Sandbox View / Context

                                                                                                                                                                                                      IPs

                                                                                                                                                                                                      ⊘No context

                                                                                                                                                                                                      Domains

                                                                                                                                                                                                      ⊘No context

                                                                                                                                                                                                      ASNs

                                                                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                      CLOUDFLARENETUSfile.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      • 104.21.33.116
                                                                                                                                                                                                      b.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                      • 104.21.88.250
                                                                                                                                                                                                      Loader.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                      • 172.67.162.84
                                                                                                                                                                                                      loader.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                      • 104.21.44.93
                                                                                                                                                                                                      file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                                                                                                                                                                      • 162.159.61.3
                                                                                                                                                                                                      file.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                      • 104.21.33.116
                                                                                                                                                                                                      file.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                      • 172.67.162.84
                                                                                                                                                                                                      file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                                                                                                                                                                      • 172.64.41.3
                                                                                                                                                                                                      file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      • 172.67.162.84
                                                                                                                                                                                                      17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                      • 104.20.3.235

                                                                                                                                                                                                      JA3 Fingerprints

                                                                                                                                                                                                      ⊘No context

                                                                                                                                                                                                      Dropped Files

                                                                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_chacha20.pydOBS-Studio-30.2.3-Windows-Installer.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_Salsa20.pydOBS-Studio-30.2.3-Windows-Installer.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_ARC4.pydOBS-Studio-30.2.3-Windows-Installer.exeGet hashmaliciousUnknownBrowse

                                                                                                                                                                                                            Created / dropped Files

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_ARC4.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):9728
                                                                                                                                                                                                            Entropy (8bit):6.721315996050753
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:96:d72Y51IktHYsaMiUBskpKf/otjOKZ7kYBbPJBj34lVhXg246ae7sXtpHqrd3ejL3:dz51IkJYevIfKJZ7kYj273QJXpHk
                                                                                                                                                                                                            MD5:2C3D55E57EEA6B6E4A4BE649FD1069F9
                                                                                                                                                                                                            SHA1:C938D6517AC0A3AA9C47B6F301D04C11AF8A6C6E
                                                                                                                                                                                                            SHA-256:744C676D333163AD81D24B266E5133611C584F5A580C5082701D3FD6A8D201FD
                                                                                                                                                                                                            SHA-512:4EAC0018F6F983BB37975EB56E514AE3CDBA8DCF1DC9F955F81731EBA25F2A545A16D9E81F335CDC5EC17F752346B71B5698BB53A0D58CCAB93F3D191E225D26
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Joe Sandbox View:
                                                                                                                                                                                                            • Filename: OBS-Studio-30.2.3-Windows-Installer.exe, Detection: malicious, Browse
                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...Y..f.........." ..... .......p........................................................`.........................................L..........\............@.........................................................8...........................................UPX0.....p..............................UPX1..... ..........................@....rsrc................"..............@......................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_Salsa20.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):10752
                                                                                                                                                                                                            Entropy (8bit):7.041585504283436
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:192:tLbomJb7eLg42ufSAky4s3YeQ807tu/kbBkYj273QJXbnV/9K:BtqICvor/bBZa7gJXxl
                                                                                                                                                                                                            MD5:BB7724B47B6C1F3B0CFB0AB6848A9FC8
                                                                                                                                                                                                            SHA1:5A39391C4FA51ECE3E53ECC415E47C918FF970CF
                                                                                                                                                                                                            SHA-256:6CAB5277B070D1F420E90CCB80F97EA558BCE8EFF43768A6C0B818EF0E778501
                                                                                                                                                                                                            SHA-512:55AC24A7581BD80DBA7D86D04B90A42B54DBFAB51D1C2476811F247515FC410A4DA4775305711C576636B677B503F2F94C96469DF94647F5217832E7934DD5F0
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Joe Sandbox View:
                                                                                                                                                                                                            • Filename: OBS-Studio-30.2.3-Windows-Installer.exe, Detection: malicious, Browse
                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...Z..f.........." .....0.......p........................................................`.........................................L..........\............P..L.......................................................8...........................................UPX0.....p..............................UPX1.....0......."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_chacha20.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):10752
                                                                                                                                                                                                            Entropy (8bit):7.039259241149234
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:192:hCbomJb7MQtHa66PQrMd4E+KkYj273QJXhnFvk7G9lk:Et46a6yGKZa7gJXvs7G9
                                                                                                                                                                                                            MD5:E6D25BE0BCC8093F9E79D9042B7B427F
                                                                                                                                                                                                            SHA1:6F0D62061A017A71DB7CA64F2F23BC0C659B3C9C
                                                                                                                                                                                                            SHA-256:CE9B0D915101455F3D1D15B0E28F23AF69EBD34F050D43DA8F7C2CEABFD92C76
                                                                                                                                                                                                            SHA-512:0E55928F51187A590A318FBBBB699E8FB4BE364188177A397800E952A87D6817BD4393BF06A7E2CB8F991DD1004C675AE4738B74E8ED4FE594F82BDFD09E52C1
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Joe Sandbox View:
                                                                                                                                                                                                            • Filename: OBS-Studio-30.2.3-Windows-Installer.exe, Detection: malicious, Browse
                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...Z..f.........." .....0.......p..p.....................................................`.........................................L..........\............P..d...................................................p...8...........................................UPX0.....p..............................UPX1.....0......."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_pkcs1_decode.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):10752
                                                                                                                                                                                                            Entropy (8bit):7.0019849554229
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:192:rKC1XDqrH2n4sOK4niou4uiCQxU4kYj273QJXQnII:rTqrymK45oipxU4Za7gJX/
                                                                                                                                                                                                            MD5:FD2D370103167D927EEBA5FF9573430D
                                                                                                                                                                                                            SHA1:420215D7D9F474797402987431A487AC40EC6F8A
                                                                                                                                                                                                            SHA-256:FED9DE86E007141EC486E420059E3D841752EA0C7D452056735D11E7C4B16700
                                                                                                                                                                                                            SHA-512:1894324A905D40C11AF3285F043CC655BC4CDBFE8F62BB8234199910748FD2DE10AD75369259CDFCE9521D11AF585C009D2B046ED22D778EAB04092EE513C8DD
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^:.6?T.6?T.6?T.?G..2?T.dJU.4?T.}GU.5?T.6?U..?T.dJQ.<?T.dJP.>?T.dJW.5?T..J\.7?T..JT.7?T..J..7?T..JV.7?T.Rich6?T.........................PE..d...X..f.........." .....0.......p..P.....................................................`.........................................L..........\............P..(..................................................P...8...........................................UPX0.....p..............................UPX1.....0......."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_aes.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):17920
                                                                                                                                                                                                            Entropy (8bit):7.44538276790286
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:192:dSfcMEwreSc6PXpaxRH1c9+z0QBuR1C+u/s6ficwcHuANwM5mqzukYj273QJXxwK:QfNEwreK8tSUDubR9UHuo5qZa7gJXKK
                                                                                                                                                                                                            MD5:7FCE96038B14661B6FACBE02D714C219
                                                                                                                                                                                                            SHA1:388809935844936CB874F21630A44A6DC2C23FB8
                                                                                                                                                                                                            SHA-256:8E2CEF1B7744A3AFAA06E300E6332EDAE9EB8641A6E37687A3A96A1F15C7E1A5
                                                                                                                                                                                                            SHA-512:0536CD949E25E733A042D23B731B1FB3E80DC1FB42CDCD9EEFEC8109CB8B7190D574A0D93EE654215E7EBE11ABC6ABE42139BD1C93A2F4F628BF2FAA4715AA8D
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...V..f.........." .....@..........P........................................ ............`.........................................L...........\...................................................................P...8...........................................UPX0....................................UPX1.....@.......>..................@....rsrc................B..............@......................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_aesni.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):11264
                                                                                                                                                                                                            Entropy (8bit):7.10750060735988
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:192:qA1KyAngDiTMsaxwpQSkKtqH59DzIre69y6ESPIFF2GWTkYj273QJXlEnPVW:MyA8Enayu6oZzIz9y6EI2FhWTZa7gJX6
                                                                                                                                                                                                            MD5:75DEE2AE97414A67497CB13A7E4CB455
                                                                                                                                                                                                            SHA1:1EBE78A17602BF598469C6A31D0F8F325D9049F0
                                                                                                                                                                                                            SHA-256:29B61F0670BA8AF9FF037CAF76196F823CA6C27D7B2DF1BFF80DFF9E8B30AC5E
                                                                                                                                                                                                            SHA-512:B6A113A738148CD2F3B10F5184A7AD8ABBBD54E5A125F86C92AB9FFBC45180D579EF5DCEF1B405602BA23DA4EA5F5BADB650FB7E6BDF64DC898ED5FD8CF18AA0
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.z.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...V..f.........." .....0.......p........................................................`.........................................L..........\............P.........................................................8...........................................UPX0.....p..............................UPX1.....0.......$..................@....rsrc................(..............@......................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_arc2.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):12288
                                                                                                                                                                                                            Entropy (8bit):7.098444004640404
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:192:lHRdBLsPZK1vko/1NzFXHDLAN4RzV/uKOJukYj273QJXWH5A:lHxsivPTzF3DLNPu/JuZa7gJX0A
                                                                                                                                                                                                            MD5:DD09C764BC8FCDDF8F8FA092EADB070D
                                                                                                                                                                                                            SHA1:0ACDB5D9325E1EEF56ED4D6F75F121F1019DE49F
                                                                                                                                                                                                            SHA-256:F0333175C8B5AAA48D0C68ED1030A1F1F49209F77407850F90D3526B4BDDE662
                                                                                                                                                                                                            SHA-512:AC0CBF58DBD4636152B0D27D4E72060EFDE24A1FC23648108DFE21C27E41EB1374A45D411B3AC91A428BC0775EC66357DB03BDF73C85C1800AB827E56F4B0D23
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." .....0...............................................................`.........................................L...........\............`.........................................................8...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@..............................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_blowfish.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):15360
                                                                                                                                                                                                            Entropy (8bit):7.366658234710816
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:192:JcwvnyaqcefIn88uRQ/dIVrrnFqrFCJZZoXfXTkYj273QJXtnbR:JzfvuRKIdi6ZZo/TZa7gJXlR
                                                                                                                                                                                                            MD5:50FB3B6DFC6A1B6DE592B659A9C28919
                                                                                                                                                                                                            SHA1:BEABF5C7F1F70E852FDCEAF3355EDDB84CB7E3F6
                                                                                                                                                                                                            SHA-256:BE0FB3C7C36C10F62B163979682FBE8215411C97D4E6AB76A33032B687660341
                                                                                                                                                                                                            SHA-512:D9795DD1B0AAFADA0C6D0F573B193AAAB5BCCC052A66ED49C26AF112F6A7D58D95E8D8AB79172D055249CC1825E5BBDA8D459F9783FC15A140D60D7E251F1E2C
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." .....@................................................................`.........................................L...........\............p..........................................................8...........................................UPX0....................................UPX1.....@.......4..................@....rsrc................8..............@..............................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_cast.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):20480
                                                                                                                                                                                                            Entropy (8bit):7.555212764163484
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:384:Q9OoXmDJJfsg/XTsJaMEgotWVKOVBVvHQ5X5y35Za7gJX0p:zoXqnVXTs/r95VBVf+XUpkp
                                                                                                                                                                                                            MD5:573233E4FBF0FA3DB814355658D02152
                                                                                                                                                                                                            SHA1:D9AA00FAD89D13D33BDCBF0064EF539F74F901ED
                                                                                                                                                                                                            SHA-256:744A5A729D6D5D59E255F01E8132E255D9526D30880DF953F7C10F88F88484B4
                                                                                                                                                                                                            SHA-512:1046716B1E78AA162FA51E8E6C498E63DF08BC63A226B5D87CB5B0F8116114277723FAD8BE8A3C1D1FD91EF6F09A112E00DB1FAEB7E108D51DA31256810CD315
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...W..f.........." .....P................................................................`.........................................L...........\.......................................................................8...........................................UPX0....................................UPX1.....P.......H..................@....rsrc................L..............@......................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_cbc.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):10240
                                                                                                                                                                                                            Entropy (8bit):6.764641078478404
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:192:frOwIMFi0ZIPRKLZm2HIKI7FAqjkYj273QJX93qz:frKMFiFKLZzHILPjZa7gJXA
                                                                                                                                                                                                            MD5:0AC9D452043A7FEBF5E6E6475AECE8E3
                                                                                                                                                                                                            SHA1:3854D5B4D9C17F22D4D079E15E25FC6B67E5D007
                                                                                                                                                                                                            SHA-256:E0E499CDC6AA3DA978EF259185874773BFE5D57DE62B65FC6BD1025291A50012
                                                                                                                                                                                                            SHA-512:C2580353FACD614773BD220C2BAADC77E614C41905EC785E1ED0BCE6B06146EC45A09CACFFA05E6187E184F642186DA64A93B195329455E94157ECE34ED68C0C
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...X..f.........." ..... .......p..@.....................................................`.........................................L..........\............P..X...................................................@...8...........................................UPX0.....p..............................UPX1..... ....... ..................@....rsrc................$..............@..............................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_cfb.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):10752
                                                                                                                                                                                                            Entropy (8bit):6.915975887591388
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:192:kSoS3cBJuphELbARkRzWJ9v07xyhAEkgDkYj273QJXXnYvo:5i/ACRzcvW2AENDZa7gJXA
                                                                                                                                                                                                            MD5:2C7FAEEC165C5485951EEACF21A2BF94
                                                                                                                                                                                                            SHA1:118FC5036890C59C78F5A96519B20EE723A07E97
                                                                                                                                                                                                            SHA-256:3A5AB5C020DA800C8EA4E7D75C27C83C42B449B33993728B22E308AC2779FAA6
                                                                                                                                                                                                            SHA-512:2ACF66AD52295EA62B80018EDCB4997187A992BBF01CDC5D54D4796C2289A2C967D00861BB0BD903DE714808F1BF44EE65B39078AB89C673F8A73FD84F82AB3C
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^..6?..6?..6?..?G..2?..dJ..4?..}G..5?..6?...?..dJ..<?..dJ..>?..dJ..5?...J..7?...J..7?...Jk.7?...J..7?..Rich6?..................PE..d...Y..f.........." .....0.......p........................................................`.........................................L..........\............P..d.......................................................8...........................................UPX0.....p..............................UPX1.....0......."..................@....rsrc................&..............@..............................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_ctr.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):11264
                                                                                                                                                                                                            Entropy (8bit):6.90005278335116
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:192:vFKPs19OtUVkzxt8b3jKdr7LxHZkYj273QJX1nGf:vAo9OtPGbGd3VHZZa7gJXU
                                                                                                                                                                                                            MD5:BCE5672E2D78D26EF52073FFA956F2EE
                                                                                                                                                                                                            SHA1:1FA18E661C39A55B4AA4C08C52A53F9259EB91D3
                                                                                                                                                                                                            SHA-256:DAC8E5B99A57F689C1BD5A24C5C58CB99569EEA0C5B9BC16856B3B59D98A6732
                                                                                                                                                                                                            SHA-512:D66AB52AB067443097CC386E4F9D9A056DA391766E70E7C6BD50EC9161B652E5B10669CA7BEFB0C32C78CD3F79B1B12FEEFECE264CBCC95A53DDFFD09276E330
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^z.6?..6?..6?..?G..2?..dJ..4?..}G..5?..6?...?..dJ..<?..dJ..>?..dJ..5?...J..7?...J..7?...J..7?...J..7?..Rich6?..........................PE..d...Y..f.........." .....0.......p.. .....................................................`.........................................L..........\............P...................................................... ...8...........................................UPX0.....p..............................UPX1.....0.......$..................@....rsrc................(..............@......................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_des.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):17408
                                                                                                                                                                                                            Entropy (8bit):7.452747043036153
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:384:PXqmPF0yHaseAZ2OC4uCDeR0IjhP0G2yZa7gJXQ:PXPajsw41Gjj20pg
                                                                                                                                                                                                            MD5:00FC3F2144FF56678607748101C7F1E2
                                                                                                                                                                                                            SHA1:1301656C0E8446CFF423FA557A7078FF304C31B5
                                                                                                                                                                                                            SHA-256:F0B4E1207867CBD686F9233D69011DD007CF3C939715E46C4D3A600AD506A3C0
                                                                                                                                                                                                            SHA-512:D12C65473957CAEC8890CEA77CF3F2B8E9D7768418A3A3218B65B1DFBECD9EA12124E1062E5500112EE323F1200AC41A0E9B9DF3451F7AE40C8BA91372956D67
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........PK..1%..1%..1%..I...1%.D$..1%.I$..1%..1$..1%.D ..1%.D!..1%.D&..1%..D-..1%..D%..1%..D...1%..D'..1%.Rich.1%.........................PE..d...X..f.........." .....@...........M... ...................................p............`.........................................Lb.......`..\....`..........l............b.......................................Y..8...........................................UPX0....................................UPX1.....@... ...<..................@....rsrc........`.......@..............@......................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_des3.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):17408
                                                                                                                                                                                                            Entropy (8bit):7.527632457434857
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:384:rXqvtGBvrj1exl5PSYSI5SFDzgN4LZa7gJXn:ry0BTMgYFAFD8CpX
                                                                                                                                                                                                            MD5:068E483215972613E4EBD09E98D946A2
                                                                                                                                                                                                            SHA1:8D9AAA7407C997B6C7AEC847DF2DE08B1FE0056A
                                                                                                                                                                                                            SHA-256:A6986EE5D6C5EB6B564175DF0D6D47CD18E642C7F5AF9C93EBF5B4E4F98991D1
                                                                                                                                                                                                            SHA-512:4EEAEA8A75F92850F70A4051FC0387EED65BAA8BC4AB0488CA54B70338FC6D0DA3DFE42028BDD3657C03C01AAD256C6A86D88109F945C8BBAC768752CD0C2D9E
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........PK..1%..1%..1%..I...1%.D$..1%.I$..1%..1$..1%.D ..1%.D!..1%.D&..1%..D-..1%..D%..1%..D...1%..D'..1%.Rich.1%.........................PE..d...X..f.........." .....@...........N... ...................................p............`.........................................Lb.......`..\....`.......................b.......................................Z..8...........................................UPX0....................................UPX1.....@... ...<..................@....rsrc........`.......@..............@......................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_ecb.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):9216
                                                                                                                                                                                                            Entropy (8bit):6.747246956175954
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:192:w51jwkl3nSW/ZHd8M/Y6tkYj273QJXpHz:w5CkwWtSMA6tZa7gJXZ
                                                                                                                                                                                                            MD5:70D8E6DD3124AB7FE5D7F23F0A0E774A
                                                                                                                                                                                                            SHA1:6AF7FC8D3867F4A3BFF72A7D4346B2D4AB3FD9E9
                                                                                                                                                                                                            SHA-256:8A98084750A04005AD051C234CF0E1C42219FE04B4DCAF0F83D9B475170BDD4F
                                                                                                                                                                                                            SHA-512:8C5B3E4C5875AB6BA436455D11D6BEB75113661AEECBFEB94F4AFDDA5B2BCF7FF87C3C91A0B75CEFAC65F1262848221225EBF36753A271DDB0418353D5F8E798
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...X..f.........." ..... .......p........................................................`.................................................................@..........................................................8...........................................UPX0.....p..............................UPX1..... ..........................@....rsrc................ ..............@......................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_eksblowfish.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):15872
                                                                                                                                                                                                            Entropy (8bit):7.38810398376641
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:384:6zW51OWrPlPXRWkplBxnEgTa+Za7gJXaf:6zW51O4lPBJpTLTLpq
                                                                                                                                                                                                            MD5:EFB8BED8E7491FC9883D48ADC5D76BBF
                                                                                                                                                                                                            SHA1:25812983173F9DCC0433CF4D6491D031A8F79C61
                                                                                                                                                                                                            SHA-256:17E8532C25E805F54E262CF9FF6ED319F47CE14F4CBEA8A2EA73D754A93EA048
                                                                                                                                                                                                            SHA-512:CC550C2991543390E10CEB9BA0C336B9826443D0D4E9FFE9E70D58D83BE974F63C673B7A9F7AB0E880A85DD9F728B50FBBB5FBA80F10567A926C93F30552FC41
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." .....@...............................................................`.........................................L...........\............p..........................................................8...........................................UPX0....................................UPX1.....@.......6..................@....rsrc................:..............@..............................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_ocb.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):11776
                                                                                                                                                                                                            Entropy (8bit):6.95443292187247
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:192:c3LNqWu7xr5InY8MmVO+AHO4dgOSeWNkYj273QJXRHPnX:6vuZ/3xHO4dxSeIZa7gJX1X
                                                                                                                                                                                                            MD5:EEFBC381AE6016973E31C217B6D758B0
                                                                                                                                                                                                            SHA1:B165774E0769313E8A6D45A1902E45E132922216
                                                                                                                                                                                                            SHA-256:184059ED9AD6799279F0817A4D648FF1CDA38C81257E87FFCE2751FF678758E9
                                                                                                                                                                                                            SHA-512:7274E22ED75C5B5F9D1D8598C3798337F7EF2E59E33781CA9F1CD2082CF0049B1CF0913E8F7CEB1171CD2E126A6485C465C895F13293A5ABD0AE83D1AB9AB071
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...Y..f.........." .....0...............................................................`.........................................L...........\............`..............H..........................................8...........................................UPX0....................................UPX1.....0.......&..................@....rsrc................*..............@......................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Cipher\_raw_ofb.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):10240
                                                                                                                                                                                                            Entropy (8bit):6.708259135829596
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:192:8rOwIMFi0ZIPRK4EtpwEHW8hVkYj273QJXD3pT:8rKMFiFK4KL28hVZa7gJXV
                                                                                                                                                                                                            MD5:0A79C221757B55CAE16EA338D7654471
                                                                                                                                                                                                            SHA1:FB92B8A30F8FF8660E9C27856D3E8807BBE7CB12
                                                                                                                                                                                                            SHA-256:9B863433A00515B060B379AB481D2DEE787A491E1EE29AF959DAE525002613DC
                                                                                                                                                                                                            SHA-512:43325FF05B33389966AEB9A1B426442BFB4452A3DEC239D0B22EF063F92445893B7B822C69ED10B95C0D0F72E47632F1AB3884BE16604BD767AB735B469F4D85
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...Y..f.........." ..... .......p........................................................`.........................................L..........\............P..X.......................................................8...........................................UPX0.....p..............................UPX1..... ....... ..................@....rsrc................$..............@..............................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_BLAKE2b.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):11264
                                                                                                                                                                                                            Entropy (8bit):7.069717543323313
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:192:MTrOwIMFi0ZI2ZdnYIvCVCZK+vkYj273QJX1nre30:irKMFiKZdnScZ5vZa7gJXdO
                                                                                                                                                                                                            MD5:5D0106B0D1DA6C2DEDC8455A0BB993EB
                                                                                                                                                                                                            SHA1:D5E85DD532390138AF68A445F42AE92F9DA4ED0B
                                                                                                                                                                                                            SHA-256:DAAEDCA16C357615439A9A2AE53A1DAD3D5A700DC5F92633337F0D9046F7D388
                                                                                                                                                                                                            SHA-512:7698D7D9F98DD332732065C1FD2FDC1A8EEB6840B62A2DE21BD429C5F6FBEDB9E2F8F825D1876A24695A5211B20D77AE0299A045DCD43BD50E25561FADC54DCA
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." .....0.......p..0.....................................................`.........................................L..........\............P..@...................................................0...8...........................................UPX0.....p..............................UPX1.....0.......$..................@....rsrc................(..............@..............................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_BLAKE2s.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):11264
                                                                                                                                                                                                            Entropy (8bit):6.999291282196889
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:192:xfrrOwIMFi0ZI2b8JcuFqNF4m2nlQXku17YhkYj273QJXbnKu3p:FrKMFiKgJcuUNFEeP17YhZa7gJX2+
                                                                                                                                                                                                            MD5:E51F40B42EE430C908229A31FA2EF83A
                                                                                                                                                                                                            SHA1:C6476C71BA2561E0230AC34E7257A61A86653279
                                                                                                                                                                                                            SHA-256:3F882CA1088017E3EDDE8CE31C3F9A1B09016FFDC2BBDA2674DB7CCA7D3F5196
                                                                                                                                                                                                            SHA-512:BB4708F1A241ACAD22F6055CD8CD88201D284FFE04CA5A5D2525BD7186A646932E0CFBC464870F3ED0A5E6966D6FA02FD0183C57446BDCF1DBE550DD12052483
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." .....0.......p........................................................`.........................................L..........\............P..@.......................................................8...........................................UPX0.....p..............................UPX1.....0.......$..................@....rsrc................(..............@..............................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_MD2.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):10752
                                                                                                                                                                                                            Entropy (8bit):6.904240110386442
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:192:Uk1XDqrH2n4sLKhXRJRzkQMz0jofSYX6NkYj273QJXinoY/R:jqryjyXRLAQE08fQNZa7gJXl8R
                                                                                                                                                                                                            MD5:FF4B2138EEB9357ADB7BE377D1DDDDE0
                                                                                                                                                                                                            SHA1:721CE94693E5AC7982E9A516D9E1652E3F2E10B4
                                                                                                                                                                                                            SHA-256:55B6A3024FA7262E7033F9037D2BA87523F9CA4A52E35C37868F6DEB63B29128
                                                                                                                                                                                                            SHA-512:5A413D890350DA7D61A5466818FC72EC5DBFAEBF4F8E85C244E30D5DB9C40AF4E81C9930127A456BFE06D0B3474F2F871FAEE5F1AA6DECC713700E55E8E5FB49
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...Q..f.........." .....0.......p........................................................`.........................................L..........\............P..(...............$.......................................8...........................................UPX0.....p..............................UPX1.....0......."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_MD4.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):10752
                                                                                                                                                                                                            Entropy (8bit):6.98436566972705
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:192:ipgm23TF55OsDTBHeLMU+0w+Ei0J/Tta+UdmtkYj273QJXbnBokQ:7zUsDTt0y+iFUdmtZa7gJX9HQ
                                                                                                                                                                                                            MD5:A17DE280D44190CD014E09343E54CCD6
                                                                                                                                                                                                            SHA1:0EB4E624E5F1F3BF966213A63FFFD9D015E2B228
                                                                                                                                                                                                            SHA-256:7FB778BF2344533D82320DD1D705672B5FCF38B349B87F47C92FF70CB067F800
                                                                                                                                                                                                            SHA-512:AEEC47E9C85ACC88F1C3EE21D64059ED460ABB10A070561E764994B6A0C1644B14BAB67BCF9874B55A93468B5C9DC23AF7EEAF66FF2F05989FA7D9E4097FB28B
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." .....0.......p..0.....................................................`.........................................L..........\............P..(...................................................0...8...........................................UPX0.....p..............................UPX1.....0......."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_MD5.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):12288
                                                                                                                                                                                                            Entropy (8bit):7.099770958825901
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:192:Ji1clPrWUqC02ilACSK7TzeWT1ekG4HDQr+Hh2i58gD9uzAOSkYj273QJXZnWa:4ClPrr02SNPSmJG4rMimZSZa7gJXA
                                                                                                                                                                                                            MD5:E6A7F81A9AA0B29A3476A1CFAF0DDBAC
                                                                                                                                                                                                            SHA1:348CCE3FF894B22023B5BBCEDA64336FDC8FAFE4
                                                                                                                                                                                                            SHA-256:0D823DCEE7ED77F047DAFCFF08137834A1300C646563E7AFB7E187085E19B6E0
                                                                                                                                                                                                            SHA-512:6F1BA4F4BC9229A093C4F7D5EB166C96D0BA16ACD232A2580AE502A847CE73745862EEB68F52F19613F26383A667B381B9F838B94FC39C2507A9BDAD310047F1
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." .....0.......p........................................................`.........................................L..........\............P..X.......................................................8...........................................UPX0.....p..............................UPX1.....0.......(..................@....rsrc................,..............@......................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_RIPEMD160.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):10752
                                                                                                                                                                                                            Entropy (8bit):7.0861687844835055
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:192:qLrOwIMFi0ZI+5/f8WjXICC4eGi//I4+qkYj273QJXhnt/u:ArKMFiqhfFXIRhDg4+qZa7gJXX2
                                                                                                                                                                                                            MD5:5BB80A4F1F593F61DCC3471419A1BE7D
                                                                                                                                                                                                            SHA1:9C93659825014E5D873AFAD998CC66F470BE2825
                                                                                                                                                                                                            SHA-256:4E41B0EA25652226B9CDB427362EF2A8EDB65DF4E86D9EF53D81E2BA2AB82203
                                                                                                                                                                                                            SHA-512:0629033A9EBEBB06656CFB942C0CFE70FAFF2794206CE0967E32F1515118E6449EF12FD3521BB4DBB093D1F5A9EFC88B1DD32421D5454BDAB859813F8F90F2F3
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." .....0.......p........................................................`.........................................L..........\............P..............$...........................................8...........................................UPX0.....p..............................UPX1.....0......."..................@....rsrc................&..............@..............................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_SHA1.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):13312
                                                                                                                                                                                                            Entropy (8bit):7.2165235597105335
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:192:x3LNqWu7xr5e0B08ZKY34+170LmTIHeIQUAHp2TkYj273QJXLH68:5vuJRZr/1SSIHSvpaZa7gJX2
                                                                                                                                                                                                            MD5:049F934A7D2BC5AFFEF87A89DF5CC205
                                                                                                                                                                                                            SHA1:86494A43BBA527B8E4B4926699B74309BDE9F6CE
                                                                                                                                                                                                            SHA-256:158875B358E0475A9985104034A9CE62F6F3A7ED191D823B6B70F3E8479EBBCC
                                                                                                                                                                                                            SHA-512:12CED430F0FC05D8D70E0EB102EB1E06A8428FE5D84A2CCD3606EA52F1F5B29E55ADBCD1DBC62811DEEA581C44800E717BBED1D7B12B474F0374FB6734050C3C
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." .....0...............................................................`.........................................L...........\............`..X...........$..........................................8...........................................UPX0....................................UPX1.....0.......,..................@....rsrc................0..............@......................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_SHA224.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):14848
                                                                                                                                                                                                            Entropy (8bit):7.257869356658698
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:384:T5bL5JdKCy6Lqo3CxYzoA+sm/NdNgtZa7gJXb:TNd86LfCyzoA3mljipL
                                                                                                                                                                                                            MD5:A9BC3A0C9E1836F85948B7A7C2741E09
                                                                                                                                                                                                            SHA1:A59EDD974D238CCD23A915C6803E5CA2AE59C480
                                                                                                                                                                                                            SHA-256:15CC1E598827A614268996561B32476AF9654CAEF9C4A0AA5E9299A9D72C62E6
                                                                                                                                                                                                            SHA-512:B2A65FD3AB617ABE7A03C0E3A6E9FCAA957F83FAB92C1DB73574B7D05E6A0DBF0D13B949A70D818645C14A3D651E4F889032E95250976E8BE0F53340EE162589
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...S..f.........." .....@...............................................................`.........................................L...........\............p..............4... ......................................8...........................................UPX0....................................UPX1.....@.......2..................@....rsrc................6..............@......................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_SHA256.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):14848
                                                                                                                                                                                                            Entropy (8bit):7.257827310821981
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:384:o5bL5JdKCy6L/58g+eYXELL43mi12j9+t4wZa7gJXb:oNd86L/yNjULLK1qo5pL
                                                                                                                                                                                                            MD5:75449B954EF15E958A881CE1A58DC089
                                                                                                                                                                                                            SHA1:689B4FF7695A9F8389D8C8B768B11E82DA9FA3BE
                                                                                                                                                                                                            SHA-256:5B6C42636E89EB321469B51D3468DE51E9B27A3935EB90183CE842036DF68DC5
                                                                                                                                                                                                            SHA-512:A8D5E58965E4F52ADAC1750AEBC0FF3C31834B71EDC4C05850B7173C988E0979B09CB2BAC2CFB7599210AFF3C5B5D17DE84E18E91335BC9C7B74CE2DA1E4D8B2
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...S..f.........." .....@...............................................................`.........................................L...........\............p..............4... ......................................8...........................................UPX0....................................UPX1.....@.......2..................@....rsrc................6..............@......................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_SHA384.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):15360
                                                                                                                                                                                                            Entropy (8bit):7.335277481327763
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:384:YaQeWO7PzpfLJigFDR0h7UiBKgI0tDZa7gJXd:xWCPlfVh3y7DBS0Vpt
                                                                                                                                                                                                            MD5:FD30BE87A7F051B7CEDAD875A4686D8A
                                                                                                                                                                                                            SHA1:640AD84B3B00FC7224D8E3E32C93095D12F81807
                                                                                                                                                                                                            SHA-256:1257363D570AE540D8654AD5EEF530C3C05A66B1BC4CA58DC4A9845372548BBD
                                                                                                                                                                                                            SHA-512:86E31076F0DD0AC91FFD5C4BE8AAB5C6274CD1C73CA9C6FC4B9F219F4B584B1B826B9A69CC35ACE0A5D44DAFF1802F6C8D9EE2B82EF580A88BCEF306300F07B7
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...T..f.........." .....@..........p.....................................................`.........................................L...........\...........................4.......................................p...8...........................................UPX0....................................UPX1.....@.......4..................@....rsrc................8..............@......................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_SHA512.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):15360
                                                                                                                                                                                                            Entropy (8bit):7.41112514918361
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:384:NeaQeWdfOexy9B3MC0uklIrDOxPvZa7gJXQ:NfWg2yjF0GDOxXpg
                                                                                                                                                                                                            MD5:12B66552F73FE03F30F546BEE57D7279
                                                                                                                                                                                                            SHA1:D0436DFA5EC295BD47DB08D023C4AD4230EFB6B5
                                                                                                                                                                                                            SHA-256:810079E59D51AA980C5AD5942E0881CBA44BF40026CCBA58964FC647C5054A90
                                                                                                                                                                                                            SHA-512:DB7F548194B677AD0F3A5405D89A21AB2D4BC7772DD9A9048B5015DEBB6A6994B9276A9D8E26483E9610C05874DDCDD3953AD0C8E305E31BDD8804463DD4C5F4
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...T..f.........." .....@..........@.....................................................`.........................................L...........\...........................4.......................................@...8...........................................UPX0....................................UPX1.....@.......4..................@....rsrc................8..............@......................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_ghash_clmul.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):10240
                                                                                                                                                                                                            Entropy (8bit):6.965304617922568
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:192:dGK1CChUEjQPmO8MkWRlRJ/UB6FRsIHkYj273QJXu3bpt:UJVFlUB6jsIHZa7gJX2
                                                                                                                                                                                                            MD5:2BF5B7572D7783B266EAF86C749AC484
                                                                                                                                                                                                            SHA1:FA2BCEE7C10F6434059B79F5B6AB0EBA5D4A591E
                                                                                                                                                                                                            SHA-256:842C28C8687A642BC5C6DD502D730E40E0D71401BCEF5F5809279142241C550D
                                                                                                                                                                                                            SHA-512:DAF1DDCE4612B72181DB48399A4BBAF70B8E28F50E6992D3887AEEA7EEBC752985F56627A3DD8772B3AA1B4ABF6A48B4BAA01788DCE5187B3FFE36D19C3E3D72
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...V..f.........." ..... .......p........................................................`.........................................T..........d............P..........................................................8...........................................UPX0.....p..............................UPX1..... ....... ..................@....rsrc................$..............@......................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_ghash_portable.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):10752
                                                                                                                                                                                                            Entropy (8bit):6.847627164690376
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:192:QN1CChUEjQPmO8HCD/yQEVJLflLfB1fiorkYj273QJX8nEJ:3J6A9IJLdfB1fFrZa7gJX3
                                                                                                                                                                                                            MD5:10056DFC8DDD44CC06150F093245C160
                                                                                                                                                                                                            SHA1:232E225E4559DBC8A230A7FE193138F1993AC54B
                                                                                                                                                                                                            SHA-256:D542395F976F9436E5E892D753B4CE5D8D46B98E313DA26519B26757FA24670D
                                                                                                                                                                                                            SHA-512:27DD1780B449DA6CF205689691F70775E36705C37425B3F0DF8876EEEFB04830E41D4BE830AD6FE9A9D9783C1364EC4AA63D2E1E198DCEF17987FB33ABA74147
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...V..f.........." .....0.......p..0.....................................................`.........................................L..........\............P..X...............$...................................0...8...........................................UPX0.....p..............................UPX1.....0......."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_keccak.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):12288
                                                                                                                                                                                                            Entropy (8bit):7.019759823328802
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:192:pp1oHdD3VpsdrqkCphVavitay5xyvCBfd9Gkm6orkYj273QJX0nJ7:s3fKTCxavinyaZeAorZa7gJXG
                                                                                                                                                                                                            MD5:60625A54C5510D87FB2FC55A33274CF9
                                                                                                                                                                                                            SHA1:F98EC281990429FA62D8E24E8E337368930DAAE4
                                                                                                                                                                                                            SHA-256:C42B8ACE5CDE98F141301C671E4255E3F132A400396C5E6441F2A95B1E079549
                                                                                                                                                                                                            SHA-512:90587C3F669092D5B86CC9F62D00510ACB2E10EC8B0F0AB26960E03C02E86C26360C5A101B4AC924521DC8E55323DC8A2B664AE535A8C259BAECEC306CD3087D
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...U..f.........." .....0.......p.......................................................`.........................................L..........\............P..X...........@..........................................8...........................................UPX0.....p..............................UPX1.....0.......(..................@....rsrc................,..............@......................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Hash\_poly1305.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):11776
                                                                                                                                                                                                            Entropy (8bit):7.0330491725625
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:192:Q6W17kMnWzpM3mXoEdh29xFeOSegeNkYj273QJXtnME:QwMWzpMWXoEbFOSegeNZa7gJXu
                                                                                                                                                                                                            MD5:121238CA4832015A2429DD6F3512F833
                                                                                                                                                                                                            SHA1:1DC658E4EEC0A731FBEEAE99C64DEF6FAEB85F69
                                                                                                                                                                                                            SHA-256:0EC29593189A9321AEA9236CC88A8C9B58B3440E8BE9D7EFD65C85BB7E5C6E4E
                                                                                                                                                                                                            SHA-512:26BBBA278FE74DEA8F39F5A41E810783AD18BEFE8579DE552EABECADCE7E3827BFC2D034EE872BF801F9A54BAAF959E9AFB379EB53A4EB1054363D2CCA260AD8
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...V..f.........." .....0.......p........................................................`.........................................L..........\............P..|.......................................................8...........................................UPX0.....p..............................UPX1.....0.......&..................@....rsrc................*..............@......................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Math\_modexp.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):20480
                                                                                                                                                                                                            Entropy (8bit):7.582234195865062
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:384:SVPYY2Eqk95s92Jd5yYA2ocvSmO8wapXyxIgTeS488QKvZa7gJXx:ewY2pk9dHKWvSlDQcI1xph
                                                                                                                                                                                                            MD5:93A2FC7C8EB10030EB45B118548B53D5
                                                                                                                                                                                                            SHA1:19054EBE282F106CBA676742FF42EFC79DE59837
                                                                                                                                                                                                            SHA-256:6E8E5FAA9B7AE63E07693B41799F749093A02E518EBD86DFD688AE734E98C671
                                                                                                                                                                                                            SHA-512:DD235FE97EE9A0C4B2FDEBA5F632129865DB3DB86259C02F9D9728511330BECCCF8BE7B1E9B179B729DA2CB4A94C9A68906EEC94FCE81201AE170494BEA76C7A
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...|...5...}...~...U...,...u...,...v...,...}.......|............._.............Rich~...................PE..d...^..f.........." .....P.......... .....................................................`.........................................L...|.......\...............<................................................... ...8...........................................UPX0....................................UPX1.....P.......H..................@....rsrc................L..............@..............................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Protocol\_scrypt.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):10240
                                                                                                                                                                                                            Entropy (8bit):6.7816437661656
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:192:rg1QdqOkpEh83hgAXfW2OAAh6wkYj273QJX43Oyb:rbqO+Eh8xgAX+2OZ6wZa7gJXV
                                                                                                                                                                                                            MD5:1AC3E0138FF30096F0937F938C902FF7
                                                                                                                                                                                                            SHA1:E4F49AF5429FF9A15DD389F984DEDFE43AA7912F
                                                                                                                                                                                                            SHA-256:656A6E38AA91EFB8CBA4308551CBE1647A9F76389BAA1B6EF8103633FB3603A1
                                                                                                                                                                                                            SHA-512:90B61A6665A88059518889B9439675691D506C88A3A164A5A1B42B765F1C5DECFE64D078E7F969FCFF4746E2B3FDA496FF1C256E6C760A96227726219EC28A53
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^:.6?T.6?T.6?T.?G..2?T.dJU.4?T.}GU.5?T.6?U..?T.dJQ.<?T.dJP.>?T.dJW.5?T..J\.7?T..JT.7?T..J..7?T..JV.7?T.Rich6?T.........................PE..d...Z..f.........." ..... .......p........................................................`.........................................L...d......\............P..4.......................................................8...........................................UPX0.....p..............................UPX1..... ....... ..................@....rsrc................$..............@......................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\PublicKey\_curve25519.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):14336
                                                                                                                                                                                                            Entropy (8bit):7.264664149380351
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:192:0NdFl9xgCYsB43vddIU5PU7XBtKZI0TWTMxpfEVt5jhjBDfuZDkYj273QJXO3R2A:0NdQPj3vdJ87fWT3xy19baDZa7gJXA2
                                                                                                                                                                                                            MD5:F6F90127990AA8094A5EE8B64BF5A25F
                                                                                                                                                                                                            SHA1:F881DFD0794531A2F23D08D6B4183F32D112FF63
                                                                                                                                                                                                            SHA-256:DFAECD1EE60BF8785BE9A3264602E0A0BB28D5DDF983E7705EEC22F79A07794A
                                                                                                                                                                                                            SHA-512:324DB41B16C6EBC96FF50F1448BCEF5172E55D105F54DF28AF16CF61352151A792DA157409D1B67BD7B55480D525736A3C62D270ED474BAED09E7D968CD50911
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...\..f.........." .....0..........P.....................................................`.........................................L...........\............p..............L.......................................P...8...........................................UPX0....................................UPX1.....0.......0..................@....rsrc................4..............@..............................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\PublicKey\_curve448.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):26624
                                                                                                                                                                                                            Entropy (8bit):7.709093804241634
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:768:RGkgn0uw0f9tuMgZj6SgoM+mHh8zBhOsbipS:kk60qf1SxM+Sh8zBZbH
                                                                                                                                                                                                            MD5:3BC254EB74AA919B1E77C71505306F68
                                                                                                                                                                                                            SHA1:0A7D3BB6BA93CAE2CAF41207B60566690C50502D
                                                                                                                                                                                                            SHA-256:CCF351CA444227C1B2BBD88B23D965082ED2AB8955BF3218CE15B49B09F17F37
                                                                                                                                                                                                            SHA-512:B5F0DCCC9D424D0EFC050B27478A9CF1AC8C75F9ADA8FD321091392C68BBC8F8E25617EAC3983FFB4F9C0DB6CA0B8763E0E41EA4C93925B70EC3AC5C243F54D4
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...|...5...}...~...U...,...u...,...v...,...}.......|............._.............Rich~...................PE..d...\..f.........." .....`..........Pa....................................................`.........................................Lr..0....p..\....p....... ..$...........|s......................................Pm..8...........................................UPX0....................................UPX1.....`.......`..................@....rsrc........p.......d..............@..............................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\PublicKey\_ec_ws.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):640000
                                                                                                                                                                                                            Entropy (8bit):7.998704897182076
                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                            SSDEEP:12288:PIahn0k2jt5j5hjcFCGQNKQ8J2NWqZxjYDHJrX2cQ6GFlBg+cogRfG9jU:P0fX9pcXO/NWixjYrJdCHqVVsZU
                                                                                                                                                                                                            MD5:B5DBAC8FEA6E95E9F7D3754FE1C7A198
                                                                                                                                                                                                            SHA1:10D08BF86DEEB1E58E1CB2B68601B9B6C17B9738
                                                                                                                                                                                                            SHA-256:472151F81BAC50922AEFD2DCCBE7BDA082D15AF95C2749EC95FFF64363F3672C
                                                                                                                                                                                                            SHA-512:0F25040CB142E0DB883B8B94B8F757DD1EB77E452B5C279246D9D02AFA6C934E6A79F6BB3B84FD40FA6E3568C209EE19628A9359467584CB0F9AD56325F81E91
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........s.. .. .. ... .. ..!.. ..!.. .. .. ..!.. ..!.. ..!.. \..!.. \..!.. \.r .. \..!.. Rich.. ................PE..d...[..f.........." .............`.......p...................................@............`.........................................L2..h....0..\....0.......................3.......................................*..8...........................................UPX0.....`..............................UPX1.........p......................@....rsrc........0......................@..............................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\PublicKey\_ed25519.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):15872
                                                                                                                                                                                                            Entropy (8bit):7.365125845689717
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:384:sGBfc1QlWR3bEsLMf6Ufn10euH/4hZa7gJXN1m:sGkQN6awqpd1m
                                                                                                                                                                                                            MD5:9234681AE65FF9F6B5278407EDE1D03E
                                                                                                                                                                                                            SHA1:1C938927279F0718512496611B69E86CABD8ACA5
                                                                                                                                                                                                            SHA-256:FA815A3B065D423DD73A361EBA170C8B6825529F25F4CA3F32968A12BB364CE2
                                                                                                                                                                                                            SHA-512:69C3FA558574C950FFCCD1F2BD3A090F8E129BBC221FE03B5C4AA6428C3955871A7E8736C84986BC72DBC502624A052DC50E4053145103A69700E2575A09AB40
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...]..f.........." .....@..........@.....................................................`.........................................L...0.......\...........................|.......................................@...8...........................................UPX0....................................UPX1.....@.......6..................@....rsrc................:..............@......................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\PublicKey\_ed448.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):28672
                                                                                                                                                                                                            Entropy (8bit):7.764536138341586
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:384:+YWTbll1RIaPUAc5BjOxy2VANd9N/Q6/HgnhkX4ts6GGZa7gJX7AgM:fablfRBPUAc3j32VANdTQ6fzX4tlprA
                                                                                                                                                                                                            MD5:02A9596AD840DCEA60FA6D52F8BEE945
                                                                                                                                                                                                            SHA1:3E7A5751187496CF9538347B4B81A42E4532E706
                                                                                                                                                                                                            SHA-256:7459473F494866B3828869FA96564FD35D32BD6A7904522BD53084C16763EA2A
                                                                                                                                                                                                            SHA-512:AD0E397E12662059B45A313B4E68C00A90F77CA387766257CFF18BE318C77CF16850F44A9FFB0E1821CD2DBA3DDB152FD67FC8121E6772B2B551404B40121576
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...|...5...}...~...U...,...u...,...v...,...}.......|............._.............Rich~...................PE..d...^..f.........." .....p.......@......P................................................`.........................................L...h.......\............`..l......................................................8...........................................UPX0.....@..............................UPX1.....p...P...h..................@....rsrc................l..............@..............................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Util\_cpuid_c.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):9216
                                                                                                                                                                                                            Entropy (8bit):6.706733620766704
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:192:g51jwkl3nSW/TftRVw61csNbbNkYj273QJXpHj:g5CkwWbft0rs1NZa7gJXJ
                                                                                                                                                                                                            MD5:D99FAD915B5F7BEACC6FBFC981EF7C6B
                                                                                                                                                                                                            SHA1:DA98B3640D42FEC05C2D7A540E3E06336825F4F0
                                                                                                                                                                                                            SHA-256:F82BF7B4856EFB676E05EF34447D03423FF13A8A3F57457A257A4DB7FCB8453F
                                                                                                                                                                                                            SHA-512:F9F810CA818CDE0E4D065BD138B99D26D3B8121E2745E3EB23DFA0881E43353ED0384B9658144B5D9FAD15CBB67587A0E44F0DDA5B4E06A8780E33039303E8F6
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...X..f.........." ..... .......p..p.....................................................`.............................................|...................@..............|.......................................p...8...........................................UPX0.....p..............................UPX1..... ..........................@....rsrc................ ..............@......................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\Crypto\Util\_strxor.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):9216
                                                                                                                                                                                                            Entropy (8bit):6.702844475658512
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:192:HohKeeuBxm0jMuCicColTjCu9WkYj273QJXEHj:IhxpgTSu9WZa7gJXw
                                                                                                                                                                                                            MD5:E0A33DE4E09E7810A788C9140B26277B
                                                                                                                                                                                                            SHA1:8E874FC12BEFC50AB2A91FA2A0F271B60B0BC718
                                                                                                                                                                                                            SHA-256:585F0C6B9C0AA6B7C7FCBFA7BBB9FBBD14340A0B65F32E14D75AB80CA2AC5BCB
                                                                                                                                                                                                            SHA-512:39088711CC8816E303548653FCDE48666E1427F180EB2DAF18367937151469D03C88371440CB495AAB4AD35DD78269EF7F4C598A96F0AADC64F3B99394979F58
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...Z..f.........." ..... .......p..p.....................................................`.............................................t...................@..............t.......................................p...8...........................................UPX0.....p..............................UPX1..... ..........................@....rsrc................ ..............@......................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\VCRUNTIME140.dll

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):109392
                                                                                                                                                                                                            Entropy (8bit):6.641929675972235
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
                                                                                                                                                                                                            MD5:4585A96CC4EEF6AAFD5E27EA09147DC6
                                                                                                                                                                                                            SHA1:489CFFF1B19ABBEC98FDA26AC8958005E88DD0CB
                                                                                                                                                                                                            SHA-256:A8F950B4357EC12CFCCDDC9094CCA56A3D5244B95E09EA6E9A746489F2D58736
                                                                                                                                                                                                            SHA-512:D78260C66331FE3029D2CC1B41A5D002EC651F2E3BBF55076D65839B5E3C6297955AFD4D9AB8951FBDC9F929DBC65EB18B14B59BCE1F2994318564EB4920F286
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........u...u...u.E.t...u.....u...t...u..v...u..q...u..p...u..u...u......u..w...u.Rich..u.........PE..d..._#;..........." ...".....`......................................................=.....`A........................................`C..4....K...............p.......\..PO...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......D..............@....pdata.......p.......H..............@..@_RDATA..\............T..............@..@.rsrc................V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\_asyncio.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):38680
                                                                                                                                                                                                            Entropy (8bit):7.696873540555824
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:768:oJSccN4rYjmVdRxZc6MCipEJIGOng05YiSyvSeEAMxkEX:o8j4r7DmCFJIGOnge7SyaeCxT
                                                                                                                                                                                                            MD5:BC5F1A631A5B2B0D874654CA17C327A7
                                                                                                                                                                                                            SHA1:D391E3198D69FC420F737D9FC31153892DED57DE
                                                                                                                                                                                                            SHA-256:A889045C5855D964B490FE6413FECC34D03FEA5B5925C722655885AEA0BD5B84
                                                                                                                                                                                                            SHA-512:4B2D46DFF34045E7ECA25B24831172A803BEDB84248C2EB8BC438BB672BE8D1F8374149DD2335CE437A7F8E8AFF3A4EBD025E90AC58319A420C5C6CF5748078D
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 3%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B:.T.[...[...[...#*..[...'...[...'...[...'...[...'...[...&...[..M#...[...[...[...&...[...&...[...&F..[...&...[..Rich.[..........................PE..d...Q..e.........." ...#.`...........9.......................................`............`..........................................Z..P....Y..P....P......................D[.......................................E..@...........................................UPX0....................................UPX1.....`.......X..................@....rsrc........P.......\..............@..............................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\_brotli.cp312-win_amd64.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):279040
                                                                                                                                                                                                            Entropy (8bit):7.992754100181066
                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                            SSDEEP:6144:1MekaHmIW3JkTJGnlffcRwF3sfDhcpntP43tSy+54JO:WTB3UWXQipu3t7c
                                                                                                                                                                                                            MD5:0EB17C658E41394A867A4C185D19F220
                                                                                                                                                                                                            SHA1:EFD39F6E8D7679181D1BC05930C4414857A444D8
                                                                                                                                                                                                            SHA-256:8768E373A4E82722CFCAB2511544A9C2A6DC8FBCC59475986A68C59135917907
                                                                                                                                                                                                            SHA-512:1401258D859E1AD7D10162CC2E132706CCBE10C5F48A4A36F2386E3811ACA1F040A32D3E6B13DFAA126E6AF42610692E1F9B0FC221DCBCA38C45746D73451BF2
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]ws..............n......j......Rn......j......j......j.......k..........$....k..9....k.......k.......k......Rich....................PE..d...7..d.........." ...#.@................................................................`.........................................,...`.......<.......................................................................@...........................................UPX0....................................UPX1.....@.......:..................@....rsrc................>..............@......................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\_bz2.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):49944
                                                                                                                                                                                                            Entropy (8bit):7.783132151019094
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:1536:G/onT0xi3xXtfwYf5CVW3Bd7IGCVwU7SyixL7:G/k538e5CIRlIGCVwUO7
                                                                                                                                                                                                            MD5:7B93D289D8342003264EA364E707A929
                                                                                                                                                                                                            SHA1:C48CC5668FEAA94C6BD2D6A869227D818ED03398
                                                                                                                                                                                                            SHA-256:56FA7963B53BB2DADB6B6AC669084521D5873923C16192030D3D8A7741F8C720
                                                                                                                                                                                                            SHA-512:26521252685A52C331204CA1C38E3E80C31E16209B6016C433FEB0348B40240E17094C3A51723839496F1906CB4A1472752AAA1CC135D61D23D681A485C3CD90
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 3%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w.l.3...3...3...:...9......1......0......>......;......7.......0...x...1...3...l.......;.......2.......2.......2...Rich3...................PE..d...f..e.........." ...#.............e....................................................`.............................................H.................... ..,...................................................q..@...........................................UPX0....................................UPX1................................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\_cffi_backend.cp312-win_amd64.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):73216
                                                                                                                                                                                                            Entropy (8bit):7.915393474934398
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:1536:rYKYjVhOKr5WNqYZbeKaMoxrZQmAQqdtXEb53a/Tw:1YxEkW91O/mLQqdOl
                                                                                                                                                                                                            MD5:9C42595725784639A9490FD262B79994
                                                                                                                                                                                                            SHA1:02D555F1B62C4B6B7AE98ABEAC129856024BBEDA
                                                                                                                                                                                                            SHA-256:C7FE8E9CCBEDF87171A604E5406CBC65520DBBBFC750DCF0432B56E63F1A12CB
                                                                                                                                                                                                            SHA-512:F1F1ADCDD807AF48C6282F079B34DDAB2A043D6145B667C79F0E53D482CD404FF03132E20BC88D43872E0A0AE1C17207C8C1524B33BE87F4B37235A2A6BB35C4
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......a..#%p.p%p.p%p.p,..p)p.p5.q'p.p5.zp!p.p5.q!p.p5.q-p.p5.q)p.pn..q!p.p6.q&p.p%p.p.p.pm..q!p.p,..p$p.pm..q$p.pm.xp$p.pm..q$p.pRich%p.p........................PE..d...W..f.........." ...). .......@...U...P................................................`..........................................s..l....p.......p..........T...........ht.......................................a..@...........................................UPX0.....@..............................UPX1..... ...P......................@....rsrc........p......................@..............................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\_ctypes.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):60696
                                                                                                                                                                                                            Entropy (8bit):7.822216451119025
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:1536:kbK/YBHE2gCtX+/9zyeoVIkwLMzKep8z+IGLPAt7SyWxU:kGAK2ghtGIk6MeeGyIGLPAtz
                                                                                                                                                                                                            MD5:39E76F6794B87D7B0AF9CB3A40009736
                                                                                                                                                                                                            SHA1:B23BE9B2F1DC5EBDB1A5B4E75BD423A3777DCB03
                                                                                                                                                                                                            SHA-256:479EAAD69BCBC8BD6CC4F0F3411A92185B780C80687A9596D3F283EEAA68D171
                                                                                                                                                                                                            SHA-512:193F420CDEFC11AFF1891C4E0E9D02EE7A9C718B446FC42B2363A1539D0A1ED78E7054C33D1EDBF443A8664D68A31C510A1ED1F48DC561ED5773D1F2DA770E04
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 3%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>...z.z.z.s...|....x....v....r....~.....x.1...{.1...|.....y.z.......|.....{...o.{.....{.Richz.................PE..d...c..e.........." ...#.............-.......................................P............`.........................................HL.......I.......@.......................L.......................................9..@...........................................UPX0....................................UPX1................................@....rsrc........@......................@......................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\_decimal.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):108312
                                                                                                                                                                                                            Entropy (8bit):7.930158683046724
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3072:RnHQe/FKYjTnmuJkv4D5ZIBGeKHC6ajQ6BWIGOqmbtbb9:RnHQe/MYjTnDJRX6Ge16ehbhx
                                                                                                                                                                                                            MD5:07BB60C9039423EC170ECB6550A5E685
                                                                                                                                                                                                            SHA1:556A754DAE6813883144F4DEE755DA68FD5197BE
                                                                                                                                                                                                            SHA-256:A0DD49BB57B6EBB78482E6E4CDE24D358EB676C7A7B29B217379DBD90F985DA6
                                                                                                                                                                                                            SHA-512:07414189A52A84672C3F9BA6D598049D005958F42195BB38FB58751F3FE345C267DBB4142B80157CB31F96DCDCBBFE69DA1F97E6D5E9BC7EB7DFBA5F982493FC
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 3%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@.R.!...!...!...Y=..!..+]...!..+]...!..+]...!..+]...!..M\...!...Y...!...!...!..M\...!..M\...!..M\...!..M\Q..!..M\...!..Rich.!..........PE..d...T..e.........." ...#.p...................................................0............`..........................................,..P....)....... ...........'...........-..........................................@...........................................UPX0....................................UPX1.....p.......f..................@....rsrc........ .......j..............@......................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\_hashlib.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):36120
                                                                                                                                                                                                            Entropy (8bit):7.670439671412394
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:768:6uKW7574DsajR20fnfPHz8HLP8pfbnIGOINg5YiSyvIAMxkE3n1:JKW7hq00fnTQEbnIGOINy7Sy+xzn1
                                                                                                                                                                                                            MD5:E9817DBEB15E1C4EB8E83E2290F566DA
                                                                                                                                                                                                            SHA1:FFAEAB66BFD23AE65FD3EC56C14B5359FB1DE0F6
                                                                                                                                                                                                            SHA-256:CC47548D1B9AE5293756FB75373482299C745FCA8C0A68C9C8779073EE4F59B1
                                                                                                                                                                                                            SHA-512:109747ED8ED939895224BAF2611A3D90AE23CACAC8B38AA6966211306AED85139065703869321A9394F6A788C750FDF1E49161C0E65E43C048D43F657B74EB63
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 3%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........u...&...&...&.U&...&u..'...&u..'...&u..'...&u..'...&...'...&...'...&...&M..&...'...&...'...&..9&...&...'...&Rich...&........PE..d......e.........." ...#.P.........../.......................................P............`.........................................|K..P....I.......@.......................K.......................................;..@...........................................UPX0....................................UPX1.....P.......N..................@....rsrc........@.......R..............@..............................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\_lzma.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):87832
                                                                                                                                                                                                            Entropy (8bit):7.91726740491422
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:1536:cRQY6vZR307kwHMn3NsbM5PlvQzSqoSdPN1uruZkU2D90nGt4pcgIGZ1rA7SyTx7:uQY6nEZe3NsbI1QzSwlaugudNIGZ1rAP
                                                                                                                                                                                                            MD5:34549863E00005080416DC1D3827895F
                                                                                                                                                                                                            SHA1:DE955741C90CAFF0F3401BEB66AD4AC83DBE9DCF
                                                                                                                                                                                                            SHA-256:44C0D49356E2BC5546B6F7CA8F290821DA336561DA275EC02EDD055BEBC1C90E
                                                                                                                                                                                                            SHA-512:3C9D94EDA63FF57F0CE58BA2156B9922C453D5700DEC625253146B4F292F0F9175D5ECD6AF30FCC98B0F29D864F5821D3DEF6FAE54D66B5167FFE342B76C3801
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 3%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........TB#.5,p.5,p.5,p.M.p.5,p.I-q.5,p.I)q.5,p.I(q.5,p.I/q.5,pnH-q.5,p.M-q.5,p.5-p.5,pnH!q.5,pnH,q.5,pnH.p.5,pnH.q.5,pRich.5,p........PE..d......e.........." ...#. ...............................................................`.........................................4...L....................P.........................................................@...........................................UPX0....................................UPX1..... ..........................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\_multiprocessing.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):27928
                                                                                                                                                                                                            Entropy (8bit):7.494153215552285
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:768:PDAcYfayYp5z4IGWt9x5YiSyv2pAAMxkEn:EcCGz4IGWt9/7SyOOxj
                                                                                                                                                                                                            MD5:8B840CB3413AC1B0B77E003D585B474E
                                                                                                                                                                                                            SHA1:F6FA5B9D0CD00881BE0A0EB8B40EE02BF772AFB8
                                                                                                                                                                                                            SHA-256:6D014026BC88DBE37D53B50DD18AC3DC9E1C02A597CC3BD7A6D4F4C44AC65C82
                                                                                                                                                                                                            SHA-512:D3608EFE3B08DF7482D1695D719A0265968BBD5A32D09001DA203CDA4D1CB6567BEAB903ED72629D5F15724B01E7918D54DB43AD3E1E05FC663362D5CD9F968B
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 3%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........)*.wGy.wGy.wGy...y.wGy'.Fx.wGy'.Bx.wGy'.Cx.wGy'.Dx.wGyA.Fx.wGy.wFy.wGy..Fx.wGyA.Jx.wGyA.Gx.wGyA..y.wGyA.Ex.wGyRich.wGy........................PE..d...W..e.........." ...#.0................................................................`.........................................4...`....................p..........................................................@...........................................UPX0....................................UPX1.....0..........................@....rsrc................2..............@..............................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\_overlapped.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):34584
                                                                                                                                                                                                            Entropy (8bit):7.637658154374066
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:768:JqfuLYw3hSxhiMM/v3Lhsr5bm7p6j7IGXt9P5YiSyvxM6AMxkEw:JqfC3hSnit33Lh2KEj7IGXt9h7SyNxM
                                                                                                                                                                                                            MD5:308D180970B3A6A3389B828551F380BE
                                                                                                                                                                                                            SHA1:29BD14918C3B1B951EA4D3A5FE43E9ED14FBAC63
                                                                                                                                                                                                            SHA-256:6CB8989DDB962CC1FC4AA0FB55E0D0421E552B7C11475198017171BA9B13539D
                                                                                                                                                                                                            SHA-512:7EC1AF33219EBB3193F49290AC54B18E15A0B7584E7D62E08311540AC60EFC13B6F05248C5AE6286566483D2D282047DD404EFBB89EFF3C4F3CEFADB83148C69
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 3%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|!{X.O(X.O(X.O(Qe.(\.O(.aN)Z.O(.aJ)T.O(.aK)P.O(.aL)[.O(.`N)Z.O(X.N(/.O(.eN)].O(.eK)Y.O(.`B)Y.O(.`O)Y.O(.`.(Y.O(.`M)Y.O(RichX.O(................PE..d...V..e.........." ...#.P..........`........................................ ............`.........................................t...X...........................................................................p...@...........................................UPX0....................................UPX1.....P.......H..................@....rsrc................L..............@..............................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\_queue.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):26904
                                                                                                                                                                                                            Entropy (8bit):7.417965806918985
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:768:Vzh/iDHAPcpqyIGQUNz5YiSyvHAMxkEJ5YSv:1hiDHAP5yIGQUN97SyPx/Y+
                                                                                                                                                                                                            MD5:C7FD1D372211BE50EC7BD692F566E8A6
                                                                                                                                                                                                            SHA1:8099F47303E917F05B06EE88A44992B89515496F
                                                                                                                                                                                                            SHA-256:3CFE97BD4ECCB9C69B1E08E140098189F3011EA7A43B358AE1F7F5C7220DD397
                                                                                                                                                                                                            SHA-512:3A6304865F4F136FF983A64BA0E0A10950EA0FF0E4602EF3859AC51B40FFA3B09A6B3D8B6C86603194979D0CC7778271676EA0FE75093A2E6036EC0E2D56D9A3
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 3%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B:W\.[9..[9..[9..#...[9..'8..[9..'<..[9..'=..[9..':..[9..&8..[9.M#8..[9..[8.M[9..&4..[9..&9..[9..&...[9..&;..[9.Rich.[9.........................PE..d...Y..e.........." ...#.0...............................................................`.............................................L.......P............`..............<..........................................@...........................................UPX0....................................UPX1.....0.......*..................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\_socket.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):45336
                                                                                                                                                                                                            Entropy (8bit):7.717736433119785
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:768:o1X8HEfobVbgwsIZsQD182/q2vQttkmnIzPnzTpwOgIGLwgBT5YiSyvvBAMxkEn:wXz0gwsGsQD1ZbmiSOgIGLwgBd7SyZxL
                                                                                                                                                                                                            MD5:CE773BF599AA4664533AC42410520FA2
                                                                                                                                                                                                            SHA1:661350EC2718B0A5D221D3D11687C93C00CBA777
                                                                                                                                                                                                            SHA-256:D6D04F0E7D8C396F85E8DB82750224F454D17EF0648F8D11A3A76E0287D39FA5
                                                                                                                                                                                                            SHA-512:A25C04034459D0BF82D61AF123A0AD37548689D048E026F0A2D2836D45A0BBE8E82B073ECAE417147A407E34768B45BC8C46242DE78283AFB7BEC8D8C60A434F
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 3%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........J./.+z|.+z|.+z|.S.|.+z|.W{}.+z|.W.}.+z|.W~}.+z|.Wy}.+z|}V{}.+z|.+{|.+z|.S{}.+z|}Vw}.+z|}Vz}.+z|}V.|.+z|}Vx}.+z|Rich.+z|................PE..d......e.........." ...#.p.......... q....................................................`.........................................D...P....................0......................................................0}..@...........................................UPX0....................................UPX1.....p.......p..................@....rsrc................t..............@......................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\_ssl.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):67352
                                                                                                                                                                                                            Entropy (8bit):7.856092146754657
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:1536:mRuyAdinkEweTTDWPnQfNnPAdu8LfPXrBIGC777m7Synx5:YF9fEo58DPXdIGC77yN
                                                                                                                                                                                                            MD5:4C86933F615D895BC421199CC4F74A74
                                                                                                                                                                                                            SHA1:90496BF51B37165BD2D7F213AD886CDECD991679
                                                                                                                                                                                                            SHA-256:BF2AAA5FBB9CA9DAE5D138B1C70DE1E6B52005ECED94FC31873AB4F9C14719AC
                                                                                                                                                                                                            SHA-512:1CF91A962F973A906C527BC83243FCEA84A9AAD70E21339893EEF0A5BAFEDD05E5F66618E0D9040977413B933F19DD27FFEAB743551C491690C7E620C7043AEF
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 3%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U.k.4.8.4.8.4.8.L)8.4.8.H.9.4.8.H.9.4.8.H.9.4.8.H.9.4.8kI.9.4.8.4.8#5.8.L.9.4.8kI.9.4.8kI.9.4.8kIE8.4.8kI.9.4.8Rich.4.8........................PE..d......e.........." ...#.........@.......P...................................0............`.........................................l,..d....)....... ..........8............,..........................................@...........................................UPX0.....@..............................UPX1.........P......................@....rsrc........ ......................@..............................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\_wmi.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):28952
                                                                                                                                                                                                            Entropy (8bit):7.472560755921187
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:768:oWw1HQYXj+pMUbIGCi9lx5YiSyvzAMxkEaFy:oWMpUbIGCi9h7Syrx+g
                                                                                                                                                                                                            MD5:6692FB61DADAE290E9C9D1B18F8F567D
                                                                                                                                                                                                            SHA1:4001C0347BA6E0FDBB05453D39549712F62B2B81
                                                                                                                                                                                                            SHA-256:235282A0C0EDE0AC029AD5831DF01B4E3BBDEA7960E864369EFC797105ABD895
                                                                                                                                                                                                            SHA-512:11B21EE9B7FFC32E0EF5E26E107DF9260CC22FF415F27DFEF680C3F36EC74C935263DC3C21B03D408D37E42C9188C0E51A760F61C63238C9CC45F0AE8207CF31
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 3%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._\...=.@.=.@.=.@.En@.=.@.A.A.=.@.A.A.=.@.A.A.=.@.@.A.=.@.A.A.=.@PE.A.=.@.=.@A=.@PE.A.=.@.@.A.=.@.@.A.=.@.@.@.=.@.@.A.=.@Rich.=.@........PE..d..._..e.........." ...#.0.......... .....................................................`.............................................H.......\............p..`...........@.......................................0...@....................S..@...................UPX0....................................UPX1.....0.......0..................@....rsrc................4..............@......................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\base_library.zip

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):1329520
                                                                                                                                                                                                            Entropy (8bit):5.586689148227218
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:12288:uttcY+b+vOmgRF1+fYNXPh26UZWAzau7j5D95wXgkVHdYOP4wwMw9gCCaYc23:uttcY+mHCiaA5TnqHdYOPxmEaYc23
                                                                                                                                                                                                            MD5:73F91FE1B7771F022020DDF0AC619CDE
                                                                                                                                                                                                            SHA1:D9ECB3061627C94F2CF6C1B7A34FEA2CDBD13DF7
                                                                                                                                                                                                            SHA-256:763457EC96D1D2AFDDFFA85523D59AA351208BFDF607F5C5F3FB79A518B6D0C2
                                                                                                                                                                                                            SHA-512:CB85666C7E50E3DBF14FC215EC05D9576B884066983FE97FA10A40C6A8D6BE11C68CA853E7F7039EC67E6B2D90E8C8A3273039B4B86D91D311BCDDCDD831B507
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:PK..........!.x[_C............_collections_abc.pyc......................................Z.....d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.............Z...e.d.........Z.d...Z...e.e.........Z.[.g.d...Z.d.Z...e...e.d.................Z...e...e...e.........................Z...e...e.i.j%..........................................Z...e...e.i.j)..........................................Z...e...e.i.j-..........................................Z...e...e.g.................Z...e...e...e.g.........................Z...e...e...e.d.........................Z...e...e...e.d.d.z...........................Z...e...e...e.........................Z...e...e.d.................Z ..e...e.d.................Z!..e...e...e"........................Z#..e.i.j%..................................Z$..e.i.j)..................................Z%..e.i.j-..................................Z&..e.e.jN..........................Z(..e...d...................Z)d...Z*..e*........Z*..e.e*........Z+e*jY............................[*d...Z-..e-........

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\certifi\cacert.pem

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):299427
                                                                                                                                                                                                            Entropy (8bit):6.047872935262006
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
                                                                                                                                                                                                            MD5:50EA156B773E8803F6C1FE712F746CBA
                                                                                                                                                                                                            SHA1:2C68212E96605210EDDF740291862BDF59398AEF
                                                                                                                                                                                                            SHA-256:94EDEB66E91774FCAE93A05650914E29096259A5C7E871A1F65D461AB5201B47
                                                                                                                                                                                                            SHA-512:01ED2E7177A99E6CB3FBEF815321B6FA036AD14A3F93499F2CB5B0DAE5B713FD2E6955AA05F6BDA11D80E9E0275040005E5B7D616959B28EFC62ABB43A3238F0
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\charset_normalizer\md.cp312-win_amd64.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):9728
                                                                                                                                                                                                            Entropy (8bit):6.714814722625894
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:192:MAOzE9WrStIf1F25LInXfzMiiukYj273QJXpHE0J:LMGo1F2AXbQuZa7gJXS0
                                                                                                                                                                                                            MD5:A0E2423755456AA66970981C3B5D453E
                                                                                                                                                                                                            SHA1:48A92FA53CBDE319D2F7F222630EE38C19D761BD
                                                                                                                                                                                                            SHA-256:2CEF74C8D6D5DEC5A0088B42CCC54A01952CDA57E4E4A026E4F39F793737FB78
                                                                                                                                                                                                            SHA-512:5A8DCDCAD81A9DFBDDDE14A32B248A0E763E3C6216A56EDC61BC74A7FD8CF132AAD1B64B1967CB4BE88800D308FE125D948DEAC88B7262CFFE46F03830D2608D
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k............r_...........r................................................3..........Rich....................PE..d... $.g.........." ...). .......p........................................................`.........................................@...p......P............@..........................................................@...........................................UPX0.....p..............................UPX1..... ..........................@....rsrc................"..............@......................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\charset_normalizer\md__mypyc.cp312-win_amd64.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):40448
                                                                                                                                                                                                            Entropy (8bit):7.867941384903281
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:768:hG2Z8o+8FiFF0grM5z6BBPNWjLDKZ2MW96vLejBuzMsidkERB4Uppu:hG2Z8ogFF9BPsGZ2MWiIuzMs2B4Uq
                                                                                                                                                                                                            MD5:86170649F304419D33D64B9042927C0D
                                                                                                                                                                                                            SHA1:9FC3624415C0D23CD29722D9FE9BF19EEF825A61
                                                                                                                                                                                                            SHA-256:7F4BE425D941D3B2C8DA7C9B9197A0E386ACE28B73B0806FF4AD329F959FB304
                                                                                                                                                                                                            SHA-512:810378ACFD833D1C74D1CBF23774A6968A36AD4851DD70C88E7832B4604D8434140F8563187AFD80A8E0E19717A3F29BFBCDF90BBAE00A413DDA03FE7FA3C75C
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........yB....................7...............7.......7.......7.......6..........C....6.......6.......6.......6......Rich............................PE..d....$.g.........." ...).............H.......................................p............`..........................................b..d....`.......`......................<c.......................................T..@...........................................UPX0....................................UPX1................................@....rsrc........`......................@..............................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\cryptography-43.0.3.dist-info\INSTALLER

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):4
                                                                                                                                                                                                            Entropy (8bit):1.5
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:Mn:M
                                                                                                                                                                                                            MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                            SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                            SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                            SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:pip.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\cryptography-43.0.3.dist-info\METADATA

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):5440
                                                                                                                                                                                                            Entropy (8bit):5.074230645519915
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:96:DloQIUQIhQIKQILbQIRIaMPktjaVxsxA2TLLDmplH7dwnqTIvrUmA0JQTQCQx5KN:RcPuP1srTLLDmplH7JTIvYX0JQTQ9x54
                                                                                                                                                                                                            MD5:C891CD93024AF027647E6DE89D0FFCE2
                                                                                                                                                                                                            SHA1:01D8D6F93F1B922A91C82D4711BCEFB885AD47B0
                                                                                                                                                                                                            SHA-256:EB36E0E4251E8479EF36964440755EF22BEDD411BA87A93F726FA8E5BB0E64B0
                                                                                                                                                                                                            SHA-512:3386FBB3DCF7383B2D427093624C531C50BE34E3E0AA0984547B953E04776D0D431D5267827F4194A9B0AD1AB897869115623E802A6A1C5D2AE1AD82C96CCE71
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Metadata-Version: 2.3.Name: cryptography.Version: 43.0.3.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: License :: OSI Approved :: BSD License.Classifier: Natural Language :: English.Classifier: Operating System :: MacOS :: MacOS X.Classifier: Operating System :: POSIX.Classifier: Operating System :: POSIX :: BSD.Classifier: Operating System :: POSIX :: Linux.Classifier: Operating System :: Microsoft :: Windows.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classif

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\cryptography-43.0.3.dist-info\RECORD

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:CSV text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):15485
                                                                                                                                                                                                            Entropy (8bit):5.56196201342315
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:192:1XxTBL1z5jF4E9VqhXJZ4WPB6s7B0Ppz+NX6in5Lqw/I+B:1XXL1hCEsJrPB6s7B0Ppz+96innVB
                                                                                                                                                                                                            MD5:8D7997FB71E20CD7B224D04D72F0DAFA
                                                                                                                                                                                                            SHA1:2AA4472F7177DCBA6067295BB5CD0218D8E44AA0
                                                                                                                                                                                                            SHA-256:AF001DA7DCDB3AB8666555CAE1F34B360785F23987072919952D921C918B87DF
                                                                                                                                                                                                            SHA-512:A2B4D6A4DB6E134EFFCD2D294C4DFBA27DF8735FBC25FCA367F244A85E64B375AEAA93212D2A69A6989266086AE84EAFE5FFE714581ECB1493AF2959F73063A0
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:cryptography-43.0.3.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-43.0.3.dist-info/METADATA,sha256=6zbg5CUehHnvNpZEQHVe8ivt1BG6h6k_cm-o5bsOZLA,5440..cryptography-43.0.3.dist-info/RECORD,,..cryptography-43.0.3.dist-info/WHEEL,sha256=8_4EnrLvbhzH224YH8WypoB7HFn-vpbwr_zHlr3XUBI,94..cryptography-43.0.3.dist-info/license_files/LICENSE,sha256=Pgx8CRqUi4JTO6mP18u0BDLW8amsv4X1ki0vmak65rs,197..cryptography-43.0.3.dist-info/license_files/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-43.0.3.dist-info/license_files/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography/__about__.py,sha256=-FkHKD9mSuEfH37wsSKnQzJZmL5zUAUTpB5OeUQjPE0,445..cryptography/__init__.py,sha256=mthuUrTd4FROCpUYrTIqhjz6s6T9djAZrV7nZ1oMm2o,364..cryptography/__pycache__/__about__.cpython-312.pyc,,..cryptography/__pycache__/__init__.cpython-312.pyc,,..cryptography/__pycache__/exceptions.cpython-312.pyc,,..cryptography/__p

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\cryptography-43.0.3.dist-info\WHEEL

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):94
                                                                                                                                                                                                            Entropy (8bit):5.016084900984752
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:RtEeX5pGogP+tkKciH/KQb:RtvoTWKTQb
                                                                                                                                                                                                            MD5:C869D30012A100ADEB75860F3810C8C9
                                                                                                                                                                                                            SHA1:42FD5CFA75566E8A9525E087A2018E8666ED22CB
                                                                                                                                                                                                            SHA-256:F3FE049EB2EF6E1CC7DB6E181FC5B2A6807B1C59FEBE96F0AFFCC796BDD75012
                                                                                                                                                                                                            SHA-512:B29FEAF6587601BBE0EDAD3DF9A87BFC82BB2C13E91103699BABD7E039F05558C0AC1EF7D904BCFAF85D791B96BC26FA9E39988DD83A1CE8ECCA85029C5109F0
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Wheel-Version: 1.0.Generator: maturin (1.7.0).Root-Is-Purelib: false.Tag: cp39-abi3-win_amd64.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\cryptography-43.0.3.dist-info\license_files\LICENSE

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):197
                                                                                                                                                                                                            Entropy (8bit):4.61968998873571
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreLRuOFEXAYeBKmJozlMHuO:h9Co8FyQjkDYc5tWreLBF/pn2mH1
                                                                                                                                                                                                            MD5:8C3617DB4FB6FAE01F1D253AB91511E4
                                                                                                                                                                                                            SHA1:E442040C26CD76D1B946822CAF29011A51F75D6D
                                                                                                                                                                                                            SHA-256:3E0C7C091A948B82533BA98FD7CBB40432D6F1A9ACBF85F5922D2F99A93AE6BB
                                                                                                                                                                                                            SHA-512:77A1919E380730BCCE5B55D76FBFFBA2F95874254FAD955BD2FE1DE7FC0E4E25B5FDAAB0FEFFD6F230FA5DC895F593CF8BFEDF8FDC113EFBD8E22FADAB0B8998
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:This software is made available under the terms of *either* of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of *both* these licenses..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\cryptography-43.0.3.dist-info\license_files\LICENSE.APACHE

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):11360
                                                                                                                                                                                                            Entropy (8bit):4.426756947907149
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
                                                                                                                                                                                                            MD5:4E168CCE331E5C827D4C2B68A6200E1B
                                                                                                                                                                                                            SHA1:DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
                                                                                                                                                                                                            SHA-256:AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
                                                                                                                                                                                                            SHA-512:F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\cryptography-43.0.3.dist-info\license_files\LICENSE.BSD

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):1532
                                                                                                                                                                                                            Entropy (8bit):5.058591167088024
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:24:MjUnoorbOFFTJJyRrYFTjzMbmqEvBTP4m96432s4EOkUTKQROJ32s3yxsITf+3tY:MkOFJSrYJsaN5P406432svv32s3EsIqm
                                                                                                                                                                                                            MD5:5AE30BA4123BC4F2FA49AA0B0DCE887B
                                                                                                                                                                                                            SHA1:EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
                                                                                                                                                                                                            SHA-256:602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
                                                                                                                                                                                                            SHA-512:DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\cryptography\hazmat\bindings\_rust.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):2229248
                                                                                                                                                                                                            Entropy (8bit):7.999624402050615
                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                            SSDEEP:49152:qbSlg7EtPbwG7Qtugc58UQG/0ym73KDYo/6cUWnyO:+SCkwG7Gub8URsF6YoPUE
                                                                                                                                                                                                            MD5:308328BCA82BE8A73422314F9B706EA9
                                                                                                                                                                                                            SHA1:A6AFCF77AED56D4F22250E4E74DAB23AA0F91B35
                                                                                                                                                                                                            SHA-256:68F78996E7C12E631E1E62C75D4A323D6C24D0AB94D3D272BEEA5719FB55888D
                                                                                                                                                                                                            SHA-512:9BE96651B2DCE3C7E601E248D8707037BD0914116AF8FBD8399A30057273BEB77DCCCBEB5376C721B9201653E79F2F0063DA08F9546B8063C183EEC596B123DF
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 5%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r.b.6...6...6...?..$...&9..4...&9..2...&9..>...&9..'...}...8...Y<..5...6...2...~8..I...6.......~8..7...~8..7...Rich6...........PE..d......g.........." ...)..".......V.0wx...V...................................x...........`...........................................x.......x.............. s...............x.$...........................H.x.(.....x.@...........................................UPX0......V.............................UPX1......"...V...!.................@...UPX2..........x.......!.............@..............................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\libcrypto-3.dll

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):1629464
                                                                                                                                                                                                            Entropy (8bit):7.952620213372374
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:49152:iMyDwbv70aKbP1zkLO5YHLA1CPwDvt3uFlDCZ:Gwbv77KbPaqYHLA1CPwDvt3uFlDCZ
                                                                                                                                                                                                            MD5:5A3C63ACDC6CE220B8E104DEA93CBA90
                                                                                                                                                                                                            SHA1:17A4282C1E359ED9726AD99202CB85833F07E714
                                                                                                                                                                                                            SHA-256:539A6496305304D8C8FC8C3219F6F84E4D4467767EEDA9A3B8A66CEDA01A2880
                                                                                                                                                                                                            SHA-512:2E050F79E844EA4ED27E607405242ADEDD9243102A27E026D1AFE6E108018C4AA20B10EB093AD96E60CC95EAF8B86B8BFC9B4364020E88E4483FA1E5FBD1C389
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./',.kFB.kFB.kFB.b>..yFB..:C.iFB..:G.gFB..:F.cFB..:A.oFB.kFC..FB. >C.`FB.;A.KFB.;F..EB.;B.jFB.;..jFB.;@.jFB.RichkFB.........................PE..d...x..e.........." ...#. .......`9.0{O..p9.................................. R...........`......................................... .O......O.h.....O.......K.\.............R.......................................O.@...........................................UPX0.....`9.............................UPX1..... ...p9.....................@....rsrc.........O.....................@..............................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\libffi-8.dll

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):29968
                                                                                                                                                                                                            Entropy (8bit):7.67776426213941
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:768:1p/6aepjG56w24Up3p45YiSyvkIPxWEqG:fA154spK7SytPxF
                                                                                                                                                                                                            MD5:66D7E2C5F4AA3E910DC357780ECF21F8
                                                                                                                                                                                                            SHA1:EA658DF800A048EE8C4549B8937C13A0952A3DF5
                                                                                                                                                                                                            SHA-256:3912D541C4EEA9029EE29D4DB6C0CA5F70196F93D50E57236508F531BC1A834C
                                                                                                                                                                                                            SHA-512:7D0BC6EF3EBD8A36264D7575143101212A8A3DD216054BACF4F922CD23D05936B9BB6BEC1F2466142D83774C19D0ED5DA808887F912D86F51E73225D7A130DAE
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".@................................................................`.....................................................................P.......................................................@...........................................UPX0....................................UPX1.....@.......<..................@...UPX2.................@..............@......................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\libssl-3.dll

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):229144
                                                                                                                                                                                                            Entropy (8bit):7.9300366936484465
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3072:gFfmvsqWLSCMT+MyN6Qp2oZqpN+/fvrqknqbf6CjaBGkfPkZAK1ck2kBVfLwOmFd:gFevsT9JN+vyH1nqLr3CPrYBBRcd
                                                                                                                                                                                                            MD5:6E9C94A0BDCE8396496A3C963FA08711
                                                                                                                                                                                                            SHA1:F0C28AED37FB319450F3826433F4B88661DB0BA6
                                                                                                                                                                                                            SHA-256:8630601F8B8C63581FBCECAE35273FC2E3BA45361F33AAFC6AF739CE5442A547
                                                                                                                                                                                                            SHA-512:53D3CB9935C4278ABF815B385A4556B771B8AED11C65B7E5F49AADEB53161931ECF7BE93FC3271985896BE2653AEA73FA8C09AF4B7BD170AC717C151683A1B08
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T..T..T..].3.Z....V......V....X....\....P....W..T..I....e....U.._.U....U..RichT..........PE..d......e.........." ...#.....P...p...r....................................................`............................................,C......8............ ..pM...................................................~..@...........................................UPX0.....p..............................UPX1................................@....rsrc....P.......L..................@..............................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\psutil\_psutil_windows.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):32256
                                                                                                                                                                                                            Entropy (8bit):7.733393238451438
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:768:SEQsXhsJVH50FvAnRNI2xEY3/oQudyp6i6:74JVO9WRe2xEY3/oQk
                                                                                                                                                                                                            MD5:65D19EE3A3EAF682ABE565946ED6A79D
                                                                                                                                                                                                            SHA1:0A3873DD5B9B1F9E63B90CE79EBD70745BECA57B
                                                                                                                                                                                                            SHA-256:61EB89C3D6468A996AAC6920D271805650073A77AD27AA26732B7473C1361244
                                                                                                                                                                                                            SHA-512:5A97CB7F902427D56F8853D0252934B7941D6249E4EA55409A2E2C8ED95CF3CB3BE91F189A5705B6DB779E3051DD2E15E5B4DAA3C87D1EA1DFFFA12B3EB36E1A
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 3%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......nT..*5..*5..*5..#M2. 5..x@..(5..x@..&5..x@.."5..x@...5...k..(5..aM..;5..*5...5...@..:5...@..+5...@^.+5...@..+5..Rich*5..................PE..d.....qf.........." .................U....................................................`.........................................8u..`....p..H....p.......................u.......................................a..8...........................................UPX0....................................UPX1.............t..................@....rsrc........p.......x..............@......................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\pyexpat.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):90392
                                                                                                                                                                                                            Entropy (8bit):7.905790533903752
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:1536:fFvj0VRbbCImt6eN962HiwRHni5uQfp0hhp/EnonIGLhri07SyVBxF:FIR6l82HLx40hhxIGLhrZZ
                                                                                                                                                                                                            MD5:406D4152D167A2793DD51745FF30242D
                                                                                                                                                                                                            SHA1:2770A101C9FD77D9DC539FCE6FB1BFC24399F035
                                                                                                                                                                                                            SHA-256:384CB9A64F419376E37BD2CD7D62A3FD9DEA122AA5E2CB6E67A232D0A287433E
                                                                                                                                                                                                            SHA-512:7639F6BBB8DD881BB5B99CD1FEB9069176E6AC1076E3884D4DC598D8FD0F8E5F2A07BF8C830D340BB175270D3C9FF58133A9E649F1F91335243EB235108220A1
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 3%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................g.................................h.......................h.......h.......h.......h.......Rich....................PE..d...Z..e.........." ...#. ..........P!.......................................@............`..........................................<..P....9.......0.......................<......................................P-..@...........................................UPX0....................................UPX1..... ....... ..................@....rsrc........0.......$..............@......................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\python3.dll

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):68376
                                                                                                                                                                                                            Entropy (8bit):6.14883904573939
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:768:3V1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM/J:3DmF61JFn+/OipIGL0m7Sy0xG
                                                                                                                                                                                                            MD5:77896345D4E1C406EEFF011F7A920873
                                                                                                                                                                                                            SHA1:EE8CDD531418CFD05C1A6792382D895AC347216F
                                                                                                                                                                                                            SHA-256:1E9224BA7190B6301EF47BEFA8E383D0C55700255D04A36F7DAC88EA9573F2FB
                                                                                                                                                                                                            SHA-512:3E98B1B605D70244B42A13A219F9E124944DA199A88AD4302308C801685B0C45A037A76DED319D08DBF55639591404665BEFE2091F0F4206A9472FEE58D55C22
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C..."e.."e.."e.0_m.."e.0_e.."e.0_..."e.0_g.."e.Rich."e.................PE..d...@..e.........." ...#............................................................q.....`.........................................`...H................................/..............T............................................................................rdata..............................@..@.rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\python312.dll

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):1826072
                                                                                                                                                                                                            Entropy (8bit):7.993990404156154
                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                            SSDEEP:49152:pTBxkJIkNEakpCPK1JQyHi3p70PHY6/g7:PeFNlUsK1ij31WYUW
                                                                                                                                                                                                            MD5:A7BF4310CEA55C20568B6AF1D00E49D4
                                                                                                                                                                                                            SHA1:1AC601543CAD3676496F9825EE1ED2D76580DDB5
                                                                                                                                                                                                            SHA-256:008DA498AE18A93B2423E1F8823B199CA49A81BB42932D5D6C73C8B29FEC2896
                                                                                                                                                                                                            SHA-512:859F6E4DC1B823455E5125529CA9694C8346FEA5D479B620CF13F9E834506DBEF8CED29F11B623395CD7A1D3D3C329D8E1AF10240D78943045D0DA4B305CCEE3
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 5%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................m.................x...s...x......x......x......Rich............PE..d...=..e.........." ...#.........@Q...l..PQ...................................m...........`.........................................H/l......)l...... l......``..V............l. ...........................0.l.(...p.l.@...........................................UPX0.....@Q.............................UPX1.........PQ.....................@....rsrc........ l.....................@..............................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\select.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):26392
                                                                                                                                                                                                            Entropy (8bit):7.448154728523066
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:768:cnyukFaypXM5IGQGNf5YiSyvTcAMxkEMrX:cnGAaM5IGQGNR7Syb6xuX
                                                                                                                                                                                                            MD5:6C46842787FC019A0D69306E2B8E47EC
                                                                                                                                                                                                            SHA1:9E15D2222689F94A378AC2E4204A2604CF489BCD
                                                                                                                                                                                                            SHA-256:11EA4521E8ADF7059EBEEDB591A55F27315E7482B1C8C88143158E4FA3761546
                                                                                                                                                                                                            SHA-512:AB895B27C11D2A55995696528121DB88F6C2B377DB56E22C453D869DD78EF0A6D14DB8281A9568653E7789E99D104C67B4C2A071BEFC8CA1AD2D609DD37CDD06
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 3%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........t.q|'.q|'.q|'...'.q|'q.}&.q|'q.y&.q|'q.x&.q|'q..&.q|'..}&.q|'.q}'.q|'..}&.q|'..q&.q|'..|&.q|'...'.q|'..~&.q|'Rich.q|'........PE..d...Z..e.........." ...#.0................................................................`......................................... ...L....................`..............l..........................................@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@..............................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\autocommand-2.2.2.dist-info\INSTALLER

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):4
                                                                                                                                                                                                            Entropy (8bit):1.5
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:Mn:M
                                                                                                                                                                                                            MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                            SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                            SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                            SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:pip.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\autocommand-2.2.2.dist-info\LICENSE

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):7634
                                                                                                                                                                                                            Entropy (8bit):4.503638339817033
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:192:qnJvhVL0qhYqlpIle4RrJQSqOBng4kS/cKM6b:4vjxhYWpce48engvK
                                                                                                                                                                                                            MD5:8466CFC6533376D42EFA6F7423F2B8E8
                                                                                                                                                                                                            SHA1:2BC8926FDBB07DB2AF0A8E3FF7A3BE545C8BDF6B
                                                                                                                                                                                                            SHA-256:ADE78D04982D69972D444A8E14A94F87A2334DD3855CC80348EA8E240AA0DF2D
                                                                                                                                                                                                            SHA-512:CC45DC470E107E63659B502F77E9EF44335F9427BE87639252D85181A8DEA65FA9D1B5F1BD196F782186BC61B144467888199537806A8CC15E2B462CAC0D46A5
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:GNU LESSER GENERAL PUBLIC LICENSE. Version 3, 29 June 2007.. Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>. Everyone is permitted to copy and distribute verbatim copies. of this license document, but changing it is not allowed.... This version of the GNU Lesser General Public License incorporates.the terms and conditions of version 3 of the GNU General Public.License, supplemented by the additional permissions listed below... 0. Additional Definitions... As used herein, "this License" refers to version 3 of the GNU Lesser.General Public License, and the "GNU GPL" refers to version 3 of the GNU.General Public License... "The Library" refers to a covered work governed by this License,.other than an Application or a Combined Work as defined below... An "Application" is any work that makes use of an interface provided.by the Library, but which is not otherwise based on the Library..Defining a subclass of a class defined by the Library is de

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\autocommand-2.2.2.dist-info\METADATA

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:Python script, ASCII text executable, with very long lines (855)
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):15006
                                                                                                                                                                                                            Entropy (8bit):4.800156894367144
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:192:S037UxjwUbQd1Ak++k59jg8dXRNInXF2IOxcme+kQBd9Clb:d37U1LbQd1Z+3e8dhwXFacb+kQjQb
                                                                                                                                                                                                            MD5:542BA4FBC993C39A0BC952BE72E8717F
                                                                                                                                                                                                            SHA1:4310DB58F98C12B23286E5FA37F0E27ABEFB6A4A
                                                                                                                                                                                                            SHA-256:3800D9B91DCEEA2065A6ED6279383362E97AC38B8E56B9343F404EE531860099
                                                                                                                                                                                                            SHA-512:E3672EA056E5F2EFD3685C98DC0CF47E9A44F5A84DC457FC8AB31CD6DE09559C6E566D2D00F5B3CE55511E81A050DBB0DED6CF941916A6FF1019392FD96E1636
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:Metadata-Version: 2.1.Name: autocommand.Version: 2.2.2.Summary: A library to create a command-line program from a function.Home-page: https://github.com/Lucretiel/autocommand.Author: Nathan West.License: LGPLv3.Project-URL: Homepage, https://github.com/Lucretiel/autocommand.Project-URL: Bug Tracker, https://github.com/Lucretiel/autocommand/issues.Platform: any.Classifier: Development Status :: 6 - Mature.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: GNU Lesser General Public License v3 (LGPLv3).Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Topic :: Software Development.Classifier: Topic :: Software Development :: Libraries.Classifier: Topic :: Software Development :: Libraries :: Python Modules.Requires-Python: >=3.7.Description-Content-Type: text/markdown.License-File: LICENSE..[![PyPI version](https://badge.fury.io/py/autocommand.svg)](

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\autocommand-2.2.2.dist-info\RECORD

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:CSV text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):1308
                                                                                                                                                                                                            Entropy (8bit):5.721750099226425
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:24:kn/2zDcMvX4owkE+RlpGUttyvUMDtuH5p4D127cyOMT34:knuXNv4LkEMl0UWMF5p45AcuT34
                                                                                                                                                                                                            MD5:52BF4937018B88B9D28ED98A76B5E2AC
                                                                                                                                                                                                            SHA1:C8D5B732C154A2D4D501454647FAFEB356B93C4E
                                                                                                                                                                                                            SHA-256:822BBA66B41526FA547186B80221F85DA50D652BEE5493DBFE5D14085112F0C3
                                                                                                                                                                                                            SHA-512:30E4DEFE09FB8907166682F9A33E0F7CC0203B65113155BBEC6548A1EADF7250882AF295FF2551803703274F9F387E00439D95CBBCB63D2E04E371B94556B3EE
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:autocommand-2.2.2.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..autocommand-2.2.2.dist-info/LICENSE,sha256=reeNBJgtaZctREqOFKlPh6IzTdOFXMgDSOqOJAqg3y0,7634..autocommand-2.2.2.dist-info/METADATA,sha256=OADZuR3O6iBlpu1ieTgzYul6w4uOVrk0P0BO5TGGAJk,15006..autocommand-2.2.2.dist-info/RECORD,,..autocommand-2.2.2.dist-info/WHEEL,sha256=2wepM1nk4DS4eFpYrW1TTqPcoGNfHhhO_i5m4cOimbo,92..autocommand-2.2.2.dist-info/top_level.txt,sha256=AzfhgKKS8EdAwWUTSF8mgeVQbXOY9kokHB6kSqwwqu0,12..autocommand/__init__.py,sha256=zko5Rnvolvb-UXjCx_2ArPTGBWwUK5QY4LIQIKYR7As,1037..autocommand/__pycache__/__init__.cpython-312.pyc,,..autocommand/__pycache__/autoasync.cpython-312.pyc,,..autocommand/__pycache__/autocommand.cpython-312.pyc,,..autocommand/__pycache__/automain.cpython-312.pyc,,..autocommand/__pycache__/autoparse.cpython-312.pyc,,..autocommand/__pycache__/errors.cpython-312.pyc,,..autocommand/autoasync.py,sha256=AMdyrxNS4pqWJfP_xuoOcImOHWD-qT7x06wmKN1Vp-U,5680..autocommand/autoco

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\autocommand-2.2.2.dist-info\WHEEL

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):92
                                                                                                                                                                                                            Entropy (8bit):4.842566724466667
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:RtEeX7MWcSlViJR4KgP+tPCCfA5S:RtBMwlVifAWBBf
                                                                                                                                                                                                            MD5:88F09A0EC874FD86ABCB9BC4E265B874
                                                                                                                                                                                                            SHA1:786AB44FFD2F5C632B4DC5C1BF4AA2E91E579A05
                                                                                                                                                                                                            SHA-256:DB07A93359E4E034B8785A58AD6D534EA3DCA0635F1E184EFE2E66E1C3A299BA
                                                                                                                                                                                                            SHA-512:7FFEF1EC782D590D2879294C2895A5A8064ECD5FE7243CF602FCCE66A8A715F64436F17CE96070B613123847EE0C18AB0AA5BC87DB13E98A792DC07DD95E4BAB
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Wheel-Version: 1.0.Generator: bdist_wheel (0.38.4).Root-Is-Purelib: true.Tag: py3-none-any..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\autocommand-2.2.2.dist-info\top_level.txt

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):12
                                                                                                                                                                                                            Entropy (8bit):3.084962500721156
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:5EEln:aM
                                                                                                                                                                                                            MD5:C3FBD7931840D987F261BEBA8C77C4D2
                                                                                                                                                                                                            SHA1:F7EE740BCB5C39966173CC377817A157D55844F7
                                                                                                                                                                                                            SHA-256:0337E180A292F04740C16513485F2681E5506D7398F64A241C1EA44AAC30AAED
                                                                                                                                                                                                            SHA-512:E1FA2DE0EE416AE68C57A0173C82D42A8F24DDD1E5143A1B76A3743B5EC3DDF11FB3950F27469D3D8FCAC4958CE267A7321D2F888671EDD7C2E95D0F3F8F7455
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:autocommand.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\backports.tarfile-1.2.0.dist-info\INSTALLER

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):4
                                                                                                                                                                                                            Entropy (8bit):1.5
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:Mn:M
                                                                                                                                                                                                            MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                            SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                            SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                            SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:pip.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\backports.tarfile-1.2.0.dist-info\LICENSE

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):1023
                                                                                                                                                                                                            Entropy (8bit):5.059832621894572
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:24:OrmJHcwH0MP3gt8Hw1hj9QHOsUv4eOk4/+/m3oqMSFJ:OaJ8YHvEH5QHOs5exm3oEFJ
                                                                                                                                                                                                            MD5:141643E11C48898150DAA83802DBC65F
                                                                                                                                                                                                            SHA1:0445ED0F69910EEAEE036F09A39A13C6E1F37E12
                                                                                                                                                                                                            SHA-256:86DA0F01AEAE46348A3C3D465195DC1CECCDE79F79E87769A64B8DA04B2A4741
                                                                                                                                                                                                            SHA-512:EF62311602B466397BAF0B23CACA66114F8838F9E78E1B067787CEB709D09E0530E85A47BBCD4C5A0905B74FDB30DF0CC640910C6CC2E67886E5B18794A3583F
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to.deal in the Software without restriction, including without limitation the.rights to use, copy, modify, merge, publish, distribute, sublicense, and/or.sell copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING.FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEA

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\backports.tarfile-1.2.0.dist-info\METADATA

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):2020
                                                                                                                                                                                                            Entropy (8bit):5.0469065437932175
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:48:DfdqaaC3P1xe9okGw1w8wQwywbM0kvsJib0ts++kv0gMzvy0htC+heU01:DfdqaaC/12G2bHZokO+/36
                                                                                                                                                                                                            MD5:18B352E2051962B9F65C33BC651426BF
                                                                                                                                                                                                            SHA1:3DD8D93CF7695D1C9D7574751AB5B0DEE5DD7F9A
                                                                                                                                                                                                            SHA-256:8215C54EAD77D9DC5A108A25C6BDC72B5999AA6F62C9499A440359412AFA5A51
                                                                                                                                                                                                            SHA-512:D966BC2899079C0D9AC763C96EA59A550E00A54BDCEEB6D96B0A8CAA9F6A1C408E7E3946915432978EDE9EDF669EEC68035A55B094B69671A28428458760D99E
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Metadata-Version: 2.1.Name: backports.tarfile.Version: 1.2.0.Summary: Backport of CPython tarfile module.Author-email: "Jason R. Coombs" <jaraco@jaraco.com>.Project-URL: Homepage, https://github.com/jaraco/backports.tarfile.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.License-File: LICENSE.Provides-Extra: docs.Requires-Dist: sphinx >=3.5 ; extra == 'docs'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'docs'.Requires-Dist: rst.linker >=1.9 ; extra == 'docs'.Requires-Dist: furo ; extra == 'docs'.Requires-Dist: sphinx-lint ; extra == 'docs'.Provides-Extra: testing.Requires-Dist: pytest !=8.1.*,>=6 ; extra == 'testing'.Requires-Dist: pytest-checkdocs >=2.4 ; extra == 'testing'.Requires-Dist: pytest-cov ; extra == 'testing

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\backports.tarfile-1.2.0.dist-info\RECORD

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:CSV text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):1360
                                                                                                                                                                                                            Entropy (8bit):5.753738299642538
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:24:U6rn/2zDJ6rvbqfuG6rJnB6rU6rEsJYB6rXamx6rlCHmTKjaQliwxJlp5DQljQls:NnuXIzUurJwN5JjfAlqYK9liSlp5DQlP
                                                                                                                                                                                                            MD5:CF347AE8E31132435B127226F358F8CD
                                                                                                                                                                                                            SHA1:2C857B300638FF291651234BBB2C077BEEF494E4
                                                                                                                                                                                                            SHA-256:258A1F1C849E1175069A55A5D6CE357AFDD04E34CD5DE27093E4ACEC7A9D2CE1
                                                                                                                                                                                                            SHA-512:2A46C7FDFA2F9883BB1D761646B33BE9CE7B07280A5BF38992C1C84AB0449944EB0CAF34620CCC82DDBBC193F0D54AE67797D97863F70CA0C24EE55A3B401F9C
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:backports.tarfile-1.2.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..backports.tarfile-1.2.0.dist-info/LICENSE,sha256=htoPAa6uRjSKPD1GUZXcHOzN55956HdppkuNoEsqR0E,1023..backports.tarfile-1.2.0.dist-info/METADATA,sha256=ghXFTq132dxaEIolxr3HK1mZqm9iyUmaRANZQSr6WlE,2020..backports.tarfile-1.2.0.dist-info/RECORD,,..backports.tarfile-1.2.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..backports.tarfile-1.2.0.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92..backports.tarfile-1.2.0.dist-info/top_level.txt,sha256=cGjaLMOoBR1FK0ApojtzWVmViTtJ7JGIK_HwXiEsvtU,10..backports/__init__.py,sha256=iOEMwnlORWezdO8-2vxBIPSR37D7JGjluZ8f55vzxls,81..backports/__pycache__/__init__.cpython-312.pyc,,..backports/tarfile/__init__.py,sha256=Pwf2qUIfB0SolJPCKcx3vz3UEu_aids4g4sAfxy94qg,108491..backports/tarfile/__main__.py,sha256=Yw2oGT1afrz2eBskzdPYL8ReB_3liApmhFkN2EbDmc4,59..backports/tarfile/__pycache__/__init__.cpython-312.pyc,,..back

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\backports.tarfile-1.2.0.dist-info\WHEEL

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):92
                                                                                                                                                                                                            Entropy (8bit):4.812622295095324
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:RtEeX7MWcSlVlFxP+tPCCfA5S:RtBMwlVTxWBBf
                                                                                                                                                                                                            MD5:43136DDE7DD276932F6197BB6D676EF4
                                                                                                                                                                                                            SHA1:6B13C105452C519EA0B65AC1A975BD5E19C50122
                                                                                                                                                                                                            SHA-256:189EEDFE4581172C1B6A02B97A8F48A14C0B5BAA3239E4CA990FBD8871553714
                                                                                                                                                                                                            SHA-512:E7712BA7D36DEB083EBCC3B641AD3E7D19FB071EE64AE3A35AD6A50EE882B20CD2E60CA1319199DF12584FE311A6266EC74F96A3FB67E59F90C7B5909668AEE1
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Wheel-Version: 1.0.Generator: bdist_wheel (0.43.0).Root-Is-Purelib: true.Tag: py3-none-any..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\backports.tarfile-1.2.0.dist-info\top_level.txt

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):10
                                                                                                                                                                                                            Entropy (8bit):3.321928094887362
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:21v:ev
                                                                                                                                                                                                            MD5:9BA458821AD258B6EF62B47E91302982
                                                                                                                                                                                                            SHA1:9EDB9E6BA5C4001CE2FCCF328739292404EA9604
                                                                                                                                                                                                            SHA-256:7068DA2CC3A8051D452B4029A23B73595995893B49EC91882BF1F05E212CBED5
                                                                                                                                                                                                            SHA-512:3A296E5DADD5B406330BA088BFED33BE6960F8FF42DB6651E185FF14F2272FC819EF520D1A15BC40DA4E20B9CA0E5D79170EDF33F3D50937C7FBEDB338CAC730
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:backports.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\INSTALLER

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):4
                                                                                                                                                                                                            Entropy (8bit):1.5
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:Mn:M
                                                                                                                                                                                                            MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                            SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                            SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                            SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:pip.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\LICENSE

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):11358
                                                                                                                                                                                                            Entropy (8bit):4.4267168336581415
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEn7HbHR:U9vlKM1zJlFvmNz5VrlkTS07Ht
                                                                                                                                                                                                            MD5:3B83EF96387F14655FC854DDC3C6BD57
                                                                                                                                                                                                            SHA1:2B8B815229AA8A61E483FB4BA0588B8B6C491890
                                                                                                                                                                                                            SHA-256:CFC7749B96F63BD31C3C42B5C471BF756814053E847C10F3EB003417BC523D30
                                                                                                                                                                                                            SHA-512:98F6B79B778F7B0A15415BD750C3A8A097D650511CB4EC8115188E115C47053FE700F578895C097051C9BC3DFB6197C2B13A15DE203273E1A3218884F86E90E8
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:. Apache License. Version 2.0, January 2004. http://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial own

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\METADATA

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):4648
                                                                                                                                                                                                            Entropy (8bit):5.006900644756252
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:96:Dx2ZSaCSmS8R902Vpnu386eLQ9Ac+fFZpDN00x2jZ2SBXZJSwTE:9Smzf02Vpnu386mQ9B+TP0vJHJSwTE
                                                                                                                                                                                                            MD5:98ABEAACC0E0E4FC385DFF67B607071A
                                                                                                                                                                                                            SHA1:E8C830D8B0942300C7C87B3B8FD15EA1396E07BD
                                                                                                                                                                                                            SHA-256:6A7B90EFFEE1E09D5B484CDF7232016A43E2D9CC9543BCBB8E494B1EC05E1F59
                                                                                                                                                                                                            SHA-512:F1D59046FFA5B0083A5259CEB03219CCDB8CC6AAC6247250CBD83E70F080784391FCC303F7630E1AD40E5CCF5041A57CB9B68ADEFEC1EBC6C31FCF7FFC65E9B7
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Metadata-Version: 2.1.Name: importlib_metadata.Version: 8.0.0.Summary: Read metadata from Python packages.Author-email: "Jason R. Coombs" <jaraco@jaraco.com>.Project-URL: Source, https://github.com/python/importlib_metadata.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.License-File: LICENSE.Requires-Dist: zipp >=0.5.Requires-Dist: typing-extensions >=3.6.4 ; python_version < "3.8".Provides-Extra: doc.Requires-Dist: sphinx >=3.5 ; extra == 'doc'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'doc'.Requires-Dist: rst.linker >=1.9 ; extra == 'doc'.Requires-Dist: furo ; extra == 'doc'.Requires-Dist: sphinx-lint ; extra == 'doc'.Requires-Dist: jaraco.tidelift >=1.4 ; extra == 'doc'.Provides-Extra: perf.Requires-D

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\RECORD

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:CSV text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):2518
                                                                                                                                                                                                            Entropy (8bit):5.6307766747793275
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:48:UnuXTg06U5J/Vw9l/gfNX7/XzBk9pvJq/fwJOfYrBfnJ/V0XJnzN/3WJV:bXzP/EgdzzBkDJsoIYrBfJ/CXNz9qV
                                                                                                                                                                                                            MD5:EB513CAFA5226DDA7D54AFDCC9AD8A74
                                                                                                                                                                                                            SHA1:B394C7AEC158350BAF676AE3197BEF4D7158B31C
                                                                                                                                                                                                            SHA-256:0D8D3C6EEB9EBBE86CAC7D60861552433C329DA9EA51248B61D02BE2E5E64030
                                                                                                                                                                                                            SHA-512:A0017CFAFF47FDA6067E3C31775FACEE4728C3220C2D4BD70DEF328BD20AA71A343E39DA15CD6B406F62311894C518DFCF5C8A4AE6F853946F26A4B4E767924E
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:importlib_metadata-8.0.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..importlib_metadata-8.0.0.dist-info/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358..importlib_metadata-8.0.0.dist-info/METADATA,sha256=anuQ7_7h4J1bSEzfcjIBakPi2cyVQ7y7jklLHsBeH1k,4648..importlib_metadata-8.0.0.dist-info/RECORD,,..importlib_metadata-8.0.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..importlib_metadata-8.0.0.dist-info/WHEEL,sha256=mguMlWGMX-VHnMpKOjjQidIo1ssRlCFu4a4mBpz1s2M,91..importlib_metadata-8.0.0.dist-info/top_level.txt,sha256=CO3fD9yylANiXkrMo4qHLV_mqXL2sC5JFKgt1yWAT-A,19..importlib_metadata/__init__.py,sha256=tZNB-23h8Bixi9uCrQqj9Yf0aeC--Josdy3IZRIQeB0,33798..importlib_metadata/__pycache__/__init__.cpython-312.pyc,,..importlib_metadata/__pycache__/_adapters.cpython-312.pyc,,..importlib_metadata/__pycache__/_collections.cpython-312.pyc,,..importlib_metadata/__pycache__/_compat.cpython-312.pyc,,..importlib_metadata/__pycac

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\WHEEL

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):91
                                                                                                                                                                                                            Entropy (8bit):4.687870576189661
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:RtEeXMRYFAVLMvhRRP+tPCCfA5S:RtC1VLMvhjWBBf
                                                                                                                                                                                                            MD5:7D09837492494019EA51F4E97823D79F
                                                                                                                                                                                                            SHA1:7829B4324BB542799494131A270EC3BDAD4DEDEF
                                                                                                                                                                                                            SHA-256:9A0B8C95618C5FE5479CCA4A3A38D089D228D6CB1194216EE1AE26069CF5B363
                                                                                                                                                                                                            SHA-512:A0063220ECDD22C3E735ACFF6DE559ACF3AC4C37B81D37633975A22A28B026F1935CD1957C0FF7D2ECC8B7F83F250310795EECC5273B893FFAB115098F7B9C38
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Wheel-Version: 1.0.Generator: setuptools (70.1.1).Root-Is-Purelib: true.Tag: py3-none-any..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\top_level.txt

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):19
                                                                                                                                                                                                            Entropy (8bit):3.536886723742169
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:JSej0EBERG:50o4G
                                                                                                                                                                                                            MD5:A24465F7850BA59507BF86D89165525C
                                                                                                                                                                                                            SHA1:4E61F9264DE74783B5924249BCFE1B06F178B9AD
                                                                                                                                                                                                            SHA-256:08EDDF0FDCB29403625E4ACCA38A872D5FE6A972F6B02E4914A82DD725804FE0
                                                                                                                                                                                                            SHA-512:ECF1F6B777970F5257BDDD353305447083008CEBD8E5A27C3D1DA9C7BDC3F9BF3ABD6881265906D6D5E11992653185C04A522F4DB5655FF75EEDB766F93D5D48
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:importlib_metadata.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\importlib_resources-6.4.0.dist-info\INSTALLER

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):4
                                                                                                                                                                                                            Entropy (8bit):1.5
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:Mn:M
                                                                                                                                                                                                            MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                            SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                            SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                            SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:pip.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\importlib_resources-6.4.0.dist-info\LICENSE

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):11358
                                                                                                                                                                                                            Entropy (8bit):4.4267168336581415
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEn7HbHR:U9vlKM1zJlFvmNz5VrlkTS07Ht
                                                                                                                                                                                                            MD5:3B83EF96387F14655FC854DDC3C6BD57
                                                                                                                                                                                                            SHA1:2B8B815229AA8A61E483FB4BA0588B8B6C491890
                                                                                                                                                                                                            SHA-256:CFC7749B96F63BD31C3C42B5C471BF756814053E847C10F3EB003417BC523D30
                                                                                                                                                                                                            SHA-512:98F6B79B778F7B0A15415BD750C3A8A097D650511CB4EC8115188E115C47053FE700F578895C097051C9BC3DFB6197C2B13A15DE203273E1A3218884F86E90E8
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:. Apache License. Version 2.0, January 2004. http://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial own

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\importlib_resources-6.4.0.dist-info\METADATA

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):3944
                                                                                                                                                                                                            Entropy (8bit):5.015824473130961
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:96:DHxQuiTaCP1nTGDbHRbnzQWHaiQq+fT5lWp8sSwTW:2PP9GDbHRbnp+rapPSwTW
                                                                                                                                                                                                            MD5:C3EB48CD13B50DDED7CD524E1E9DD4CE
                                                                                                                                                                                                            SHA1:7C9B0B50D0E667825DAB09902AD8376A5F2945B6
                                                                                                                                                                                                            SHA-256:83878CD8BB8BD0E89971454D0F4AB00C9529136F603AFB4EDC148F5D36CEF459
                                                                                                                                                                                                            SHA-512:056EBC250B7E82F91B5C5E96B1293F24D5E917E06846A9716A4D05B47C30FEB3781E439C77876CF7D8620BEBAA4A253039CA8DF122283DE304992E340F4DE8BF
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Metadata-Version: 2.1.Name: importlib_resources.Version: 6.4.0.Summary: Read resources from Python packages.Home-page: https://github.com/python/importlib_resources.Author: Barry Warsaw.Author-email: barry@python.org.Project-URL: Documentation, https://importlib-resources.readthedocs.io/.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.License-File: LICENSE.Requires-Dist: zipp >=3.1.0 ; python_version < "3.10".Provides-Extra: docs.Requires-Dist: sphinx >=3.5 ; extra == 'docs'.Requires-Dist: sphinx <7.2.5 ; extra == 'docs'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'docs'.Requires-Dist: rst.linker >=1.9 ; extra == 'docs'.Requires-Dist: furo ; extra == 'docs'.Requires-Dist: sphinx-lint ; extra == 'docs'.Requires-Dist: jaraco.tidelift >=1.4 ; ext

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\importlib_resources-6.4.0.dist-info\RECORD

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:CSV text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):7620
                                                                                                                                                                                                            Entropy (8bit):5.560551717923108
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:192:lX7qdX7ZgsP7JtILSVAn5V26+XuVYmBXx:lX7wX7ZBP7ELSVAni6+iBh
                                                                                                                                                                                                            MD5:67F5E26385B6BDCF2236A005A2D2BA32
                                                                                                                                                                                                            SHA1:3DCD8685638A90D121FD484138AFCAC9775E5D66
                                                                                                                                                                                                            SHA-256:967DD56FEEA143F1D2C4E98AC1F937C055E61C9AA0425146D55F7AD7C82510FA
                                                                                                                                                                                                            SHA-512:30B5812E930A00A476E570EBCC4611D54C911A8B1E4646949A887F551FC5ABDC933311A554B197C602F0DA7626DFE8877A3F267EFBC6D724E24A3E9B5FCC2E30
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:importlib_resources-6.4.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..importlib_resources-6.4.0.dist-info/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358..importlib_resources-6.4.0.dist-info/METADATA,sha256=g4eM2LuL0OiZcUVND0qwDJUpE29gOvtO3BSPXTbO9Fk,3944..importlib_resources-6.4.0.dist-info/RECORD,,..importlib_resources-6.4.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..importlib_resources-6.4.0.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92..importlib_resources-6.4.0.dist-info/top_level.txt,sha256=fHIjHU1GZwAjvcydpmUnUrTnbvdiWjG4OEVZK8by0TQ,20..importlib_resources/__init__.py,sha256=uyp1kzYR6SawQBsqlyaXXfIxJx4Z2mM8MjmZn8qq2Gk,505..importlib_resources/__pycache__/__init__.cpython-312.pyc,,..importlib_resources/__pycache__/_adapters.cpython-312.pyc,,..importlib_resources/__pycache__/_common.cpython-312.pyc,,..importlib_resources/__pycache__/_itertools.cpython-312.pyc,,..importlib_resource

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\importlib_resources-6.4.0.dist-info\WHEEL

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):92
                                                                                                                                                                                                            Entropy (8bit):4.812622295095324
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:RtEeX7MWcSlVlFxP+tPCCfA5S:RtBMwlVTxWBBf
                                                                                                                                                                                                            MD5:43136DDE7DD276932F6197BB6D676EF4
                                                                                                                                                                                                            SHA1:6B13C105452C519EA0B65AC1A975BD5E19C50122
                                                                                                                                                                                                            SHA-256:189EEDFE4581172C1B6A02B97A8F48A14C0B5BAA3239E4CA990FBD8871553714
                                                                                                                                                                                                            SHA-512:E7712BA7D36DEB083EBCC3B641AD3E7D19FB071EE64AE3A35AD6A50EE882B20CD2E60CA1319199DF12584FE311A6266EC74F96A3FB67E59F90C7B5909668AEE1
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Wheel-Version: 1.0.Generator: bdist_wheel (0.43.0).Root-Is-Purelib: true.Tag: py3-none-any..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\importlib_resources-6.4.0.dist-info\top_level.txt

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):20
                                                                                                                                                                                                            Entropy (8bit):3.6841837197791887
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:JSe8AW6D:3fD
                                                                                                                                                                                                            MD5:0613840F692BD9E064FEDD915DFD477A
                                                                                                                                                                                                            SHA1:64DF38B36F541BA1714C15FCA1A9CA8C94EF2DAA
                                                                                                                                                                                                            SHA-256:7C72231D4D46670023BDCC9DA6652752B4E76EF7625A31B83845592BC6F2D134
                                                                                                                                                                                                            SHA-512:78AA888C24B3468C94FCB8EB882561D4B6F19A0537A4CFDDDFF94ED8A4BAFE8DF0C2B620E70B57A61E8BA3F877856DB9ADA548DFCA8CAE86D4C3C525A4E9B7EB
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:importlib_resources.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\inflect-7.3.1.dist-info\INSTALLER

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):4
                                                                                                                                                                                                            Entropy (8bit):1.5
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:Mn:M
                                                                                                                                                                                                            MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                            SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                            SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                            SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:pip.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\inflect-7.3.1.dist-info\LICENSE

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):1023
                                                                                                                                                                                                            Entropy (8bit):5.059832621894572
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:24:OrmJHcwH0MP3gt8Hw1hj9QHOsUv4eOk4/+/m3oqMSFJ:OaJ8YHvEH5QHOs5exm3oEFJ
                                                                                                                                                                                                            MD5:141643E11C48898150DAA83802DBC65F
                                                                                                                                                                                                            SHA1:0445ED0F69910EEAEE036F09A39A13C6E1F37E12
                                                                                                                                                                                                            SHA-256:86DA0F01AEAE46348A3C3D465195DC1CECCDE79F79E87769A64B8DA04B2A4741
                                                                                                                                                                                                            SHA-512:EF62311602B466397BAF0B23CACA66114F8838F9E78E1B067787CEB709D09E0530E85A47BBCD4C5A0905B74FDB30DF0CC640910C6CC2E67886E5B18794A3583F
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to.deal in the Software without restriction, including without limitation the.rights to use, copy, modify, merge, publish, distribute, sublicense, and/or.sell copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING.FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEA

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\inflect-7.3.1.dist-info\METADATA

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):21079
                                                                                                                                                                                                            Entropy (8bit):5.103530371859935
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:384:12Vpnu38/2K9tjUaNtT/yTCtYTnWDdg3GaXb51KLVgWTVPeEGsuPrAESM:12Vpnu38JZtT/yIdg3D51KLV7RPeEGs+
                                                                                                                                                                                                            MD5:1A287FAF08B125BC7C932AAD05E7DAEE
                                                                                                                                                                                                            SHA1:C37042ADC0D1270485F4B8B5B9E085A274DC035B
                                                                                                                                                                                                            SHA-256:66030D634580651B3E53CC19895D9231F8D22AA06B327817C8332CFC20303308
                                                                                                                                                                                                            SHA-512:D0BB0AD27A17007DF7D3281FB2F46EFB048B69532D082AB1D431E0BA28E592D897687708B4EC972F4BC21EDA29DDDDC9EF44BB950DFC4FFB03EA75CDA4DE414C
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Metadata-Version: 2.1.Name: inflect.Version: 7.3.1.Summary: Correctly generate plurals, singular nouns, ordinals, indefinite articles.Author-email: Paul Dyson <pwdyson@yahoo.com>.Maintainer-email: "Jason R. Coombs" <jaraco@jaraco.com>.Project-URL: Source, https://github.com/jaraco/inflect.Keywords: plural,inflect,participle.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Natural Language :: English.Classifier: Operating System :: OS Independent.Classifier: Topic :: Software Development :: Libraries :: Python Modules.Classifier: Topic :: Text Processing :: Linguistic.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.License-File: LICENSE.Requires-Dist: more-itertools >=8.5.0.Requires-Dist: typeguard >=4.0.1.Requires-Dist: typing-extensions ; python_version < "3.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\inflect-7.3.1.dist-info\RECORD

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:CSV text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):943
                                                                                                                                                                                                            Entropy (8bit):5.828988691860191
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:24:IVn/2zDPvbqfuIpBntmuIcjlM+sVGXdbkDcnJopDvDK16bZWJV:unuXPzUuIpRtmuZjl9sVQgcnJo9bK16E
                                                                                                                                                                                                            MD5:C837BB3258448B7FCC6B77559C7F17B6
                                                                                                                                                                                                            SHA1:B15701449CD64A13756A70AD3704E26DB1FF416B
                                                                                                                                                                                                            SHA-256:5D7834AC1BA2612C6801050FDE57A7B98B0F36ACF88C3C2D4F376FD8911B3091
                                                                                                                                                                                                            SHA-512:2333CD86502C51607414390ECF43BD6D62E863D3DFB0501DAD3A8B45F5F4DFA81F910917183FC4F4A0DEEC82C8F8B3CF8D5B0A2C136DEB164226BABE68B74A33
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:inflect-7.3.1.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..inflect-7.3.1.dist-info/LICENSE,sha256=htoPAa6uRjSKPD1GUZXcHOzN55956HdppkuNoEsqR0E,1023..inflect-7.3.1.dist-info/METADATA,sha256=ZgMNY0WAZRs-U8wZiV2SMfjSKqBrMngXyDMs_CAwMwg,21079..inflect-7.3.1.dist-info/RECORD,,..inflect-7.3.1.dist-info/WHEEL,sha256=y4mX-SOX4fYIkonsAGA5N0Oy-8_gI4FXw5HNI1xqvWg,91..inflect-7.3.1.dist-info/top_level.txt,sha256=m52ujdp10CqT6jh1XQxZT6kEntcnv-7Tl7UiGNTzWZA,8..inflect/__init__.py,sha256=Jxy1HJXZiZ85kHeLAhkmvz6EMTdFqBe-duvt34R6IOc,103796..inflect/__pycache__/__init__.cpython-312.pyc,,..inflect/compat/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..inflect/compat/__pycache__/__init__.cpython-312.pyc,,..inflect/compat/__pycache__/py38.cpython-312.pyc,,..inflect/compat/py38.py,sha256=oObVfVnWX9_OpnOuEJn1mFbJxVhwyR5epbiTNXDDaso,160..inflect/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\inflect-7.3.1.dist-info\WHEEL

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):91
                                                                                                                                                                                                            Entropy (8bit):4.7098485981676825
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:RtEeXMRYFAVLKSgP+tPCCfA5S:RtC1VLKZWBBf
                                                                                                                                                                                                            MD5:EB46A94D39AC40E2EEA4A32729E0C8C3
                                                                                                                                                                                                            SHA1:E42EF49A7098269E1934932ECC3174B40967982A
                                                                                                                                                                                                            SHA-256:CB8997F92397E1F6089289EC0060393743B2FBCFE0238157C391CD235C6ABD68
                                                                                                                                                                                                            SHA-512:D89F0DA16AA37AAFAC0DE56A3DFBD72DC3C9DCC53C8E455094E7230DB21ABF95ED76EAC1848A4156DB422B9C10BE136201D871DCCB73AD38192E5536E41DBDFE
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Wheel-Version: 1.0.Generator: setuptools (70.2.0).Root-Is-Purelib: true.Tag: py3-none-any..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\inflect-7.3.1.dist-info\top_level.txt

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):8
                                                                                                                                                                                                            Entropy (8bit):3.0
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:KDpJ:K9J
                                                                                                                                                                                                            MD5:4571281D24750CBE7638EFE250E342AB
                                                                                                                                                                                                            SHA1:61E8A0AD5796F1CA67EAB0D8108A6402483D499B
                                                                                                                                                                                                            SHA-256:9B9DAE8DDA75D02A93EA38755D0C594FA9049ED727BFEED397B52218D4F35990
                                                                                                                                                                                                            SHA-512:E7807002E53CC228D6EFB307E928C6737796B29E31D25A342ED407F556FFBF540494FE92C27B5C31043D2D7FF427C78A29C4FF5595BC11BB643003026642254E
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:inflect.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\jaraco.collections-5.1.0.dist-info\INSTALLER

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):4
                                                                                                                                                                                                            Entropy (8bit):1.5
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:Mn:M
                                                                                                                                                                                                            MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                            SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                            SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                            SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:pip.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\jaraco.collections-5.1.0.dist-info\LICENSE

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):1023
                                                                                                                                                                                                            Entropy (8bit):5.059832621894572
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:24:OrmJHcwH0MP3gt8Hw1hj9QHOsUv4eOk4/+/m3oqMSFJ:OaJ8YHvEH5QHOs5exm3oEFJ
                                                                                                                                                                                                            MD5:141643E11C48898150DAA83802DBC65F
                                                                                                                                                                                                            SHA1:0445ED0F69910EEAEE036F09A39A13C6E1F37E12
                                                                                                                                                                                                            SHA-256:86DA0F01AEAE46348A3C3D465195DC1CECCDE79F79E87769A64B8DA04B2A4741
                                                                                                                                                                                                            SHA-512:EF62311602B466397BAF0B23CACA66114F8838F9E78E1B067787CEB709D09E0530E85A47BBCD4C5A0905B74FDB30DF0CC640910C6CC2E67886E5B18794A3583F
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to.deal in the Software without restriction, including without limitation the.rights to use, copy, modify, merge, publish, distribute, sublicense, and/or.sell copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING.FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEA

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\jaraco.collections-5.1.0.dist-info\METADATA

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):3933
                                                                                                                                                                                                            Entropy (8bit):4.993707893382395
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:96:D0duaC9zmnEh2S8xI0+4np+A+fbl7inVgQJSwT2:qq9KnEh2zxI0+4npn+zlmn+QJSwT2
                                                                                                                                                                                                            MD5:C9BA49C9B82CEFCCAC79CB5B76BCB1EE
                                                                                                                                                                                                            SHA1:AC0DB25AEFD2679B4C3265E713D00F6155A94465
                                                                                                                                                                                                            SHA-256:20C51A96236C0395F53B1F4C5D458E6A0721E51E16C1BFF733B7ABA76F5D06D8
                                                                                                                                                                                                            SHA-512:563C3BEC6FB8D137357130BADCB63A229A18A781B05E2F006F4A42AF7C9052D23D266908DA2E62FF283C9BA7BAA9B6CB6FB32A1999CB07F63471CA43003A34C0
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Metadata-Version: 2.1.Name: jaraco.collections.Version: 5.1.0.Summary: Collection objects similar to those in stdlib by jaraco.Author-email: "Jason R. Coombs" <jaraco@jaraco.com>.Project-URL: Source, https://github.com/jaraco/jaraco.collections.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.License-File: LICENSE.Requires-Dist: jaraco.text.Provides-Extra: check.Requires-Dist: pytest-checkdocs >=2.4 ; extra == 'check'.Requires-Dist: pytest-ruff >=0.2.1 ; (sys_platform != "cygwin") and extra == 'check'.Provides-Extra: cover.Requires-Dist: pytest-cov ; extra == 'cover'.Provides-Extra: doc.Requires-Dist: sphinx >=3.5 ; extra == 'doc'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'doc'.Requires-Dist: rst.linker >=1.9 ; extra

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\jaraco.collections-5.1.0.dist-info\RECORD

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:CSV text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):873
                                                                                                                                                                                                            Entropy (8bit):5.770829319764291
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:24:T9bn/2zDabvbqfunb1AO5bGYbEsJvbp1blKzmKmJaaX9WJV:T9bnuXabzUunb1AgbBb5Jvbp1blscWJV
                                                                                                                                                                                                            MD5:0463062305AC30E7F3D6AB12DA825D90
                                                                                                                                                                                                            SHA1:AC83602461BF535C78EB4CCC13AB103C12110D57
                                                                                                                                                                                                            SHA-256:1E9B62BD70E4A5FA26E9594CBB80860FFECA3DEBFEE8773DAEFA774CD259CA06
                                                                                                                                                                                                            SHA-512:8F617D9A2DA41BDC8591D9EA9F2DBE79D7C5816BA7A94D4044AFF2A0504C9738E83FFCAA350CEF20764D430C261C9DC17DBB5E4ABB7AE54C3BE8715C8AD6BB71
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:jaraco.collections-5.1.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..jaraco.collections-5.1.0.dist-info/LICENSE,sha256=htoPAa6uRjSKPD1GUZXcHOzN55956HdppkuNoEsqR0E,1023..jaraco.collections-5.1.0.dist-info/METADATA,sha256=IMUaliNsA5X1Ox9MXUWOagch5R4Wwb_3M7erp29dBtg,3933..jaraco.collections-5.1.0.dist-info/RECORD,,..jaraco.collections-5.1.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..jaraco.collections-5.1.0.dist-info/WHEEL,sha256=Mdi9PDNwEZptOjTlUcAth7XJDFtKrHYaQMPulZeBCiQ,91..jaraco.collections-5.1.0.dist-info/top_level.txt,sha256=0JnN3LfXH4LIRfXL-QFOGCJzQWZO3ELx4R1d_louoQM,7..jaraco/collections/__init__.py,sha256=Pc1-SqjWm81ad1P0-GttpkwO_LWlnaY6gUq8gcKh2v0,26640..jaraco/collections/__pycache__/__init__.cpython-312.pyc,,..jaraco/collections/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\jaraco.collections-5.1.0.dist-info\WHEEL

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):91
                                                                                                                                                                                                            Entropy (8bit):4.696166043246402
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:RtEeXMRYFAWWHKRRP+tPCCfA5S:RtC1qjWBBf
                                                                                                                                                                                                            MD5:6FBE8610D7E48CA32AE774804C4A0B19
                                                                                                                                                                                                            SHA1:102D23C4ECB17ED83A6E43888B45FF2BBFE93E0B
                                                                                                                                                                                                            SHA-256:31D8BD3C3370119A6D3A34E551C02D87B5C90C5B4AAC761A40C3EE9597810A24
                                                                                                                                                                                                            SHA-512:78738099EC5B31FDEE5AE50F7840F17EFD526588835157CADF4249882462B1AF2E3BEDB77801A9FCB1D22A8FD41AA6A934B382F3E66309723D0E7F93C2F2868A
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Wheel-Version: 1.0.Generator: setuptools (73.0.1).Root-Is-Purelib: true.Tag: py3-none-any..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\jaraco.collections-5.1.0.dist-info\top_level.txt

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):7
                                                                                                                                                                                                            Entropy (8bit):2.5216406363433186
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:GEG0:GEG0
                                                                                                                                                                                                            MD5:0BA8D736B7B4AB182687318B0497E61E
                                                                                                                                                                                                            SHA1:311BA5FFD098689179F299EF20768EE1A29F586D
                                                                                                                                                                                                            SHA-256:D099CDDCB7D71F82C845F5CBF9014E18227341664EDC42F1E11D5DFE5A2EA103
                                                                                                                                                                                                            SHA-512:7CCCBB4AFA2FADE40D529482301BEAE152E0C71EE3CC41736EB19E35CFC5EE3B91EF958CF5CA6B7330333B8494FEB6682FD833D5AA16BF4A8F1F721FD859832C
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:jaraco.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\jaraco.context-5.3.0.dist-info\INSTALLER

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):4
                                                                                                                                                                                                            Entropy (8bit):1.5
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:Mn:M
                                                                                                                                                                                                            MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                            SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                            SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                            SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:pip.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\jaraco.context-5.3.0.dist-info\LICENSE

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):1023
                                                                                                                                                                                                            Entropy (8bit):5.059832621894572
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:24:OrmJHcwH0MP3gt8Hw1hj9QHOsUv4eOk4/+/m3oqMSFJ:OaJ8YHvEH5QHOs5exm3oEFJ
                                                                                                                                                                                                            MD5:141643E11C48898150DAA83802DBC65F
                                                                                                                                                                                                            SHA1:0445ED0F69910EEAEE036F09A39A13C6E1F37E12
                                                                                                                                                                                                            SHA-256:86DA0F01AEAE46348A3C3D465195DC1CECCDE79F79E87769A64B8DA04B2A4741
                                                                                                                                                                                                            SHA-512:EF62311602B466397BAF0B23CACA66114F8838F9E78E1B067787CEB709D09E0530E85A47BBCD4C5A0905B74FDB30DF0CC640910C6CC2E67886E5B18794A3583F
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to.deal in the Software without restriction, including without limitation the.rights to use, copy, modify, merge, publish, distribute, sublicense, and/or.sell copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING.FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEA

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\jaraco.context-5.3.0.dist-info\METADATA

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text, with very long lines (406)
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):4020
                                                                                                                                                                                                            Entropy (8bit):4.99859161164956
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:96:D6P4YaCP1gGRbHneRohWYc+f/PCnG9rulJQ84UNxCUSwTcL:kPqGRbHneRohWJ+XPaqylW/USwTcL
                                                                                                                                                                                                            MD5:812F27A7C8C748351DC1643D58B6B250
                                                                                                                                                                                                            SHA1:AC9C92013B2F0FC65D741B32A9FE4B956DD6EB7D
                                                                                                                                                                                                            SHA-256:C43B60B897A3D2D37D8845C252FC44261D9AEF171E21154111A9012D2AFFFED6
                                                                                                                                                                                                            SHA-512:CAC62C3682F808D85233B69F1C142B5A0E95E316E4BDCBC6EE253583EC302FA42E635BAB6A837327D8CE5D26C08C8DCD9E45D5CFDD8346B4501C473250D66953
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Metadata-Version: 2.1.Name: jaraco.context.Version: 5.3.0.Summary: Useful decorators and context managers.Home-page: https://github.com/jaraco/jaraco.context.Author: Jason R. Coombs.Author-email: jaraco@jaraco.com.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.License-File: LICENSE.Requires-Dist: backports.tarfile ; python_version < "3.12".Provides-Extra: docs.Requires-Dist: sphinx >=3.5 ; extra == 'docs'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'docs'.Requires-Dist: rst.linker >=1.9 ; extra == 'docs'.Requires-Dist: furo ; extra == 'docs'.Requires-Dist: sphinx-lint ; extra == 'docs'.Requires-Dist: jaraco.tidelift >=1.4 ; extra == 'docs'.Provides-Extra: testing.Requires-Dist: pytest !=8.1.1,>=6 ; extra == 'testing'.Requires-Dist: pytest-checkdocs >=2.4

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\jaraco.context-5.3.0.dist-info\RECORD

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:CSV text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):641
                                                                                                                                                                                                            Entropy (8bit):5.76835538630355
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:12:TGA0a/2zDJAv/TnqfQlWJAL/fy9vKAGvAXCaaryBAl2VrkEQCXvbAT2r1S:TBn/2zDCvbqfuLO9FGoXamalKSCXzB1S
                                                                                                                                                                                                            MD5:2B0A77624AE3903E42C3A8213E593796
                                                                                                                                                                                                            SHA1:D63027FF018995D0620E2497BCE9678888A57667
                                                                                                                                                                                                            SHA-256:55197B88A78443297BB2D827A75BAAE740B33896251D872835D4B4C75EC2F57E
                                                                                                                                                                                                            SHA-512:C02FB1554F8F40158BB60F2B4EC07D80F71CFBFFB38463C5809385A7A2FF8DDB2BDFEFE9AE5E67F4DEC3D904A6E0925E565B0EE6363DD0C2ED5B03A96B056B18
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:jaraco.context-5.3.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..jaraco.context-5.3.0.dist-info/LICENSE,sha256=htoPAa6uRjSKPD1GUZXcHOzN55956HdppkuNoEsqR0E,1023..jaraco.context-5.3.0.dist-info/METADATA,sha256=xDtguJej0tN9iEXCUvxEJh2a7xceIRVBEakBLSr__tY,4020..jaraco.context-5.3.0.dist-info/RECORD,,..jaraco.context-5.3.0.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92..jaraco.context-5.3.0.dist-info/top_level.txt,sha256=0JnN3LfXH4LIRfXL-QFOGCJzQWZO3ELx4R1d_louoQM,7..jaraco/__pycache__/context.cpython-312.pyc,,..jaraco/context.py,sha256=REoLIxDkO5MfEYowt_WoupNCRoxBS5v7YX2PbW8lIcs,9552..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\jaraco.context-5.3.0.dist-info\WHEEL

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):92
                                                                                                                                                                                                            Entropy (8bit):4.812622295095324
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:RtEeX7MWcSlVlFxP+tPCCfA5S:RtBMwlVTxWBBf
                                                                                                                                                                                                            MD5:43136DDE7DD276932F6197BB6D676EF4
                                                                                                                                                                                                            SHA1:6B13C105452C519EA0B65AC1A975BD5E19C50122
                                                                                                                                                                                                            SHA-256:189EEDFE4581172C1B6A02B97A8F48A14C0B5BAA3239E4CA990FBD8871553714
                                                                                                                                                                                                            SHA-512:E7712BA7D36DEB083EBCC3B641AD3E7D19FB071EE64AE3A35AD6A50EE882B20CD2E60CA1319199DF12584FE311A6266EC74F96A3FB67E59F90C7B5909668AEE1
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Wheel-Version: 1.0.Generator: bdist_wheel (0.43.0).Root-Is-Purelib: true.Tag: py3-none-any..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\jaraco.context-5.3.0.dist-info\top_level.txt

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):7
                                                                                                                                                                                                            Entropy (8bit):2.5216406363433186
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:GEG0:GEG0
                                                                                                                                                                                                            MD5:0BA8D736B7B4AB182687318B0497E61E
                                                                                                                                                                                                            SHA1:311BA5FFD098689179F299EF20768EE1A29F586D
                                                                                                                                                                                                            SHA-256:D099CDDCB7D71F82C845F5CBF9014E18227341664EDC42F1E11D5DFE5A2EA103
                                                                                                                                                                                                            SHA-512:7CCCBB4AFA2FADE40D529482301BEAE152E0C71EE3CC41736EB19E35CFC5EE3B91EF958CF5CA6B7330333B8494FEB6682FD833D5AA16BF4A8F1F721FD859832C
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:jaraco.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\jaraco.functools-4.0.1.dist-info\INSTALLER

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):4
                                                                                                                                                                                                            Entropy (8bit):1.5
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:Mn:M
                                                                                                                                                                                                            MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                            SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                            SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                            SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:pip.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\jaraco.functools-4.0.1.dist-info\LICENSE

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):1023
                                                                                                                                                                                                            Entropy (8bit):5.059832621894572
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:24:OrmJHcwH0MP3gt8Hw1hj9QHOsUv4eOk4/+/m3oqMSFJ:OaJ8YHvEH5QHOs5exm3oEFJ
                                                                                                                                                                                                            MD5:141643E11C48898150DAA83802DBC65F
                                                                                                                                                                                                            SHA1:0445ED0F69910EEAEE036F09A39A13C6E1F37E12
                                                                                                                                                                                                            SHA-256:86DA0F01AEAE46348A3C3D465195DC1CECCDE79F79E87769A64B8DA04B2A4741
                                                                                                                                                                                                            SHA-512:EF62311602B466397BAF0B23CACA66114F8838F9E78E1B067787CEB709D09E0530E85A47BBCD4C5A0905B74FDB30DF0CC640910C6CC2E67886E5B18794A3583F
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to.deal in the Software without restriction, including without limitation the.rights to use, copy, modify, merge, publish, distribute, sublicense, and/or.sell copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING.FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEA

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\jaraco.functools-4.0.1.dist-info\METADATA

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):2891
                                                                                                                                                                                                            Entropy (8bit):5.034580807599395
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:48:DEmbsaC3J1x9Ie9okNGwQw8wQw2wTw0zCPU0+I65Jib0H++kv0gM5d0DT+heU04u:DEmgaCZ1nTGDbHRAnzpI6o+fX5dFSwTm
                                                                                                                                                                                                            MD5:C2E6BDA7F1B03B39BF42D31B6DBF6C38
                                                                                                                                                                                                            SHA1:B7A18F079DE22D10C4C318E54BD8C48177F91333
                                                                                                                                                                                                            SHA-256:8B86946900D7FA38DD1102B9C1EBE17A0CB1F09C8B7E29F61F2BDA4A4DC51ECA
                                                                                                                                                                                                            SHA-512:F4E892B3D41482E3B17642B1D722B6E2A8E8DD4833F0623C29ED2D50D55CFC68DA1F9756B4E08723DC89F3E552424096C92912AC4DA533FE8E2DC59DC19EA9CF
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Metadata-Version: 2.1.Name: jaraco.functools.Version: 4.0.1.Summary: Functools like those found in stdlib.Author-email: "Jason R. Coombs" <jaraco@jaraco.com>.Project-URL: Homepage, https://github.com/jaraco/jaraco.functools.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.License-File: LICENSE.Requires-Dist: more-itertools.Provides-Extra: docs.Requires-Dist: sphinx >=3.5 ; extra == 'docs'.Requires-Dist: sphinx <7.2.5 ; extra == 'docs'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'docs'.Requires-Dist: rst.linker >=1.9 ; extra == 'docs'.Requires-Dist: furo ; extra == 'docs'.Requires-Dist: sphinx-lint ; extra == 'docs'.Requires-Dist: jaraco.tidelift >=1.4 ; extra == 'docs'.Provides-Extra: testing.Requires-Dist: pytest >=6 ;

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\jaraco.functools-4.0.1.dist-info\RECORD

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:CSV text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):843
                                                                                                                                                                                                            Entropy (8bit):5.807846597836061
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:24:Tmn/2zDRvbqfuggoaGnXamZlKZBX3vpBvt+c0X4yWJV:TmnuXRzUuggDifZlmX/aWJV
                                                                                                                                                                                                            MD5:85FB54BAFB143CD57D1787F7EF74FDB2
                                                                                                                                                                                                            SHA1:A915BBCDF108A58F3DFC1783D9D4DD3B7F3CE23A
                                                                                                                                                                                                            SHA-256:632AA7C04F7C4BCC01C027AF5B9BC76FE8958F4A181035B957A3BD3014BA248B
                                                                                                                                                                                                            SHA-512:2A39B4C6F221F88EC61D584C8CD3CAD358E8C7B50E529192105A0A4144ED3C2A4CE8B630C39C18D20E27FE226A23E2DE23CDFF8E3D3693959B165A9A2F9047CD
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:jaraco.functools-4.0.1.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..jaraco.functools-4.0.1.dist-info/LICENSE,sha256=htoPAa6uRjSKPD1GUZXcHOzN55956HdppkuNoEsqR0E,1023..jaraco.functools-4.0.1.dist-info/METADATA,sha256=i4aUaQDX-jjdEQK5wevhegyx8JyLfin2HyvaSk3FHso,2891..jaraco.functools-4.0.1.dist-info/RECORD,,..jaraco.functools-4.0.1.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92..jaraco.functools-4.0.1.dist-info/top_level.txt,sha256=0JnN3LfXH4LIRfXL-QFOGCJzQWZO3ELx4R1d_louoQM,7..jaraco/functools/__init__.py,sha256=hEAJaS2uSZRuF_JY4CxCHIYh79ZpxaPp9OiHyr9EJ1w,16642..jaraco/functools/__init__.pyi,sha256=gk3dsgHzo5F_U74HzAvpNivFAPCkPJ1b2-yCd62dfnw,3878..jaraco/functools/__pycache__/__init__.cpython-312.pyc,,..jaraco/functools/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\jaraco.functools-4.0.1.dist-info\WHEEL

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):92
                                                                                                                                                                                                            Entropy (8bit):4.812622295095324
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:RtEeX7MWcSlVlFxP+tPCCfA5S:RtBMwlVTxWBBf
                                                                                                                                                                                                            MD5:43136DDE7DD276932F6197BB6D676EF4
                                                                                                                                                                                                            SHA1:6B13C105452C519EA0B65AC1A975BD5E19C50122
                                                                                                                                                                                                            SHA-256:189EEDFE4581172C1B6A02B97A8F48A14C0B5BAA3239E4CA990FBD8871553714
                                                                                                                                                                                                            SHA-512:E7712BA7D36DEB083EBCC3B641AD3E7D19FB071EE64AE3A35AD6A50EE882B20CD2E60CA1319199DF12584FE311A6266EC74F96A3FB67E59F90C7B5909668AEE1
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Wheel-Version: 1.0.Generator: bdist_wheel (0.43.0).Root-Is-Purelib: true.Tag: py3-none-any..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\jaraco.functools-4.0.1.dist-info\top_level.txt

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):7
                                                                                                                                                                                                            Entropy (8bit):2.5216406363433186
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:GEG0:GEG0
                                                                                                                                                                                                            MD5:0BA8D736B7B4AB182687318B0497E61E
                                                                                                                                                                                                            SHA1:311BA5FFD098689179F299EF20768EE1A29F586D
                                                                                                                                                                                                            SHA-256:D099CDDCB7D71F82C845F5CBF9014E18227341664EDC42F1E11D5DFE5A2EA103
                                                                                                                                                                                                            SHA-512:7CCCBB4AFA2FADE40D529482301BEAE152E0C71EE3CC41736EB19E35CFC5EE3B91EF958CF5CA6B7330333B8494FEB6682FD833D5AA16BF4A8F1F721FD859832C
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:jaraco.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\jaraco.text-3.12.1.dist-info\INSTALLER

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):4
                                                                                                                                                                                                            Entropy (8bit):1.5
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:Mn:M
                                                                                                                                                                                                            MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                            SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                            SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                            SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:pip.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\jaraco.text-3.12.1.dist-info\LICENSE

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):1023
                                                                                                                                                                                                            Entropy (8bit):5.059832621894572
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:24:OrmJHcwH0MP3gt8Hw1hj9QHOsUv4eOk4/+/m3oqMSFJ:OaJ8YHvEH5QHOs5exm3oEFJ
                                                                                                                                                                                                            MD5:141643E11C48898150DAA83802DBC65F
                                                                                                                                                                                                            SHA1:0445ED0F69910EEAEE036F09A39A13C6E1F37E12
                                                                                                                                                                                                            SHA-256:86DA0F01AEAE46348A3C3D465195DC1CECCDE79F79E87769A64B8DA04B2A4741
                                                                                                                                                                                                            SHA-512:EF62311602B466397BAF0B23CACA66114F8838F9E78E1B067787CEB709D09E0530E85A47BBCD4C5A0905B74FDB30DF0CC640910C6CC2E67886E5B18794A3583F
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to.deal in the Software without restriction, including without limitation the.rights to use, copy, modify, merge, publish, distribute, sublicense, and/or.sell copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING.FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEA

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\jaraco.text-3.12.1.dist-info\METADATA

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):3658
                                                                                                                                                                                                            Entropy (8bit):5.02710641474483
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:96:DYMaCFS802Vpnu388Ksc+fIybwFiR8g6RSwTsL:pFz02Vpnu388KB+gybwgRd6RSwTsL
                                                                                                                                                                                                            MD5:70FE732EDE8F8E6C84DA4EA21D4933E5
                                                                                                                                                                                                            SHA1:A7763789FA56CEBBAA849368FAAC7D386F170399
                                                                                                                                                                                                            SHA-256:03359D9BA56231F0CE3E840C7CB5A7DB380141218949CCAA78DDBD4DCB965D52
                                                                                                                                                                                                            SHA-512:4C8D3D5078840BD4DBE20458EBF52890585C5911C22C3EFCE2FB28985461BC80469339DDAF6016FB099C84BDF9B41A26FF1884B456422A8D0C682104D7950D91
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Metadata-Version: 2.1.Name: jaraco.text.Version: 3.12.1.Summary: Module for text manipulation.Author-email: "Jason R. Coombs" <jaraco@jaraco.com>.Project-URL: Homepage, https://github.com/jaraco/jaraco.text.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.License-File: LICENSE.Requires-Dist: jaraco.functools.Requires-Dist: jaraco.context >=4.1.Requires-Dist: autocommand.Requires-Dist: inflect.Requires-Dist: more-itertools.Requires-Dist: importlib-resources ; python_version < "3.9".Provides-Extra: doc.Requires-Dist: sphinx >=3.5 ; extra == 'doc'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'doc'.Requires-Dist: rst.linker >=1.9 ; extra == 'doc'.Requires-Dist: furo ; extra == 'doc'.Requires-Dist: sphinx-lint ; extra == 'doc

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\jaraco.text-3.12.1.dist-info\RECORD

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:CSV text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):1500
                                                                                                                                                                                                            Entropy (8bit):5.794249493238335
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:24:TkLFn/2zDVLFvbqfuaLFo2kXLFGnLFEsJiLFXamdLFlKbkZ6d3JpPXu/1XWXYXw2:TcnuXDzUuuCw5Jmfblyz3Jp2/NUsM0bN
                                                                                                                                                                                                            MD5:39FCCE64BC768C2046067E4AAD8465F0
                                                                                                                                                                                                            SHA1:2EFC0FC776576A8FE01BBACD0760A49EEE6481DA
                                                                                                                                                                                                            SHA-256:816D945741DCA246099388CA3EED74FC0667ACBAA36F70B559B2494C3979B1F6
                                                                                                                                                                                                            SHA-512:FB2335A6675F9CADEEE38B666FAB9EA1D8BFBA6B7768253D42F44149591A3239F4B2FA19DDF2C282DC7E47A01D7DCA69AADBBCDAC9107EDBCB2C22D11BA81287
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:jaraco.text-3.12.1.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..jaraco.text-3.12.1.dist-info/LICENSE,sha256=htoPAa6uRjSKPD1GUZXcHOzN55956HdppkuNoEsqR0E,1023..jaraco.text-3.12.1.dist-info/METADATA,sha256=AzWdm6ViMfDOPoQMfLWn2zgBQSGJScyqeN29TcuWXVI,3658..jaraco.text-3.12.1.dist-info/RECORD,,..jaraco.text-3.12.1.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..jaraco.text-3.12.1.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92..jaraco.text-3.12.1.dist-info/top_level.txt,sha256=0JnN3LfXH4LIRfXL-QFOGCJzQWZO3ELx4R1d_louoQM,7..jaraco/text/Lorem ipsum.txt,sha256=N_7c_79zxOufBY9HZ3yzMgOkNv-TkOTTio4BydrSjgs,1335..jaraco/text/__init__.py,sha256=Y2YUqXR_orUoDaY4SkPRe6ZZhb5HUHB_Ah9RCNsVyho,16250..jaraco/text/__pycache__/__init__.cpython-312.pyc,,..jaraco/text/__pycache__/layouts.cpython-312.pyc,,..jaraco/text/__pycache__/show-newlines.cpython-312.pyc,,..jaraco/text/__pycache__/strip-prefix.cpython-312.pyc,,..jaraco/text/__py

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\jaraco.text-3.12.1.dist-info\WHEEL

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):92
                                                                                                                                                                                                            Entropy (8bit):4.812622295095324
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:RtEeX7MWcSlVlFxP+tPCCfA5S:RtBMwlVTxWBBf
                                                                                                                                                                                                            MD5:43136DDE7DD276932F6197BB6D676EF4
                                                                                                                                                                                                            SHA1:6B13C105452C519EA0B65AC1A975BD5E19C50122
                                                                                                                                                                                                            SHA-256:189EEDFE4581172C1B6A02B97A8F48A14C0B5BAA3239E4CA990FBD8871553714
                                                                                                                                                                                                            SHA-512:E7712BA7D36DEB083EBCC3B641AD3E7D19FB071EE64AE3A35AD6A50EE882B20CD2E60CA1319199DF12584FE311A6266EC74F96A3FB67E59F90C7B5909668AEE1
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Wheel-Version: 1.0.Generator: bdist_wheel (0.43.0).Root-Is-Purelib: true.Tag: py3-none-any..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\jaraco.text-3.12.1.dist-info\top_level.txt

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):7
                                                                                                                                                                                                            Entropy (8bit):2.5216406363433186
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:GEG0:GEG0
                                                                                                                                                                                                            MD5:0BA8D736B7B4AB182687318B0497E61E
                                                                                                                                                                                                            SHA1:311BA5FFD098689179F299EF20768EE1A29F586D
                                                                                                                                                                                                            SHA-256:D099CDDCB7D71F82C845F5CBF9014E18227341664EDC42F1E11D5DFE5A2EA103
                                                                                                                                                                                                            SHA-512:7CCCBB4AFA2FADE40D529482301BEAE152E0C71EE3CC41736EB19E35CFC5EE3B91EF958CF5CA6B7330333B8494FEB6682FD833D5AA16BF4A8F1F721FD859832C
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:jaraco.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\jaraco\text\Lorem ipsum.txt

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text, with very long lines (888)
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):1335
                                                                                                                                                                                                            Entropy (8bit):4.226823573023539
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:24:FP6Hbz+g9RPZ14bJi04L6GEbX4UQF4UkZQhxI2EIhNyu:9E+i6bJmLm43+Uxxnh0u
                                                                                                                                                                                                            MD5:4CE7501F6608F6CE4011D627979E1AE4
                                                                                                                                                                                                            SHA1:78363672264D9CD3F72D5C1D3665E1657B1A5071
                                                                                                                                                                                                            SHA-256:37FEDCFFBF73C4EB9F058F47677CB33203A436FF9390E4D38A8E01C9DAD28E0B
                                                                                                                                                                                                            SHA-512:A4CDF92725E1D740758DA4DD28DF5D1131F70CEF46946B173FE6956CC0341F019D7C4FECC3C9605F354E1308858721DADA825B4C19F59C5AD1CE01AB84C46B24
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum..Curabitur pretium tincidunt lacus. Nulla gravida orci a odio. Nullam varius, turpis et commodo pharetra, est eros bibendum elit, nec luctus magna felis sollicitudin mauris. Integer in mauris eu nibh euismod gravida. Duis ac tellus et risus vulputate vehicula. Donec lobortis risus a elit. Etiam tempor. Ut ullamcorper, ligula eu tempor congue, eros est euismod turpis, id tincidunt sapien risus a quam. Maecenas fermentum consequat mi. Donec fermentum. Pellentesque malesuada nulla a mi. Duis sapien sem, aliquet nec, commodo eget, consequat quis, neque.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\more_itertools-10.3.0.dist-info\INSTALLER

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):4
                                                                                                                                                                                                            Entropy (8bit):1.5
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:Mn:M
                                                                                                                                                                                                            MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                            SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                            SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                            SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:pip.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\more_itertools-10.3.0.dist-info\LICENSE

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):1053
                                                                                                                                                                                                            Entropy (8bit):5.0945274555157285
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:24:arOJH7H0yxgtUHw1hC09QHOsUv4eOk4/+/m3oqLFh:aSJrlxEvdQHOs5exm3ogFh
                                                                                                                                                                                                            MD5:3396EA30F9D21389D7857719816F83B5
                                                                                                                                                                                                            SHA1:0D43A836DAC65C0EA426AD49C881A1086600BF85
                                                                                                                                                                                                            SHA-256:09F1C8C9E941AF3E584D59641EA9B87D83C0CB0FD007EB5EF391A7E2643C1A46
                                                                                                                                                                                                            SHA-512:D43092223392EDDA3BD777625F5BF54ACB0CC00C25555A4F8A16DB9CCDAFC380D3204486CB2A5FDC9D3F9E459B1FED948FFC7000AA0E40F37B807A01F4421294
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Copyright (c) 2012 Erik Rose..Permission is hereby granted, free of charge, to any person obtaining a copy of.this software and associated documentation files (the "Software"), to deal in.the Software without restriction, including without limitation the rights to.use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies.of the Software, and to permit persons to whom the Software is furnished to do.so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR IN CONNECTION WITH THE SO

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\more_itertools-10.3.0.dist-info\METADATA

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):36293
                                                                                                                                                                                                            Entropy (8bit):3.717596190655759
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:384:bs9cnyPtWIRmL0QnCHx4Zi3XBB9GcF89oi+odVBqCv9d3m24TeYH5AvDpG27IFf5:Ua+H1Nsg/
                                                                                                                                                                                                            MD5:5BA05B51B603386707E1E3A101CDD6B3
                                                                                                                                                                                                            SHA1:FFCCEC7FD799CC4AB07530954FEF3BE2472E2C23
                                                                                                                                                                                                            SHA-256:0453BDD0EF9F2CD89540CA63EE8212E73B73809514419DD3037D8FE471F737E0
                                                                                                                                                                                                            SHA-512:FE7F7D6B6C8089B09A18930EF462BA4C7A15EAF6D3E8610AC655ECADE16CE31D9C01ECE84C88A3C2D9DD34DE70E194A020E28179CF33B21389EE3EEFC7229B74
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Metadata-Version: 2.1.Name: more-itertools.Version: 10.3.0.Summary: More routines for operating on iterables, beyond itertools.Keywords: itertools,iterator,iteration,filter,peek,peekable,chunk,chunked.Author-email: Erik Rose <erikrose@grinchcentral.com>.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: Natural Language :: English.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: Implementation :: CPython.Classifier: Programming Language :: Python :: Implementation :: Py

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\more_itertools-10.3.0.dist-info\RECORD

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:CSV text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):1259
                                                                                                                                                                                                            Entropy (8bit):5.794423512787632
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:24:Bhxn/2zDahxvIhxphxBhxEsJXhxzvXiCflBJRHXoggtqgmf7WJhmsxmwG:hnuXwOph5J3zvXi4Lo7qgQ7WJhS
                                                                                                                                                                                                            MD5:178EE325409DD28809AD3661E8819EF8
                                                                                                                                                                                                            SHA1:F5844FAC6E3C9133FE5F1B8195EE801959801DF3
                                                                                                                                                                                                            SHA-256:77C8E73E018DC0FD7E9ED6C80B05A4404545F641FB085220CE42B368B59AA3D3
                                                                                                                                                                                                            SHA-512:2DB06B622F644674BF7D7AD8B780F9802858D15D73B5075139C2D82181DD6D589B90172BCA7AE9C785E705F447F523DB2AE641826C550C599551A7D8C2396FC2
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:more_itertools-10.3.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..more_itertools-10.3.0.dist-info/LICENSE,sha256=CfHIyelBrz5YTVlkHqm4fYPAyw_QB-te85Gn4mQ8GkY,1053..more_itertools-10.3.0.dist-info/METADATA,sha256=BFO90O-fLNiVQMpj7oIS5ztzgJUUQZ3TA32P5HH3N-A,36293..more_itertools-10.3.0.dist-info/RECORD,,..more_itertools-10.3.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..more_itertools-10.3.0.dist-info/WHEEL,sha256=rSgq_JpHF9fHR1lx53qwg_1-2LypZE_qmcuXbVUq948,81..more_itertools/__init__.py,sha256=dtAbGjTDmn_ghiU5YXfhyDy0phAlXVdt5klZA5fUa-Q,149..more_itertools/__init__.pyi,sha256=5B3eTzON1BBuOLob1vCflyEb2lSd6usXQQ-Cv-hXkeA,43..more_itertools/__pycache__/__init__.cpython-312.pyc,,..more_itertools/__pycache__/more.cpython-312.pyc,,..more_itertools/__pycache__/recipes.cpython-312.pyc,,..more_itertools/more.py,sha256=1E5kzFncRKTDw0cYv1yRXMgDdunstLQd1QStcnL6U90,148370..more_itertools/more.pyi,sha256=iXXeqt48Nxe8VGmIWpkVXuKpR2FYNuu2DU8nQL

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\more_itertools-10.3.0.dist-info\WHEEL

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):81
                                                                                                                                                                                                            Entropy (8bit):4.672346887071811
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:RtEeX/QFML6KjP+tPCCfA5I:Rt1QqL6gWBB3
                                                                                                                                                                                                            MD5:FE76A5D309B5416824C2034FBF8A16CD
                                                                                                                                                                                                            SHA1:5975EB6043863B0D018A5D751293F38E0B8E2874
                                                                                                                                                                                                            SHA-256:AD282AFC9A4717D7C7475971E77AB083FD7ED8BCA9644FEA99CB976D552AF78F
                                                                                                                                                                                                            SHA-512:6E4610171DD4E7E49FB4570CF3562D26A4F171FF67DA0F3A259A77916ACB939C8FCA7DA9F473EFAD839947796AC8CD7385DAA3264ADB150FF131A5C0FAC9329C
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Wheel-Version: 1.0.Generator: flit 3.8.0.Root-Is-Purelib: true.Tag: py3-none-any.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\packaging-24.1.dist-info\INSTALLER

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):4
                                                                                                                                                                                                            Entropy (8bit):1.5
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:Mn:M
                                                                                                                                                                                                            MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                            SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                            SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                            SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:pip.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\packaging-24.1.dist-info\LICENSE

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):197
                                                                                                                                                                                                            Entropy (8bit):4.510719529760597
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreBNA2eBKmJozlMHuO:h9Co8FyQjkDYc5tWreBN0n2mH1
                                                                                                                                                                                                            MD5:FAADAEDCA9251A90B205C9167578CE91
                                                                                                                                                                                                            SHA1:ED1FCABA1DBBF55113ABB419A484F3DF63E7ECFC
                                                                                                                                                                                                            SHA-256:CAD1EF5BD340D73E074BA614D26F7DEACA5C7940C3D8C34852E65C4909686C48
                                                                                                                                                                                                            SHA-512:1E69C89558FFE39E5C1EBB6728C4F0EB6023563C7A7F31B5417A8EFCC906378D2E2AF7B0E06A66980FBAAB7996AEB2AE1EA3918FDBE5FFCC3F77EA888A68EFBC
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:This software is made available under the terms of *either* of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to this software is made.under the terms of *both* these licenses..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\packaging-24.1.dist-info\LICENSE.APACHE

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):10174
                                                                                                                                                                                                            Entropy (8bit):4.3908324771089084
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLhP:U9vlKM1zJlFvmNz5VrZ
                                                                                                                                                                                                            MD5:2EE41112A44FE7014DCE33E26468BA93
                                                                                                                                                                                                            SHA1:598F87F072F66E2269DD6919292B2934DBB20492
                                                                                                                                                                                                            SHA-256:0D542E0C8804E39AA7F37EB00DA5A762149DC682D7829451287E11B938E94594
                                                                                                                                                                                                            SHA-512:27B8C0252EAE50CA3CE02AB7C5670664C0C824E03EB3DA1089F3F0A00D23E648A956BCB9F53645C6D79674A87C4CC86D1085DC335911BE0210D691336B121857
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:. Apache License. Version 2.0, January 2004. http://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial own

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\packaging-24.1.dist-info\LICENSE.BSD

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):1344
                                                                                                                                                                                                            Entropy (8bit):5.070827944686827
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:24:fjUnoorbOFFTJJyRrYFTjz796432s4EOkUs8gROF32s3yTtTf413tf9fsZlTHv:fkOFJSrYJR6432svI32s3Stc13tfyTHv
                                                                                                                                                                                                            MD5:7BEF9BF4A8E4263634D0597E7BA100B8
                                                                                                                                                                                                            SHA1:FDC0E4EABC45522B079DEFF7D03D70528D775DC0
                                                                                                                                                                                                            SHA-256:B70E7E9B742F1CC6F948B34C16AA39FFECE94196364BC88FF0D2180F0028FAC5
                                                                                                                                                                                                            SHA-512:96C3273D51B83B6AE1AB85FEFB814DCD6C1E60D311D412242405AA429CC860412477CBD6ECE171408DBB85F0C4FD742E3AF20C758015BC48406AA65A1AB6F60A
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Copyright (c) Donald Stufft and individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE.DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE.FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL.DAMAGES (INCLUDING, BUT NOT LIM

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\packaging-24.1.dist-info\METADATA

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):3204
                                                                                                                                                                                                            Entropy (8bit):4.9859857663557925
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:96:DRKnOkaMktjaVMxsxCp5QXFfFKiYEvA9TzBnyD:psZfFhgXNG
                                                                                                                                                                                                            MD5:3236C0D7091D4A6577FA30E061480CEC
                                                                                                                                                                                                            SHA1:F99865B8D3B90AD64A0060F7F2F4C6E4FAEB0A39
                                                                                                                                                                                                            SHA-256:5F7A283B75A709FCCD481AEA42379F083D4F3801753365922E6B0732042515D9
                                                                                                                                                                                                            SHA-512:A9F0BC43A135732510B98E9C0B7F997D9557A6069352372F1AC3216F0E66FA617D9597990904935D58E5139FB34E17995BFA8B95B90C71997206A2B6955FE867
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Metadata-Version: 2.1.Name: packaging.Version: 24.1.Summary: Core utilities for Python packages.Author-email: Donald Stufft <donald@stufft.io>.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: License :: OSI Approved :: BSD License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classifier: Programming Language :: Python :: 3.13.Classifier: Programming Language :: Python :: Implementation :: CPython.Classifier: Programming Language :: Python :: Implementation

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\packaging-24.1.dist-info\RECORD

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:CSV text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):2565
                                                                                                                                                                                                            Entropy (8bit):5.780503861671858
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:48:bsnuXksXW2Bsv8VsQ7lEsahOsbs5Jhsde8UogvtJkHpHAfEcysrD5WJeCzESowj:vXrW2s8JsMdVogvtJkJgfksP5qeCzOwj
                                                                                                                                                                                                            MD5:88FBF3C6BD08040482212DAD5A8EAB02
                                                                                                                                                                                                            SHA1:E7EE66942F7321FB77888D492D57C2EEEA1A5171
                                                                                                                                                                                                            SHA-256:38A6898306293627C81E2B2D8A93E5F6857D5F7EDB73F0334E8D9A53DAD53B6E
                                                                                                                                                                                                            SHA-512:786AE1F883A999A0939C22A756F90D74CC7F87AAF13F6FFF22D8D962D213A1ECBC6AAE2890A5D7347487824CD0E9EB440A3923F01F938EEF068719DFEEE96554
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:packaging-24.1.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..packaging-24.1.dist-info/LICENSE,sha256=ytHvW9NA1z4HS6YU0m996spceUDD2MNIUuZcSQlobEg,197..packaging-24.1.dist-info/LICENSE.APACHE,sha256=DVQuDIgE45qn836wDaWnYhSdxoLXgpRRKH4RuTjpRZQ,10174..packaging-24.1.dist-info/LICENSE.BSD,sha256=tw5-m3QvHMb5SLNMFqo5_-zpQZY2S8iP8NIYDwAo-sU,1344..packaging-24.1.dist-info/METADATA,sha256=X3ooO3WnCfzNSBrqQjefCD1POAF1M2WSLmsHMgQlFdk,3204..packaging-24.1.dist-info/RECORD,,..packaging-24.1.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..packaging-24.1.dist-info/WHEEL,sha256=EZbGkh7Ie4PoZfRQ8I0ZuP9VklN_TvcZ6DSE5Uar4z4,81..packaging/__init__.py,sha256=dtw2bNmWCQ9WnMoK3bk_elL1svSlikXtLpZhCFIB9SE,496..packaging/__pycache__/__init__.cpython-312.pyc,,..packaging/__pycache__/_elffile.cpython-312.pyc,,..packaging/__pycache__/_manylinux.cpython-312.pyc,,..packaging/__pycache__/_musllinux.cpython-312.pyc,,..packaging/__pycache__/_parser.cpython-312.pyc,,

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\packaging-24.1.dist-info\WHEEL

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):81
                                                                                                                                                                                                            Entropy (8bit):4.672346887071811
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:RtEeX/QFM+vxP+tPCCfA5I:Rt1Qq2WBB3
                                                                                                                                                                                                            MD5:24019423EA7C0C2DF41C8272A3791E7B
                                                                                                                                                                                                            SHA1:AAE9ECFB44813B68CA525BA7FA0D988615399C86
                                                                                                                                                                                                            SHA-256:1196C6921EC87B83E865F450F08D19B8FF5592537F4EF719E83484E546ABE33E
                                                                                                                                                                                                            SHA-512:09AB8E4DAA9193CFDEE6CF98CCAE9DB0601F3DCD4944D07BF3AE6FA5BCB9DC0DCAFD369DE9A650A38D1B46C758DB0721EBA884446A8A5AD82BB745FD5DB5F9B1
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Wheel-Version: 1.0.Generator: flit 3.9.0.Root-Is-Purelib: true.Tag: py3-none-any.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\platformdirs-4.2.2.dist-info\INSTALLER

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):4
                                                                                                                                                                                                            Entropy (8bit):1.5
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:Mn:M
                                                                                                                                                                                                            MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                            SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                            SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                            SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:pip.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\platformdirs-4.2.2.dist-info\METADATA

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:Unicode text, UTF-8 text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):11429
                                                                                                                                                                                                            Entropy (8bit):5.039575520713946
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:192:n9x/tlCtlsaCUpVQ7yHwgNF8NFvWVDM1RnzadSibNTTh+fOnnxa6jlES4h8a8KAH:3/tlCfsqpq7ydZzM0dGiCbvHcjNj61TA
                                                                                                                                                                                                            MD5:12306075DF09A0DBB93315FADDDF73FB
                                                                                                                                                                                                            SHA1:1AC8A3679AFCFEEC0BA00851F5F8095DD1B060CD
                                                                                                                                                                                                            SHA-256:CE6B227B4D46D4CB57474C2022FE57A557933BB89DAF4596BDF9B12AC296B869
                                                                                                                                                                                                            SHA-512:BA0A72B888A14F82FD44FB103C01EF0900B5302F18E986A8264A9A08AB77D1C655C392374FD7B0A98BEF9B9511F6EC78AF3EF8936091C80A0B5364F7A53DC20A
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Metadata-Version: 2.3.Name: platformdirs.Version: 4.2.2.Summary: A small Python package for determining appropriate platform-specific dirs, e.g. a `user data dir`..Project-URL: Documentation, https://platformdirs.readthedocs.io.Project-URL: Homepage, https://github.com/platformdirs/platformdirs.Project-URL: Source, https://github.com/platformdirs/platformdirs.Project-URL: Tracker, https://github.com/platformdirs/platformdirs/issues.Maintainer-email: Bern.t G.bor <gaborjbernat@gmail.com>, Julian Berman <Julian@GrayVines.com>, Ofek Lev <oss@ofek.dev>, Ronny Pfannschmidt <opensource@ronnypfannschmidt.de>.License-Expression: MIT.License-File: LICENSE.Keywords: appdirs,application,cache,directory,log,user.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Operating System :: OS Independent.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\platformdirs-4.2.2.dist-info\RECORD

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:CSV text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):1642
                                                                                                                                                                                                            Entropy (8bit):5.780720255872038
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:24:bn/2zDzoobEsJhfPWcs013+pj456szN6lnhta57WJ+guQg4:bnuXcob5Jhfucs+d49hta9WJ+g1X
                                                                                                                                                                                                            MD5:0E141A28570FC62974FC5CEADFE808E3
                                                                                                                                                                                                            SHA1:7B92561C5BBBA83D6E16A1C7B195089ACA1766AF
                                                                                                                                                                                                            SHA-256:4C211D76D42ED40EFC3ACFCC866D8912A718AFBCA2B7E51849442366D6E99FE8
                                                                                                                                                                                                            SHA-512:830721C18A35AECD1EFB81A5FAAF8AC0EA02428EDC5B294458556343788D894B76035F1E661214D975DF2A64DC8C3D6AAA7A53A99BE64B9413B6A5D89D549F9D
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:platformdirs-4.2.2.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..platformdirs-4.2.2.dist-info/METADATA,sha256=zmsie01G1MtXR0wgIv5XpVeTO7idr0WWvfmxKsKWuGk,11429..platformdirs-4.2.2.dist-info/RECORD,,..platformdirs-4.2.2.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..platformdirs-4.2.2.dist-info/WHEEL,sha256=zEMcRr9Kr03x1ozGwg5v9NQBKn3kndp6LSoSlVg-jhU,87..platformdirs-4.2.2.dist-info/licenses/LICENSE,sha256=KeD9YukphQ6G6yjD_czwzv30-pSHkBHP-z0NS-1tTbY,1089..platformdirs/__init__.py,sha256=EMGE8qeHRR9CzDFr8kL3tA8hdZZniYjXBVZd0UGTWK0,22225..platformdirs/__main__.py,sha256=HnsUQHpiBaiTxwcmwVw-nFaPdVNZtQIdi1eWDtI-MzI,1493..platformdirs/__pycache__/__init__.cpython-312.pyc,,..platformdirs/__pycache__/__main__.cpython-312.pyc,,..platformdirs/__pycache__/android.cpython-312.pyc,,..platformdirs/__pycache__/api.cpython-312.pyc,,..platformdirs/__pycache__/macos.cpython-312.pyc,,..platformdirs/__pycache__/unix.cpython-312.pyc,,..platformdirs/__p

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\platformdirs-4.2.2.dist-info\WHEEL

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):87
                                                                                                                                                                                                            Entropy (8bit):4.730668933656452
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:RtEeXAaCTR73RP+tPCCfA5I:Rt2PFRWBB3
                                                                                                                                                                                                            MD5:8895639B8515B3094302B59E28AFB562
                                                                                                                                                                                                            SHA1:FBD4DA759EA5BEB65AE820DFBC47F9B569E89519
                                                                                                                                                                                                            SHA-256:CC431C46BF4AAF4DF1D68CC6C20E6FF4D4012A7DE49DDA7A2D2A1295583E8E15
                                                                                                                                                                                                            SHA-512:B53C0978DAD2A7195058ABC7B7D20A229EC617BDDBB364D8ED2354F37D5071208735774350F9FBBA5C804BEFCEFE71C27BC5E468E12899DF4687189C468785A0
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Wheel-Version: 1.0.Generator: hatchling 1.24.2.Root-Is-Purelib: true.Tag: py3-none-any.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\platformdirs-4.2.2.dist-info\licenses\LICENSE

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):1089
                                                                                                                                                                                                            Entropy (8bit):5.119723466133474
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:24:VrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:VaJHlxE3dQHOs5exm3ogFh
                                                                                                                                                                                                            MD5:EA4F5A41454746A9ED111E3D8723D17A
                                                                                                                                                                                                            SHA1:F511A8A63AF8C6E36004B593478436BBC560EE0C
                                                                                                                                                                                                            SHA-256:29E0FD62E929850E86EB28C3FDCCF0CEFDF4FA94879011CFFB3D0D4BED6D4DB6
                                                                                                                                                                                                            SHA-512:CACA68A5589CA2EAB7C0D74BA5D2B25E3367B9902DFC7578BBA911AC8F8BF1C3A13F25E663C5B6B19BA71BF611943E23F4D0A99BE92A8F7D7FF60732DC3DD409
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:MIT License..Copyright (c) 2010-202x The platformdirs developers..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\tomli-2.0.1.dist-info\INSTALLER

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):4
                                                                                                                                                                                                            Entropy (8bit):1.5
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:Mn:M
                                                                                                                                                                                                            MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                            SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                            SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                            SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:pip.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\tomli-2.0.1.dist-info\LICENSE

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):1072
                                                                                                                                                                                                            Entropy (8bit):5.10135495500641
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:24:f9rmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:1aJHlxE3dQHOs5exm3ogFh
                                                                                                                                                                                                            MD5:AAAAF0879D17DF0110D1AA8C8C9F46F5
                                                                                                                                                                                                            SHA1:9DA6CA26337A886FB3E8D30EFD4AEDA623DC9ADE
                                                                                                                                                                                                            SHA-256:B80816B0D530B8ACCB4C2211783790984A6E3B61922C2B5EE92F3372AB2742FE
                                                                                                                                                                                                            SHA-512:EECD0C29FEBF51ADEFB02F970E66EFE7E24D573686DFDB3BEEA63CEFEA012A79CE3C49A899B4F26E9B67DC27176B397F6041909227281F9866BEEDC97389095C
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:MIT License..Copyright (c) 2021 Taneli Hukkinen..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR IN CON

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\tomli-2.0.1.dist-info\METADATA

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:Python script, ASCII text executable
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):8875
                                                                                                                                                                                                            Entropy (8bit):4.884349533695185
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:192:h15VsahrDzoGlmLxUJyLIPXR/yrKK3Trclclg2pj4VRR6V8wNVonQd:3swrAamWuIPA2K3v2g
                                                                                                                                                                                                            MD5:CBBF7047A51FEDA58386E86182B85B8A
                                                                                                                                                                                                            SHA1:D3EA3BDA227794AE35FE7FFC5BD6E5FA2A5EF250
                                                                                                                                                                                                            SHA-256:CCF0DC78A98FC0918B5AD67292B1E2C4BED65575A6246CD9D63C914F9942A0F2
                                                                                                                                                                                                            SHA-512:A994914F1676790730C6BDACA26FE5F1B18BA9A3B9F0D24D708C722424DED255360A0CC88E239C6BFE467BD2763DF7339BB6B760AB090FAE474A7C9C8AFA8948
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                            Preview:Metadata-Version: 2.1.Name: tomli.Version: 2.0.1.Summary: A lil' TOML parser.Keywords: toml.Author-email: Taneli Hukkinen <hukkin@users.noreply.github.com>.Requires-Python: >=3.7.Description-Content-Type: text/markdown.Classifier: License :: OSI Approved :: MIT License.Classifier: Operating System :: MacOS.Classifier: Operating System :: Microsoft :: Windows.Classifier: Operating System :: POSIX :: Linux.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: Implementation :: CPython.Classifier: Programming Language :: Python :: Implementation :: PyPy.Classifier: Topic :: Software Development :: Libraries :: Python Modules.Classifier: Typing :: Typed.Project-URL: Changelog, https://github.com/hukkin/tomli/blob/master/CHANGELOG.md.Project-URL:

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\tomli-2.0.1.dist-info\RECORD

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:CSV text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):999
                                                                                                                                                                                                            Entropy (8bit):5.89030761653127
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:24:4n/2zDRv53Pb4EsJWc6QtD8r8N8bh8WNdop2+oM8+kzAL5+1:4nuXR1Pb45JWc6QmIebKWcpHoM8JMLy
                                                                                                                                                                                                            MD5:D5FAB61E3DB6B54B51FBA607865C195B
                                                                                                                                                                                                            SHA1:B94D9126E8FC9D5F29FAFBB67F068E2D111D17FC
                                                                                                                                                                                                            SHA-256:0CB9F9A451A1E365AC54B4C88662E1DA0CB54A72D16A5258FB0ABFF9D3E1C022
                                                                                                                                                                                                            SHA-512:ABD3EF61D8D578C1DE609560A6985503E60BD53F90DCFF54EBEE23714D9CD88DBA4036ED19B24EC62B8432550311894FCC47BDCCD7CE4DCDE82518F4E02E123C
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:tomli-2.0.1.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..tomli-2.0.1.dist-info/LICENSE,sha256=uAgWsNUwuKzLTCIReDeQmEpuO2GSLCte6S8zcqsnQv4,1072..tomli-2.0.1.dist-info/METADATA,sha256=zPDceKmPwJGLWtZykrHixL7WVXWmJGzZ1jyRT5lCoPI,8875..tomli-2.0.1.dist-info/RECORD,,..tomli-2.0.1.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..tomli-2.0.1.dist-info/WHEEL,sha256=jPMR_Dzkc4X4icQtmz81lnNY_kAsfog7ry7qoRvYLXw,81..tomli/__init__.py,sha256=JhUwV66DB1g4Hvt1UQCVMdfCu-IgAV8FXmvDU9onxd4,396..tomli/__pycache__/__init__.cpython-312.pyc,,..tomli/__pycache__/_parser.cpython-312.pyc,,..tomli/__pycache__/_re.cpython-312.pyc,,..tomli/__pycache__/_types.cpython-312.pyc,,..tomli/_parser.py,sha256=g9-ENaALS-B8dokYpCuzUFalWlog7T-SIYMjLZSWrtM,22633..tomli/_re.py,sha256=dbjg5ChZT23Ka9z9DHOXfdtSpPwUfdgMXnj8NOoly-w,2943..tomli/_types.py,sha256=-GTG2VUqkpxwMqzmVO4F7ybKddIbAnuAHXfmWQcTi3Q,254..tomli/py.typed,sha256=8PjyZ1aVoQpRVvt71muvuq5qE-jTFZkK-GLHkhdebmc,26..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\tomli-2.0.1.dist-info\WHEEL

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):81
                                                                                                                                                                                                            Entropy (8bit):4.672346887071811
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:RtEeX/QFMthP+tPCCfA5I:Rt1QqDWBB3
                                                                                                                                                                                                            MD5:FF39892A240316BD62B5832C03D504BC
                                                                                                                                                                                                            SHA1:3883FC4406CC9A73BE0B839C1A0C31D3DDD64829
                                                                                                                                                                                                            SHA-256:8CF311FC3CE47385F889C42D9B3F35967358FE402C7E883BAF2EEAA11BD82D7C
                                                                                                                                                                                                            SHA-512:B2E57D9C81BBFB7364B8216FC086B8F73C2F2B537E300FB250EFB7972E3908F77A3D504363676C50A195D307822C69EE9B689DE6C48A4E6B8A6BA89A5A99AC32
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Wheel-Version: 1.0.Generator: flit 3.6.0.Root-Is-Purelib: true.Tag: py3-none-any.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\typeguard-4.3.0.dist-info\INSTALLER

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):4
                                                                                                                                                                                                            Entropy (8bit):1.5
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:Mn:M
                                                                                                                                                                                                            MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                            SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                            SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                            SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:pip.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\typeguard-4.3.0.dist-info\LICENSE

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:Unicode text, UTF-8 text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):1130
                                                                                                                                                                                                            Entropy (8bit):5.118590213496374
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:24:qt4rWHvH0yPP3Gt6Hw1hP9QHmsUv48OV/+dho3BoqxFB:/S/lPvKhlQHms5QK3WmFB
                                                                                                                                                                                                            MD5:F0E423EEA5C91E7AA21BDB70184B3E53
                                                                                                                                                                                                            SHA1:A51CCDCB7A9D8C2116D1DFC16F11B3C8A5830F67
                                                                                                                                                                                                            SHA-256:6163F7987DFB38D6BC320CE2B70B2F02B862BC41126516D552EF1CD43247E758
                                                                                                                                                                                                            SHA-512:8BE742880E6E8495C7EC4C9ECC8F076A9FC9D64FC84B3AEBBC8D2D10DC62AC2C5053F33B716212DCB76C886A9C51619F262C460FC4B39A335CE1AE2C9A8769A8
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:This is the MIT license: http://www.opensource.org/licenses/mit-license.php..Copyright (c) Alex Gr.nholm..Permission is hereby granted, free of charge, to any person obtaining a copy of this.software and associated documentation files (the "Software"), to deal in the Software.without restriction, including without limitation the rights to use, copy, modify, merge,.publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons.to whom the Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all copies or.substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,.INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR.PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE.FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF C

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\typeguard-4.3.0.dist-info\METADATA

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:Unicode text, UTF-8 text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):3717
                                                                                                                                                                                                            Entropy (8bit):4.986068381037722
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:96:DSQRbraktjaAckH94jQnJIK04Fak/grjspC3EklAJj:/Rakd4jA7ak/gvspNWmj
                                                                                                                                                                                                            MD5:B6DAAC02F66AC8403E9061881322BABE
                                                                                                                                                                                                            SHA1:9A94672CCFEA06156A5F8A321CD0626CFD233AE8
                                                                                                                                                                                                            SHA-256:CF675C1C0A744F08580855390DE87CC77D676B312582E8D4CFDB5BB8FD298D21
                                                                                                                                                                                                            SHA-512:9C6B7326C90396AA9E962C2731A1085EDB672B5696F95F552D13350843C09A246E0BBF0EC484862DFF434FA5A86DE4C0B7C963958ADE35A066B9D2384076DD47
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Metadata-Version: 2.1.Name: typeguard.Version: 4.3.0.Summary: Run-time type checker for Python.Author-email: Alex Gr.nholm <alex.gronholm@nextday.fi>.License: MIT.Project-URL: Documentation, https://typeguard.readthedocs.io/en/latest/.Project-URL: Change log, https://typeguard.readthedocs.io/en/latest/versionhistory.html.Project-URL: Source code, https://github.com/agronholm/typeguard.Project-URL: Issue tracker, https://github.com/agronholm/typeguard/issues.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Requires-Python: >=3.8.Description-Content

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\typeguard-4.3.0.dist-info\RECORD

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:CSV text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):2402
                                                                                                                                                                                                            Entropy (8bit):5.729208478282605
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:48:eDnuX3DVED9HDDeDfPDLkAosGDlDiVoBFj7XH0H3HuwVB6Kgfkx7J/Q1NK1cQyxk:eyX3WRHDiLPjksV7I47J/Q1U6Qyx5fsJ
                                                                                                                                                                                                            MD5:D680B2881597974ACD91750E5AB61010
                                                                                                                                                                                                            SHA1:E00ED2416B5CE21641E3946905504D62D536972F
                                                                                                                                                                                                            SHA-256:48A51959582478352275428CEECD78EF77D79AC9DAE796E39A2EAF2540282552
                                                                                                                                                                                                            SHA-512:112172ACB515B0712AC58D78898EB159580ADA3DD3F16AABB37CB7A8D964F9E4BADF2869A245927B83B208D56904831C0F04ED925C95DFCB705801734FB0C7BA
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:typeguard-4.3.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..typeguard-4.3.0.dist-info/LICENSE,sha256=YWP3mH37ONa8MgzitwsvArhivEESZRbVUu8c1DJH51g,1130..typeguard-4.3.0.dist-info/METADATA,sha256=z2dcHAp0TwhYCFU5Deh8x31nazElgujUz9tbuP0pjSE,3717..typeguard-4.3.0.dist-info/RECORD,,..typeguard-4.3.0.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92..typeguard-4.3.0.dist-info/entry_points.txt,sha256=qp7NQ1aLtiSgMQqo6gWlfGpy0IIXzoMJmeQTLpzqFZQ,48..typeguard-4.3.0.dist-info/top_level.txt,sha256=4z28AhuDodwRS_c1J_l8H51t5QuwfTseskYzlxp6grs,10..typeguard/__init__.py,sha256=Onh4w38elPCjtlcU3JY9k3h70NjsxXIkAflmQn-Z0FY,2071..typeguard/__pycache__/__init__.cpython-312.pyc,,..typeguard/__pycache__/_checkers.cpython-312.pyc,,..typeguard/__pycache__/_config.cpython-312.pyc,,..typeguard/__pycache__/_decorators.cpython-312.pyc,,..typeguard/__pycache__/_exceptions.cpython-312.pyc,,..typeguard/__pycache__/_functions.cpython-312.pyc,,..typeguard/__pycache__/_i

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\typeguard-4.3.0.dist-info\WHEEL

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):92
                                                                                                                                                                                                            Entropy (8bit):4.812622295095324
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:RtEeX7MWcSlVlFxP+tPCCfA5S:RtBMwlVTxWBBf
                                                                                                                                                                                                            MD5:43136DDE7DD276932F6197BB6D676EF4
                                                                                                                                                                                                            SHA1:6B13C105452C519EA0B65AC1A975BD5E19C50122
                                                                                                                                                                                                            SHA-256:189EEDFE4581172C1B6A02B97A8F48A14C0B5BAA3239E4CA990FBD8871553714
                                                                                                                                                                                                            SHA-512:E7712BA7D36DEB083EBCC3B641AD3E7D19FB071EE64AE3A35AD6A50EE882B20CD2E60CA1319199DF12584FE311A6266EC74F96A3FB67E59F90C7B5909668AEE1
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Wheel-Version: 1.0.Generator: bdist_wheel (0.43.0).Root-Is-Purelib: true.Tag: py3-none-any..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\typeguard-4.3.0.dist-info\entry_points.txt

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):48
                                                                                                                                                                                                            Entropy (8bit):4.155187698990101
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:mWSJCQEjMitjHfLvn:mrMJHfbn
                                                                                                                                                                                                            MD5:AEAB5BCF8BF89A51C97C4CDF70578848
                                                                                                                                                                                                            SHA1:2E9C1617560AB66431AAB90700DB901985293485
                                                                                                                                                                                                            SHA-256:AA9ECD43568BB624A0310AA8EA05A57C6A72D08217CE830999E4132E9CEA1594
                                                                                                                                                                                                            SHA-512:2BE73E99296DF26A28835F91DD8BC50EB104AF06A3C54666175FAF322E0AD4620453DB0388531C4113B052A92C1D2E4C3088E25AF43CDE42AA852CF7B0CB5B05
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:[pytest11].typeguard = typeguard._pytest_plugin.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\typeguard-4.3.0.dist-info\top_level.txt

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):10
                                                                                                                                                                                                            Entropy (8bit):3.321928094887362
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:LEJn:M
                                                                                                                                                                                                            MD5:004A2A8CE1AB120A63902A27D76BD964
                                                                                                                                                                                                            SHA1:A4E367AB40410598DADD1FC5F680ED7A176BEB09
                                                                                                                                                                                                            SHA-256:E33DBC021B83A1DC114BF73527F97C1F9D6DE50BB07D3B1EB24633971A7A82BB
                                                                                                                                                                                                            SHA-512:0D8FF9A43897AB390AB41AFE5BAC8BD38A68C2BEF88E844E5B49BF70E3164B226975CC2717AE3DC3428D1CFBB0BE068C243F104915FEE1FFA58C23FBE76FDB89
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:typeguard.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\typing_extensions-4.12.2.dist-info\INSTALLER

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):4
                                                                                                                                                                                                            Entropy (8bit):1.5
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:Mn:M
                                                                                                                                                                                                            MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                            SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                            SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                            SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:pip.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\typing_extensions-4.12.2.dist-info\LICENSE

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):13936
                                                                                                                                                                                                            Entropy (8bit):5.135214154002924
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:384:cke8RQ6KSAdxC9ad9iqsibQtKti9zpQpzu9Jkh:K8RQ6q7C9ad9iqT8cti9zpQpzu7kh
                                                                                                                                                                                                            MD5:FCF6B249C2641540219A727F35D8D2C2
                                                                                                                                                                                                            SHA1:C6E195F9AA30CC9B675D1612CA4FB7F74111BD35
                                                                                                                                                                                                            SHA-256:3B2F81FE21D181C499C59A256C8E1968455D6689D269AA85373BFB6AF41DA3BF
                                                                                                                                                                                                            SHA-512:70367B908204B5922E5D9D2ACE39437DBAA1EEFDAD1797B50CC6E7DCA168D9B59199353BADDDCAEEE12B49D328FC8132F628952383CFE6803CB4F4BF9B9D6D86
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:A. HISTORY OF THE SOFTWARE.==========================..Python was created in the early 1990s by Guido van Rossum at Stichting.Mathematisch Centrum (CWI, see https://www.cwi.nl) in the Netherlands.as a successor of a language called ABC. Guido remains Python's.principal author, although it includes many contributions from others...In 1995, Guido continued his work on Python at the Corporation for.National Research Initiatives (CNRI, see https://www.cnri.reston.va.us).in Reston, Virginia where he released several versions of the.software...In May 2000, Guido and the Python core development team moved to.BeOpen.com to form the BeOpen PythonLabs team. In October of the same.year, the PythonLabs team moved to Digital Creations, which became.Zope Corporation. In 2001, the Python Software Foundation (PSF, see.https://www.python.org/psf/) was formed, a non-profit organization.created specifically to own Python-related Intellectual Property..Zope Corporation was a sponsoring member of the PS

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\typing_extensions-4.12.2.dist-info\METADATA

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:Unicode text, UTF-8 text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):3018
                                                                                                                                                                                                            Entropy (8bit):5.0579916471633
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:48:DtkCMU2ymXbFX1QI/aMktjaVQEBu+FOK+W6i+qXd0qme28mIp9DvvV+Vz+nlh:DtkCD/mxX1QI/aMktjaVBroBBqd0VODD
                                                                                                                                                                                                            MD5:8303191AC93E4D32457A4A9E3CDAD8E5
                                                                                                                                                                                                            SHA1:B6ADA54B9516D20B69A5DD5CDED868DA22C5E252
                                                                                                                                                                                                            SHA-256:05E51021AF1C9D86EB8D6C7E37C4CECE733D5065B91A6D8389C5690ED440F16D
                                                                                                                                                                                                            SHA-512:F2F5DBE5EA55ED720FA4191180076E9EFFCB9C811C3C7BF1A1201E9D78590B381E125EAF7B8366B28A03383C2958449423548576605E8DCB5CC11C33C9B0E709
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Metadata-Version: 2.1.Name: typing_extensions.Version: 4.12.2.Summary: Backported and Experimental Type Hints for Python 3.8+.Keywords: annotations,backport,checker,checking,function,hinting,hints,type,typechecking,typehinting,typehints,typing.Author-email: "Guido van Rossum, Jukka Lehtosalo, .ukasz Langa, Michael Lee" <levkivskyi@gmail.com>.Requires-Python: >=3.8.Description-Content-Type: text/markdown.Classifier: Development Status :: 5 - Production/Stable.Classifier: Environment :: Console.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Python Software Foundation License.Classifier: Operating System :: OS Independent.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Langua

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\typing_extensions-4.12.2.dist-info\RECORD

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:CSV text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):571
                                                                                                                                                                                                            Entropy (8bit):5.751670348693122
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:12:rCA89x0a/2zDuxv/vjWaxLbSaLjxjxXaefIE12BATqyo/C:mA87n/2zD6vXCulVZf5Cc4C
                                                                                                                                                                                                            MD5:B884E8832BFB336C2D7F54271F11EE1C
                                                                                                                                                                                                            SHA1:5A3BAABEE79E0CF32D2E87C9AF0FBB3AAD8CACAD
                                                                                                                                                                                                            SHA-256:7710002D81971E632AA6A2FC33DC5D74AAF5D7CAAE22040A65D3E31503B05EE9
                                                                                                                                                                                                            SHA-512:0A5EB3ABED212C474CB5FDDEF47F8E62DAA130128F2BB368A8E1F12E143DAE2F8B2EF4A9B85A883A03C67195829AD637DB7CF7CC4B41535AF6CA5668F8F2BD0B
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:__pycache__/typing_extensions.cpython-312.pyc,,..typing_extensions-4.12.2.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..typing_extensions-4.12.2.dist-info/LICENSE,sha256=Oy-B_iHRgcSZxZolbI4ZaEVdZonSaaqFNzv7avQdo78,13936..typing_extensions-4.12.2.dist-info/METADATA,sha256=BeUQIa8cnYbrjWx-N8TOznM9UGW5Gm2DicVpDtRA8W0,3018..typing_extensions-4.12.2.dist-info/RECORD,,..typing_extensions-4.12.2.dist-info/WHEEL,sha256=EZbGkh7Ie4PoZfRQ8I0ZuP9VklN_TvcZ6DSE5Uar4z4,81..typing_extensions.py,sha256=gwekpyG9DVG3lxWKX4ni8u7nk3We5slG98mA9F3DJQw,134451..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\typing_extensions-4.12.2.dist-info\WHEEL

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):81
                                                                                                                                                                                                            Entropy (8bit):4.672346887071811
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:RtEeX/QFM+vxP+tPCCfA5I:Rt1Qq2WBB3
                                                                                                                                                                                                            MD5:24019423EA7C0C2DF41C8272A3791E7B
                                                                                                                                                                                                            SHA1:AAE9ECFB44813B68CA525BA7FA0D988615399C86
                                                                                                                                                                                                            SHA-256:1196C6921EC87B83E865F450F08D19B8FF5592537F4EF719E83484E546ABE33E
                                                                                                                                                                                                            SHA-512:09AB8E4DAA9193CFDEE6CF98CCAE9DB0601F3DCD4944D07BF3AE6FA5BCB9DC0DCAFD369DE9A650A38D1B46C758DB0721EBA884446A8A5AD82BB745FD5DB5F9B1
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Wheel-Version: 1.0.Generator: flit 3.9.0.Root-Is-Purelib: true.Tag: py3-none-any.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\wheel-0.43.0.dist-info\INSTALLER

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):4
                                                                                                                                                                                                            Entropy (8bit):1.5
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:Mn:M
                                                                                                                                                                                                            MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                            SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                            SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                            SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:pip.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txt

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):1107
                                                                                                                                                                                                            Entropy (8bit):5.115074330424529
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:24:PWmrRONJHLH0cPP3gtkHw1h39QHOsUv4eOk4/+jvho3nPz:ttONJbbvE/NQHOs5eNS3n7
                                                                                                                                                                                                            MD5:7FFB0DB04527CFE380E4F2726BD05EBF
                                                                                                                                                                                                            SHA1:5B39C45A91A556E5F1599604F1799E4027FA0E60
                                                                                                                                                                                                            SHA-256:30C23618679108F3E8EA1D2A658C7CA417BDFC891C98EF1A89FA4FF0C9828654
                                                                                                                                                                                                            SHA-512:205F284F3A7E8E696C70ED7B856EE98C1671C68893F0952EEC40915A383BC452B99899BDC401F9FE161A1BF9B6E2CEA3BCD90615EEE9173301657A2CE4BAFE14
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:MIT License..Copyright (c) 2012 Daniel Holth <dholth@fastmail.fm> and contributors..Permission is hereby granted, free of charge, to any person obtaining a.copy of this software and associated documentation files (the "Software"),.to deal in the Software without restriction, including without limitation.the rights to use, copy, modify, merge, publish, distribute, sublicense,.and/or sell copies of the Software, and to permit persons to whom the.Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included.in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL.THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR.OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERW

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\wheel-0.43.0.dist-info\METADATA

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:Unicode text, UTF-8 text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):2153
                                                                                                                                                                                                            Entropy (8bit):5.088249746074878
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:48:DEhpFu5MktjaywDK48d+md+7uT8RfkD1UKd+mOl1Awry:DEhpiMktjayq/7kOfsUzmbYy
                                                                                                                                                                                                            MD5:EBEA27DA14E3F453119DC72D84343E8C
                                                                                                                                                                                                            SHA1:7CEB6DBE498B69ABF4087637C6F500742FF7E2B4
                                                                                                                                                                                                            SHA-256:59BAC22B00A59D3E5608A56B8CF8EFC43831A36B72792EE4389C9CD4669C7841
                                                                                                                                                                                                            SHA-512:A41593939B9325D40CB67FD3F41CD1C9E9978F162487FB469094C41440B5F48016B9A66BE2E6E4A0406D6EEDB25CE4F5A860BA1E3DC924B81F63CEEE3AE31117
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Metadata-Version: 2.1.Name: wheel.Version: 0.43.0.Summary: A built-package format for Python.Keywords: wheel,packaging.Author-email: Daniel Holth <dholth@fastmail.fm>.Maintainer-email: Alex Gr.nholm <alex.gronholm@nextday.fi>.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: Topic :: System :: Archiving :: Packaging.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Requires-Dist: pytest >= 6.0.0 ; extra == "test".Requires-Dist: setuptools >= 65 ; extra == "test".Project-URL: Changelog, https://wheel.readthedocs.io/en/s

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\wheel-0.43.0.dist-info\RECORD

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:CSV text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):4557
                                                                                                                                                                                                            Entropy (8bit):5.714200636114494
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:96:QXVuEmegx01TQIvFCiq9H/H7vp88FxTXiJPkGJP4CWweXQHmnDpMI78IegK5EeZR:QXVxAbYkU4CWweXQHmnDpMeV2BvTRqQF
                                                                                                                                                                                                            MD5:44D352C4997560C7BFB82D9360F5985A
                                                                                                                                                                                                            SHA1:BE58C7B8AB32790384E4E4F20865C4A88414B67A
                                                                                                                                                                                                            SHA-256:783E654742611AF88CD9F00BF01A431A219DB536556E63FF981C7BD673070AC9
                                                                                                                                                                                                            SHA-512:281B1D939A560E6A08D0606E5E8CE15F086B4B45738AB41ED6B5821968DC8D764CD6B25DB6BA562A07018C271ABF17A6BC5A380FAD05696ADF1D11EE2C5749C8
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:../../bin/wheel,sha256=cT2EHbrv-J-UyUXu26cDY-0I7RgcruysJeHFanT1Xfo,249..wheel-0.43.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..wheel-0.43.0.dist-info/LICENSE.txt,sha256=MMI2GGeRCPPo6h0qZYx8pBe9_IkcmO8aifpP8MmChlQ,1107..wheel-0.43.0.dist-info/METADATA,sha256=WbrCKwClnT5WCKVrjPjvxDgxo2tyeS7kOJyc1GaceEE,2153..wheel-0.43.0.dist-info/RECORD,,..wheel-0.43.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..wheel-0.43.0.dist-info/WHEEL,sha256=EZbGkh7Ie4PoZfRQ8I0ZuP9VklN_TvcZ6DSE5Uar4z4,81..wheel-0.43.0.dist-info/entry_points.txt,sha256=rTY1BbkPHhkGMm4Q3F0pIzJBzW2kMxoG1oriffvGdA0,104..wheel/__init__.py,sha256=D6jhH00eMzbgrXGAeOwVfD5i-lCAMMycuG1L0useDlo,59..wheel/__main__.py,sha256=NkMUnuTCGcOkgY0IBLgBCVC_BGGcWORx2K8jYGS12UE,455..wheel/__pycache__/__init__.cpython-312.pyc,,..wheel/__pycache__/__main__.cpython-312.pyc,,..wheel/__pycache__/_setuptools_logging.cpython-312.pyc,,..wheel/__pycache__/bdist_wheel.cpython-312.pyc,,..wheel/__pycache

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\wheel-0.43.0.dist-info\WHEEL

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):81
                                                                                                                                                                                                            Entropy (8bit):4.672346887071811
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:RtEeX/QFM+vxP+tPCCfA5I:Rt1Qq2WBB3
                                                                                                                                                                                                            MD5:24019423EA7C0C2DF41C8272A3791E7B
                                                                                                                                                                                                            SHA1:AAE9ECFB44813B68CA525BA7FA0D988615399C86
                                                                                                                                                                                                            SHA-256:1196C6921EC87B83E865F450F08D19B8FF5592537F4EF719E83484E546ABE33E
                                                                                                                                                                                                            SHA-512:09AB8E4DAA9193CFDEE6CF98CCAE9DB0601F3DCD4944D07BF3AE6FA5BCB9DC0DCAFD369DE9A650A38D1B46C758DB0721EBA884446A8A5AD82BB745FD5DB5F9B1
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Wheel-Version: 1.0.Generator: flit 3.9.0.Root-Is-Purelib: true.Tag: py3-none-any.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\wheel-0.43.0.dist-info\entry_points.txt

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):104
                                                                                                                                                                                                            Entropy (8bit):4.271713330022269
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:1SSAnAYgh+MWTMhk6WjrAM5t5ln:1Jb9WTMhk9jUM5t5ln
                                                                                                                                                                                                            MD5:6180E17C30BAE5B30DB371793FCE0085
                                                                                                                                                                                                            SHA1:E3A12C421562A77D90A13D8539A3A0F4D3228359
                                                                                                                                                                                                            SHA-256:AD363505B90F1E1906326E10DC5D29233241CD6DA4331A06D68AE27DFBC6740D
                                                                                                                                                                                                            SHA-512:69EAE7B1E181D7BA1D3E2864D31E1320625A375E76D3B2FBF8856B3B6515936ACE3138D4D442CABDE7576FCFBCBB0DEED054D90B95CFA1C99829DB12A9031E26
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:[console_scripts].wheel=wheel.cli:main..[distutils.commands].bdist_wheel=wheel.bdist_wheel:bdist_wheel..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\zipp-3.19.2.dist-info\INSTALLER

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):4
                                                                                                                                                                                                            Entropy (8bit):1.5
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:Mn:M
                                                                                                                                                                                                            MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                            SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                            SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                            SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:pip.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\zipp-3.19.2.dist-info\LICENSE

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):1023
                                                                                                                                                                                                            Entropy (8bit):5.059832621894572
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:24:OrmJHcwH0MP3gt8Hw1hj9QHOsUv4eOk4/+/m3oqMSFJ:OaJ8YHvEH5QHOs5exm3oEFJ
                                                                                                                                                                                                            MD5:141643E11C48898150DAA83802DBC65F
                                                                                                                                                                                                            SHA1:0445ED0F69910EEAEE036F09A39A13C6E1F37E12
                                                                                                                                                                                                            SHA-256:86DA0F01AEAE46348A3C3D465195DC1CECCDE79F79E87769A64B8DA04B2A4741
                                                                                                                                                                                                            SHA-512:EF62311602B466397BAF0B23CACA66114F8838F9E78E1B067787CEB709D09E0530E85A47BBCD4C5A0905B74FDB30DF0CC640910C6CC2E67886E5B18794A3583F
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to.deal in the Software without restriction, including without limitation the.rights to use, copy, modify, merge, publish, distribute, sublicense, and/or.sell copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING.FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEA

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\zipp-3.19.2.dist-info\METADATA

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):3575
                                                                                                                                                                                                            Entropy (8bit):5.085545958857746
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:96:D0h4aC/S802Vpnu3pyt1Q+/+DeVb0ksYSwTgD:Oc/z02Vpnu3pytS+2DeVNfSwTW
                                                                                                                                                                                                            MD5:F659E7F578CE6FD3753871DBBBA1F939
                                                                                                                                                                                                            SHA1:C53B0E6A2E3D94093E2FE4978926A7439B47D43C
                                                                                                                                                                                                            SHA-256:508AE4FE43081C64B0B0A2828588B3A8CC3430C6693D1676662569400B0DFDB1
                                                                                                                                                                                                            SHA-512:2C0496B76D259259A8F1E57F3ED2224A7E3E99FF309F764C00A8377BB5BD1C94035BDDF24BD1BA637209677CB9F4E8109F84C50B3488B5B8FC372B6BEDAB9AE0
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Metadata-Version: 2.1.Name: zipp.Version: 3.19.2.Summary: Backport of pathlib-compatible object wrapper for zip files.Author-email: "Jason R. Coombs" <jaraco@jaraco.com>.Project-URL: Homepage, https://github.com/jaraco/zipp.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.License-File: LICENSE.Provides-Extra: doc.Requires-Dist: sphinx >=3.5 ; extra == 'doc'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'doc'.Requires-Dist: rst.linker >=1.9 ; extra == 'doc'.Requires-Dist: furo ; extra == 'doc'.Requires-Dist: sphinx-lint ; extra == 'doc'.Requires-Dist: jaraco.tidelift >=1.4 ; extra == 'doc'.Provides-Extra: test.Requires-Dist: pytest !=8.1.*,>=6 ; extra == 'test'.Requires-Dist: pytest-checkdocs >=2.4 ; extra == 'test'.Requir

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\zipp-3.19.2.dist-info\RECORD

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:CSV text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):1039
                                                                                                                                                                                                            Entropy (8bit):5.8094923667268965
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:24:An/2zDlvbqfuiwbWk/EsJ6Xam9lpW8OWq3tW36nJA3u3iWwksYW:AnuXlzUuitk/5J6f9lpW8OW4tM6nJSkE
                                                                                                                                                                                                            MD5:1E77310EF3277C93430D969FEAC8FDFC
                                                                                                                                                                                                            SHA1:173240337F249E2A6D54206AA0D0ACB0FDED12D7
                                                                                                                                                                                                            SHA-256:F316F2E03FD9ADE7EBBC0B154706848E2BB8FD568B90935109F0D8E3CE2B9BFE
                                                                                                                                                                                                            SHA-512:68F752DAF2DBEB79644337E4DB9B8CEAEAE3606A865EDC32BE16785DC97BDCF38EF200F0EDC86DC9D71ABA72E108D2851A510F0EB598FFEA286503F0C9772E5E
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:zipp-3.19.2.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..zipp-3.19.2.dist-info/LICENSE,sha256=htoPAa6uRjSKPD1GUZXcHOzN55956HdppkuNoEsqR0E,1023..zipp-3.19.2.dist-info/METADATA,sha256=UIrk_kMIHGSwsKKChYizqMw0MMZpPRZ2ZiVpQAsN_bE,3575..zipp-3.19.2.dist-info/RECORD,,..zipp-3.19.2.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..zipp-3.19.2.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92..zipp-3.19.2.dist-info/top_level.txt,sha256=iAbdoSHfaGqBfVb2XuR9JqSQHCoOsOtG6y9C_LSpqFw,5..zipp/__init__.py,sha256=QuI1g00G4fRAcGt-HqbV0oWIkmSgedCGGYsHHYzNa8A,13412..zipp/__pycache__/__init__.cpython-312.pyc,,..zipp/__pycache__/glob.cpython-312.pyc,,..zipp/compat/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..zipp/compat/__pycache__/__init__.cpython-312.pyc,,..zipp/compat/__pycache__/py310.cpython-312.pyc,,..zipp/compat/py310.py,sha256=eZpkW0zRtunkhEh8jjX3gCGe22emoKCBJw72Zt4RkhA,219..zipp/glob.py,sha256=etWpnfEoRyf

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\zipp-3.19.2.dist-info\WHEEL

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):92
                                                                                                                                                                                                            Entropy (8bit):4.812622295095324
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:RtEeX7MWcSlVlFxP+tPCCfA5S:RtBMwlVTxWBBf
                                                                                                                                                                                                            MD5:43136DDE7DD276932F6197BB6D676EF4
                                                                                                                                                                                                            SHA1:6B13C105452C519EA0B65AC1A975BD5E19C50122
                                                                                                                                                                                                            SHA-256:189EEDFE4581172C1B6A02B97A8F48A14C0B5BAA3239E4CA990FBD8871553714
                                                                                                                                                                                                            SHA-512:E7712BA7D36DEB083EBCC3B641AD3E7D19FB071EE64AE3A35AD6A50EE882B20CD2E60CA1319199DF12584FE311A6266EC74F96A3FB67E59F90C7B5909668AEE1
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Wheel-Version: 1.0.Generator: bdist_wheel (0.43.0).Root-Is-Purelib: true.Tag: py3-none-any..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\setuptools\_vendor\zipp-3.19.2.dist-info\top_level.txt

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):5
                                                                                                                                                                                                            Entropy (8bit):1.9219280948873623
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:m:m
                                                                                                                                                                                                            MD5:9B929466EC7848714DE24BCF75AE57CB
                                                                                                                                                                                                            SHA1:ECC9237295CDA9B690BE094E58FAE1458A4B0389
                                                                                                                                                                                                            SHA-256:8806DDA121DF686A817D56F65EE47D26A4901C2A0EB0EB46EB2F42FCB4A9A85C
                                                                                                                                                                                                            SHA-512:C8D8967BE2B5094A5D72BA4BEF5DBDA2CBF539BF3B8B916CF86854087A12DF82B51B7BF5B6EFA79898692EFD22FAD9688058448CAAB198FB708A0E661DC685EA
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:zipp.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\typeguard-4.3.0.dist-info\INSTALLER

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):4
                                                                                                                                                                                                            Entropy (8bit):1.5
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:Mn:M
                                                                                                                                                                                                            MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                            SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                            SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                            SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:pip.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\typeguard-4.3.0.dist-info\LICENSE

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:Unicode text, UTF-8 text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):1130
                                                                                                                                                                                                            Entropy (8bit):5.118590213496374
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:24:qt4rWHvH0yPP3Gt6Hw1hP9QHmsUv48OV/+dho3BoqxFB:/S/lPvKhlQHms5QK3WmFB
                                                                                                                                                                                                            MD5:F0E423EEA5C91E7AA21BDB70184B3E53
                                                                                                                                                                                                            SHA1:A51CCDCB7A9D8C2116D1DFC16F11B3C8A5830F67
                                                                                                                                                                                                            SHA-256:6163F7987DFB38D6BC320CE2B70B2F02B862BC41126516D552EF1CD43247E758
                                                                                                                                                                                                            SHA-512:8BE742880E6E8495C7EC4C9ECC8F076A9FC9D64FC84B3AEBBC8D2D10DC62AC2C5053F33B716212DCB76C886A9C51619F262C460FC4B39A335CE1AE2C9A8769A8
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:This is the MIT license: http://www.opensource.org/licenses/mit-license.php..Copyright (c) Alex Gr.nholm..Permission is hereby granted, free of charge, to any person obtaining a copy of this.software and associated documentation files (the "Software"), to deal in the Software.without restriction, including without limitation the rights to use, copy, modify, merge,.publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons.to whom the Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all copies or.substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,.INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR.PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE.FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF C

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\typeguard-4.3.0.dist-info\METADATA

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:Unicode text, UTF-8 text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):3717
                                                                                                                                                                                                            Entropy (8bit):4.986068381037722
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:96:DSQRbraktjaAckH94jQnJIK04Fak/grjspC3EklAJj:/Rakd4jA7ak/gvspNWmj
                                                                                                                                                                                                            MD5:B6DAAC02F66AC8403E9061881322BABE
                                                                                                                                                                                                            SHA1:9A94672CCFEA06156A5F8A321CD0626CFD233AE8
                                                                                                                                                                                                            SHA-256:CF675C1C0A744F08580855390DE87CC77D676B312582E8D4CFDB5BB8FD298D21
                                                                                                                                                                                                            SHA-512:9C6B7326C90396AA9E962C2731A1085EDB672B5696F95F552D13350843C09A246E0BBF0EC484862DFF434FA5A86DE4C0B7C963958ADE35A066B9D2384076DD47
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Metadata-Version: 2.1.Name: typeguard.Version: 4.3.0.Summary: Run-time type checker for Python.Author-email: Alex Gr.nholm <alex.gronholm@nextday.fi>.License: MIT.Project-URL: Documentation, https://typeguard.readthedocs.io/en/latest/.Project-URL: Change log, https://typeguard.readthedocs.io/en/latest/versionhistory.html.Project-URL: Source code, https://github.com/agronholm/typeguard.Project-URL: Issue tracker, https://github.com/agronholm/typeguard/issues.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Requires-Python: >=3.8.Description-Content

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\typeguard-4.3.0.dist-info\RECORD

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:CSV text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):2402
                                                                                                                                                                                                            Entropy (8bit):5.729208478282605
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:48:eDnuX3DVED9HDDeDfPDLkAosGDlDiVoBFj7XH0H3HuwVB6Kgfkx7J/Q1NK1cQyxk:eyX3WRHDiLPjksV7I47J/Q1U6Qyx5fsJ
                                                                                                                                                                                                            MD5:D680B2881597974ACD91750E5AB61010
                                                                                                                                                                                                            SHA1:E00ED2416B5CE21641E3946905504D62D536972F
                                                                                                                                                                                                            SHA-256:48A51959582478352275428CEECD78EF77D79AC9DAE796E39A2EAF2540282552
                                                                                                                                                                                                            SHA-512:112172ACB515B0712AC58D78898EB159580ADA3DD3F16AABB37CB7A8D964F9E4BADF2869A245927B83B208D56904831C0F04ED925C95DFCB705801734FB0C7BA
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:typeguard-4.3.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..typeguard-4.3.0.dist-info/LICENSE,sha256=YWP3mH37ONa8MgzitwsvArhivEESZRbVUu8c1DJH51g,1130..typeguard-4.3.0.dist-info/METADATA,sha256=z2dcHAp0TwhYCFU5Deh8x31nazElgujUz9tbuP0pjSE,3717..typeguard-4.3.0.dist-info/RECORD,,..typeguard-4.3.0.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92..typeguard-4.3.0.dist-info/entry_points.txt,sha256=qp7NQ1aLtiSgMQqo6gWlfGpy0IIXzoMJmeQTLpzqFZQ,48..typeguard-4.3.0.dist-info/top_level.txt,sha256=4z28AhuDodwRS_c1J_l8H51t5QuwfTseskYzlxp6grs,10..typeguard/__init__.py,sha256=Onh4w38elPCjtlcU3JY9k3h70NjsxXIkAflmQn-Z0FY,2071..typeguard/__pycache__/__init__.cpython-312.pyc,,..typeguard/__pycache__/_checkers.cpython-312.pyc,,..typeguard/__pycache__/_config.cpython-312.pyc,,..typeguard/__pycache__/_decorators.cpython-312.pyc,,..typeguard/__pycache__/_exceptions.cpython-312.pyc,,..typeguard/__pycache__/_functions.cpython-312.pyc,,..typeguard/__pycache__/_i

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\typeguard-4.3.0.dist-info\WHEEL

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):92
                                                                                                                                                                                                            Entropy (8bit):4.812622295095324
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:RtEeX7MWcSlVlFxP+tPCCfA5S:RtBMwlVTxWBBf
                                                                                                                                                                                                            MD5:43136DDE7DD276932F6197BB6D676EF4
                                                                                                                                                                                                            SHA1:6B13C105452C519EA0B65AC1A975BD5E19C50122
                                                                                                                                                                                                            SHA-256:189EEDFE4581172C1B6A02B97A8F48A14C0B5BAA3239E4CA990FBD8871553714
                                                                                                                                                                                                            SHA-512:E7712BA7D36DEB083EBCC3B641AD3E7D19FB071EE64AE3A35AD6A50EE882B20CD2E60CA1319199DF12584FE311A6266EC74F96A3FB67E59F90C7B5909668AEE1
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Wheel-Version: 1.0.Generator: bdist_wheel (0.43.0).Root-Is-Purelib: true.Tag: py3-none-any..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\typeguard-4.3.0.dist-info\entry_points.txt

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):48
                                                                                                                                                                                                            Entropy (8bit):4.155187698990101
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:mWSJCQEjMitjHfLvn:mrMJHfbn
                                                                                                                                                                                                            MD5:AEAB5BCF8BF89A51C97C4CDF70578848
                                                                                                                                                                                                            SHA1:2E9C1617560AB66431AAB90700DB901985293485
                                                                                                                                                                                                            SHA-256:AA9ECD43568BB624A0310AA8EA05A57C6A72D08217CE830999E4132E9CEA1594
                                                                                                                                                                                                            SHA-512:2BE73E99296DF26A28835F91DD8BC50EB104AF06A3C54666175FAF322E0AD4620453DB0388531C4113B052A92C1D2E4C3088E25AF43CDE42AA852CF7B0CB5B05
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:[pytest11].typeguard = typeguard._pytest_plugin.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\typeguard-4.3.0.dist-info\top_level.txt

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):10
                                                                                                                                                                                                            Entropy (8bit):3.321928094887362
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:LEJn:M
                                                                                                                                                                                                            MD5:004A2A8CE1AB120A63902A27D76BD964
                                                                                                                                                                                                            SHA1:A4E367AB40410598DADD1FC5F680ED7A176BEB09
                                                                                                                                                                                                            SHA-256:E33DBC021B83A1DC114BF73527F97C1F9D6DE50BB07D3B1EB24633971A7A82BB
                                                                                                                                                                                                            SHA-512:0D8FF9A43897AB390AB41AFE5BAC8BD38A68C2BEF88E844E5B49BF70E3164B226975CC2717AE3DC3428D1CFBB0BE068C243F104915FEE1FFA58C23FBE76FDB89
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:typeguard.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\unicodedata.pyd

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):302872
                                                                                                                                                                                                            Entropy (8bit):7.986490052260418
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:6144:EtX6biS7ltWh4BvaEyS+KPUR30JlSEwV7hqoUnJG4qKOF6J:EZLS5YiyEFPPl3yqrJG4V06J
                                                                                                                                                                                                            MD5:71A9251C68EE8772F514ADAEA332E20D
                                                                                                                                                                                                            SHA1:3392737A6869B4DA869D2A0B9C597DC1355915C4
                                                                                                                                                                                                            SHA-256:8419E45441A5967C8156DA0A2A5866CB09D04CD566F8113255C930B7351F50EB
                                                                                                                                                                                                            SHA-512:4EC0B64E8ED9153305705FB247C918631EAF4407DAF20CCFB60A325EEE7485F856ADD080FB5B676A48D845E943C30A13A44671F74CD8A6A096CBD81F49F0E418
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 3%
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w...3m..3m..3m..:...5m......1m......>m......;m......0m......0m..x...1m..3m..cm......2m......2m....j.2m......2m..Rich3m..................PE..d...]..e.........." ...#.`.......0.......@................................................`.............................................X....................@..........................................................@...........................................UPX0.....0..............................UPX1.....`...@...^..................@....rsrc................b..............@......................................................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\wheel-0.43.0.dist-info\INSTALLER

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):4
                                                                                                                                                                                                            Entropy (8bit):1.5
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:Mn:M
                                                                                                                                                                                                            MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                            SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                            SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                            SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:pip.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\wheel-0.43.0.dist-info\LICENSE.txt

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):1107
                                                                                                                                                                                                            Entropy (8bit):5.115074330424529
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:24:PWmrRONJHLH0cPP3gtkHw1h39QHOsUv4eOk4/+jvho3nPz:ttONJbbvE/NQHOs5eNS3n7
                                                                                                                                                                                                            MD5:7FFB0DB04527CFE380E4F2726BD05EBF
                                                                                                                                                                                                            SHA1:5B39C45A91A556E5F1599604F1799E4027FA0E60
                                                                                                                                                                                                            SHA-256:30C23618679108F3E8EA1D2A658C7CA417BDFC891C98EF1A89FA4FF0C9828654
                                                                                                                                                                                                            SHA-512:205F284F3A7E8E696C70ED7B856EE98C1671C68893F0952EEC40915A383BC452B99899BDC401F9FE161A1BF9B6E2CEA3BCD90615EEE9173301657A2CE4BAFE14
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:MIT License..Copyright (c) 2012 Daniel Holth <dholth@fastmail.fm> and contributors..Permission is hereby granted, free of charge, to any person obtaining a.copy of this software and associated documentation files (the "Software"),.to deal in the Software without restriction, including without limitation.the rights to use, copy, modify, merge, publish, distribute, sublicense,.and/or sell copies of the Software, and to permit persons to whom the.Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included.in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL.THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR.OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERW

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\wheel-0.43.0.dist-info\METADATA

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:Unicode text, UTF-8 text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):2153
                                                                                                                                                                                                            Entropy (8bit):5.088249746074878
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:48:DEhpFu5MktjaywDK48d+md+7uT8RfkD1UKd+mOl1Awry:DEhpiMktjayq/7kOfsUzmbYy
                                                                                                                                                                                                            MD5:EBEA27DA14E3F453119DC72D84343E8C
                                                                                                                                                                                                            SHA1:7CEB6DBE498B69ABF4087637C6F500742FF7E2B4
                                                                                                                                                                                                            SHA-256:59BAC22B00A59D3E5608A56B8CF8EFC43831A36B72792EE4389C9CD4669C7841
                                                                                                                                                                                                            SHA-512:A41593939B9325D40CB67FD3F41CD1C9E9978F162487FB469094C41440B5F48016B9A66BE2E6E4A0406D6EEDB25CE4F5A860BA1E3DC924B81F63CEEE3AE31117
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Metadata-Version: 2.1.Name: wheel.Version: 0.43.0.Summary: A built-package format for Python.Keywords: wheel,packaging.Author-email: Daniel Holth <dholth@fastmail.fm>.Maintainer-email: Alex Gr.nholm <alex.gronholm@nextday.fi>.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: Topic :: System :: Archiving :: Packaging.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Requires-Dist: pytest >= 6.0.0 ; extra == "test".Requires-Dist: setuptools >= 65 ; extra == "test".Project-URL: Changelog, https://wheel.readthedocs.io/en/s

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\wheel-0.43.0.dist-info\RECORD

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:CSV text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):4557
                                                                                                                                                                                                            Entropy (8bit):5.714200636114494
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:96:QXVuEmegx01TQIvFCiq9H/H7vp88FxTXiJPkGJP4CWweXQHmnDpMI78IegK5EeZR:QXVxAbYkU4CWweXQHmnDpMeV2BvTRqQF
                                                                                                                                                                                                            MD5:44D352C4997560C7BFB82D9360F5985A
                                                                                                                                                                                                            SHA1:BE58C7B8AB32790384E4E4F20865C4A88414B67A
                                                                                                                                                                                                            SHA-256:783E654742611AF88CD9F00BF01A431A219DB536556E63FF981C7BD673070AC9
                                                                                                                                                                                                            SHA-512:281B1D939A560E6A08D0606E5E8CE15F086B4B45738AB41ED6B5821968DC8D764CD6B25DB6BA562A07018C271ABF17A6BC5A380FAD05696ADF1D11EE2C5749C8
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:../../bin/wheel,sha256=cT2EHbrv-J-UyUXu26cDY-0I7RgcruysJeHFanT1Xfo,249..wheel-0.43.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..wheel-0.43.0.dist-info/LICENSE.txt,sha256=MMI2GGeRCPPo6h0qZYx8pBe9_IkcmO8aifpP8MmChlQ,1107..wheel-0.43.0.dist-info/METADATA,sha256=WbrCKwClnT5WCKVrjPjvxDgxo2tyeS7kOJyc1GaceEE,2153..wheel-0.43.0.dist-info/RECORD,,..wheel-0.43.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..wheel-0.43.0.dist-info/WHEEL,sha256=EZbGkh7Ie4PoZfRQ8I0ZuP9VklN_TvcZ6DSE5Uar4z4,81..wheel-0.43.0.dist-info/entry_points.txt,sha256=rTY1BbkPHhkGMm4Q3F0pIzJBzW2kMxoG1oriffvGdA0,104..wheel/__init__.py,sha256=D6jhH00eMzbgrXGAeOwVfD5i-lCAMMycuG1L0useDlo,59..wheel/__main__.py,sha256=NkMUnuTCGcOkgY0IBLgBCVC_BGGcWORx2K8jYGS12UE,455..wheel/__pycache__/__init__.cpython-312.pyc,,..wheel/__pycache__/__main__.cpython-312.pyc,,..wheel/__pycache__/_setuptools_logging.cpython-312.pyc,,..wheel/__pycache__/bdist_wheel.cpython-312.pyc,,..wheel/__pycache

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\wheel-0.43.0.dist-info\WHEEL

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):81
                                                                                                                                                                                                            Entropy (8bit):4.672346887071811
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:RtEeX/QFM+vxP+tPCCfA5I:Rt1Qq2WBB3
                                                                                                                                                                                                            MD5:24019423EA7C0C2DF41C8272A3791E7B
                                                                                                                                                                                                            SHA1:AAE9ECFB44813B68CA525BA7FA0D988615399C86
                                                                                                                                                                                                            SHA-256:1196C6921EC87B83E865F450F08D19B8FF5592537F4EF719E83484E546ABE33E
                                                                                                                                                                                                            SHA-512:09AB8E4DAA9193CFDEE6CF98CCAE9DB0601F3DCD4944D07BF3AE6FA5BCB9DC0DCAFD369DE9A650A38D1B46C758DB0721EBA884446A8A5AD82BB745FD5DB5F9B1
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:Wheel-Version: 1.0.Generator: flit 3.9.0.Root-Is-Purelib: true.Tag: py3-none-any.

                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63882\wheel-0.43.0.dist-info\entry_points.txt

                                                                                                                                                                                                            Download File
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):104
                                                                                                                                                                                                            Entropy (8bit):4.271713330022269
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:1SSAnAYgh+MWTMhk6WjrAM5t5ln:1Jb9WTMhk9jUM5t5ln
                                                                                                                                                                                                            MD5:6180E17C30BAE5B30DB371793FCE0085
                                                                                                                                                                                                            SHA1:E3A12C421562A77D90A13D8539A3A0F4D3228359
                                                                                                                                                                                                            SHA-256:AD363505B90F1E1906326E10DC5D29233241CD6DA4331A06D68AE27DFBC6740D
                                                                                                                                                                                                            SHA-512:69EAE7B1E181D7BA1D3E2864D31E1320625A375E76D3B2FBF8856B3B6515936ACE3138D4D442CABDE7576FCFBCBB0DEED054D90B95CFA1C99829DB12A9031E26
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Preview:[console_scripts].wheel=wheel.cli:main..[distutils.commands].bdist_wheel=wheel.bdist_wheel:bdist_wheel..

                                                                                                                                                                                                            Static File Info

                                                                                                                                                                                                            General

                                                                                                                                                                                                            File type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                            Entropy (8bit):7.994844285042161
                                                                                                                                                                                                            TrID:
                                                                                                                                                                                                            • Win64 Executable GUI (202006/5) 92.65%
                                                                                                                                                                                                            • Win64 Executable (generic) (12005/4) 5.51%
                                                                                                                                                                                                            • Generic Win/DOS Executable (2004/3) 0.92%
                                                                                                                                                                                                            • DOS Executable Generic (2002/1) 0.92%
                                                                                                                                                                                                            • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                            File name:tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            File size:14'451'360 bytes
                                                                                                                                                                                                            MD5:0d471709feba575823c5d89293bddf62
                                                                                                                                                                                                            SHA1:23a969daff09442e725aafa81864c6eeae706cfb
                                                                                                                                                                                                            SHA256:eec8d8dbdc517184ddfa7353ed89e4ac4d2e6c2fefef2a8c4e2c81bb4b6a9047
                                                                                                                                                                                                            SHA512:521dc58da370ba77b54b6e93d1e8750354f5f7fee14f9c72d78741228dde1060489d2be06f3b4e9fa3e9a55349f4ca6ca43c66f74e7d2f499f8f2cd288d200d5
                                                                                                                                                                                                            SSDEEP:393216:m92LWeftByxjZL+9qzgAD7fEUNPOjMR+0:qstAjF+9qcK7fEYRr
                                                                                                                                                                                                            TLSH:A3E6332CA6E10A97F989103D9F56EC6DD552BC612B94C59F32FD316E1E2F2C4CC26E20
                                                                                                                                                                                                            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Zpc.Zpc.Zpc...`.]pc...f..pc...g.Ppc.....Ypc...`.Spc...g.Kpc...f.rpc...b.Qpc.Zpb..pc.O.g.Cpc.O.a.[pc.RichZpc.........PE..d..

                                                                                                                                                                                                            File Icon

                                                                                                                                                                                                            Icon Hash:0761a594a6c56317

                                                                                                                                                                                                            Static PE Info

                                                                                                                                                                                                            General

                                                                                                                                                                                                            Entrypoint:0x14000cdb0
                                                                                                                                                                                                            Entrypoint Section:.text
                                                                                                                                                                                                            Digitally signed:true
                                                                                                                                                                                                            Imagebase:0x140000000
                                                                                                                                                                                                            Subsystem:windows gui
                                                                                                                                                                                                            Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                                                                                                                                                                            DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                            Time Stamp:0x6740A02D [Fri Nov 22 15:15:57 2024 UTC]
                                                                                                                                                                                                            TLS Callbacks:
                                                                                                                                                                                                            CLR (.Net) Version:
                                                                                                                                                                                                            OS Version Major:6
                                                                                                                                                                                                            OS Version Minor:0
                                                                                                                                                                                                            File Version Major:6
                                                                                                                                                                                                            File Version Minor:0
                                                                                                                                                                                                            Subsystem Version Major:6
                                                                                                                                                                                                            Subsystem Version Minor:0
                                                                                                                                                                                                            Import Hash:72c4e339b7af8ab1ed2eb3821c98713a

                                                                                                                                                                                                            Authenticode Signature

                                                                                                                                                                                                            Signature Valid:true
                                                                                                                                                                                                            Signature Issuer:CN=GlobalSign GCC R45 EV CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
                                                                                                                                                                                                            Signature Validation Error:The operation completed successfully
                                                                                                                                                                                                            Error Number:0
                                                                                                                                                                                                            Not Before, Not After
                                                                                                                                                                                                            • 11/03/2024 03:54:22 12/03/2025 03:54:22
                                                                                                                                                                                                            Subject Chain
                                                                                                                                                                                                            • CN="Nine Rivers Sky Roar Commit Trade Co., Ltd.", O="Nine Rivers Sky Roar Commit Trade Co., Ltd.", L=Jiujiang, S=Jiangxi, C=CN, OID.1.3.6.1.4.1.311.60.2.1.1=Jiujiang, OID.1.3.6.1.4.1.311.60.2.1.2=Jiangxi, OID.1.3.6.1.4.1.311.60.2.1.3=CN, SERIALNUMBER=91360402MACHADCC93, OID.2.5.4.15=Private Organization
                                                                                                                                                                                                            Version:3
                                                                                                                                                                                                            Thumbprint MD5:4E0565C4F6C07E840699BFFCEE8DD860
                                                                                                                                                                                                            Thumbprint SHA-1:2DAE7C97B1CE082B6FA5B6CC0786BAD87AFEF563
                                                                                                                                                                                                            Thumbprint SHA-256:79B622C069BAB2F8C1A6D838E61F062D8486C32D469980AF9BF7BC2E0DF9062F
                                                                                                                                                                                                            Serial:01F61D5311CEDD61DEE28CAA

                                                                                                                                                                                                            Entrypoint Preview

                                                                                                                                                                                                            Instruction
                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                            sub esp, 28h
                                                                                                                                                                                                            call 00007FC868EDAF5Ch
                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                            add esp, 28h
                                                                                                                                                                                                            jmp 00007FC868EDAB7Fh
                                                                                                                                                                                                            int3
                                                                                                                                                                                                            int3
                                                                                                                                                                                                            int3
                                                                                                                                                                                                            int3
                                                                                                                                                                                                            int3
                                                                                                                                                                                                            int3
                                                                                                                                                                                                            int3
                                                                                                                                                                                                            int3
                                                                                                                                                                                                            int3
                                                                                                                                                                                                            int3
                                                                                                                                                                                                            int3
                                                                                                                                                                                                            int3
                                                                                                                                                                                                            int3
                                                                                                                                                                                                            int3
                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                            sub esp, 28h
                                                                                                                                                                                                            call 00007FC868EDB328h
                                                                                                                                                                                                            test eax, eax
                                                                                                                                                                                                            je 00007FC868EDAD23h
                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                            mov eax, dword ptr [00000030h]
                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                            mov ecx, dword ptr [eax+08h]
                                                                                                                                                                                                            jmp 00007FC868EDAD07h
                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                            cmp ecx, eax
                                                                                                                                                                                                            je 00007FC868EDAD16h
                                                                                                                                                                                                            xor eax, eax
                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                            cmpxchg dword ptr [0003577Ch], ecx
                                                                                                                                                                                                            jne 00007FC868EDACF0h
                                                                                                                                                                                                            xor al, al
                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                            add esp, 28h
                                                                                                                                                                                                            ret
                                                                                                                                                                                                            mov al, 01h
                                                                                                                                                                                                            jmp 00007FC868EDACF9h
                                                                                                                                                                                                            int3
                                                                                                                                                                                                            int3
                                                                                                                                                                                                            int3
                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                            sub esp, 28h
                                                                                                                                                                                                            test ecx, ecx
                                                                                                                                                                                                            jne 00007FC868EDAD09h
                                                                                                                                                                                                            mov byte ptr [00035765h], 00000001h
                                                                                                                                                                                                            call 00007FC868EDA455h
                                                                                                                                                                                                            call 00007FC868EDB740h
                                                                                                                                                                                                            test al, al
                                                                                                                                                                                                            jne 00007FC868EDAD06h
                                                                                                                                                                                                            xor al, al
                                                                                                                                                                                                            jmp 00007FC868EDAD16h
                                                                                                                                                                                                            call 00007FC868EE825Fh
                                                                                                                                                                                                            test al, al
                                                                                                                                                                                                            jne 00007FC868EDAD0Bh
                                                                                                                                                                                                            xor ecx, ecx
                                                                                                                                                                                                            call 00007FC868EDB750h
                                                                                                                                                                                                            jmp 00007FC868EDACECh
                                                                                                                                                                                                            mov al, 01h
                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                            add esp, 28h
                                                                                                                                                                                                            ret
                                                                                                                                                                                                            int3
                                                                                                                                                                                                            int3
                                                                                                                                                                                                            inc eax
                                                                                                                                                                                                            push ebx
                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                            sub esp, 20h
                                                                                                                                                                                                            cmp byte ptr [0003572Ch], 00000000h
                                                                                                                                                                                                            mov ebx, ecx
                                                                                                                                                                                                            jne 00007FC868EDAD69h
                                                                                                                                                                                                            cmp ecx, 01h
                                                                                                                                                                                                            jnbe 00007FC868EDAD6Ch
                                                                                                                                                                                                            call 00007FC868EDB29Eh
                                                                                                                                                                                                            test eax, eax
                                                                                                                                                                                                            je 00007FC868EDAD2Ah
                                                                                                                                                                                                            test ebx, ebx
                                                                                                                                                                                                            jne 00007FC868EDAD26h
                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                            lea ecx, dword ptr [00035716h]
                                                                                                                                                                                                            call 00007FC868EE8052h

                                                                                                                                                                                                            Data Directories

                                                                                                                                                                                                            NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_IMPORT0x3ca5c0x78.rdata
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_RESOURCE0x470000x1ffd5.rsrc
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x440000x2250.pdata
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_SECURITY0xdc59700x2930
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_BASERELOC0x670000x764.reloc
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_DEBUG0x3a0800x1c.rdata
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x39f400x140.rdata
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_IAT0x2b0000x4a0.rdata
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                            Sections

                                                                                                                                                                                                            NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                            .text0x10000x29f000x2a000a6c3b829cc8eaabb1a474c227e90407fFalse0.5514206659226191data6.487493643901088IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                            .rdata0x2b0000x12a500x12c005af8068c0c981edd4ab115cacb8b8373False0.5245182291666667data5.752737698225504IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                            .data0x3e0000x53f80xe00dba0caeecab624a0ccc0d577241601d1False0.134765625data1.8392217063172436IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                            .pdata0x440000x22500x2400181312260a85d10a1454ba38901c499bFalse0.4705946180555556data5.290347578351011IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                            .rsrc0x470000x1ffd50x200001f0a120a853ec003d8477f6b642ac27fFalse0.30507659912109375data6.143652768124741IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                            .reloc0x670000x7640x800816c68eeb419ee2c08656c31c06a0fffFalse0.5576171875data5.2809528666624175IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                            Resources

                                                                                                                                                                                                            NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                            RT_ICON0x472940x47fePNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced1.0006511123168746
                                                                                                                                                                                                            RT_ICON0x4ba940x10828Device independent bitmap graphic, 128 x 256 x 32, image size 655360.1220424701289483
                                                                                                                                                                                                            RT_ICON0x5c2bc0x4228Device independent bitmap graphic, 64 x 128 x 32, image size 163840.21522201228153046
                                                                                                                                                                                                            RT_ICON0x604e40x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 92160.2796680497925311
                                                                                                                                                                                                            RT_ICON0x62a8c0x1a68Device independent bitmap graphic, 40 x 80 x 32, image size 64000.3235207100591716
                                                                                                                                                                                                            RT_ICON0x644f40x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 40960.3829737335834897
                                                                                                                                                                                                            RT_ICON0x6559c0x988Device independent bitmap graphic, 24 x 48 x 32, image size 23040.47090163934426227
                                                                                                                                                                                                            RT_ICON0x65f240x6b8Device independent bitmap graphic, 20 x 40 x 32, image size 16000.5459302325581395
                                                                                                                                                                                                            RT_ICON0x665dc0x468Device independent bitmap graphic, 16 x 32 x 32, image size 10240.5975177304964538
                                                                                                                                                                                                            RT_GROUP_ICON0x66a440x84data0.7121212121212122
                                                                                                                                                                                                            RT_MANIFEST0x66ac80x50dXML 1.0 document, ASCII text0.4694508894044857

                                                                                                                                                                                                            Imports

                                                                                                                                                                                                            DLLImport
                                                                                                                                                                                                            USER32.dllCreateWindowExW, ShutdownBlockReasonCreate, MsgWaitForMultipleObjects, ShowWindow, DestroyWindow, RegisterClassW, DefWindowProcW, PeekMessageW, DispatchMessageW, TranslateMessage, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
                                                                                                                                                                                                            COMCTL32.dll
                                                                                                                                                                                                            KERNEL32.dllGetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, SetEnvironmentVariableW, FlushFileBuffers, GetCurrentDirectoryW, LCMapStringW, CompareStringW, FlsFree, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, FormatMessageW, GetLastError, GetModuleFileNameW, LoadLibraryExW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, GetEnvironmentStringsW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, DeleteFileW, FindClose, FindFirstFileW, FindNextFileW, GetDriveTypeW, RemoveDirectoryW, GetTempPathW, CloseHandle, QueryPerformanceCounter, QueryPerformanceFrequency, WaitForSingleObject, Sleep, GetCurrentProcess, TerminateProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LocalFree, SetConsoleCtrlHandler, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, FlsSetValue, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, CreateDirectoryW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue
                                                                                                                                                                                                            ADVAPI32.dllOpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
                                                                                                                                                                                                            GDI32.dllSelectObject, DeleteObject, CreateFontIndirectW

                                                                                                                                                                                                            Network Behavior

                                                                                                                                                                                                            Network Port Distribution

                                                                                                                                                                                                            TCP Packets

                                                                                                                                                                                                            TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                            Nov 23, 2024 10:32:11.846021891 CET49711443192.168.2.5104.21.35.75
                                                                                                                                                                                                            Nov 23, 2024 10:32:11.846069098 CET44349711104.21.35.75192.168.2.5
                                                                                                                                                                                                            Nov 23, 2024 10:32:11.846141100 CET49711443192.168.2.5104.21.35.75
                                                                                                                                                                                                            Nov 23, 2024 10:32:11.846673012 CET49711443192.168.2.5104.21.35.75
                                                                                                                                                                                                            Nov 23, 2024 10:32:11.846690893 CET44349711104.21.35.75192.168.2.5
                                                                                                                                                                                                            Nov 23, 2024 10:32:13.067133904 CET44349711104.21.35.75192.168.2.5
                                                                                                                                                                                                            Nov 23, 2024 10:32:13.067821026 CET49711443192.168.2.5104.21.35.75
                                                                                                                                                                                                            Nov 23, 2024 10:32:13.067862988 CET44349711104.21.35.75192.168.2.5
                                                                                                                                                                                                            Nov 23, 2024 10:32:13.069842100 CET44349711104.21.35.75192.168.2.5
                                                                                                                                                                                                            Nov 23, 2024 10:32:13.069930077 CET49711443192.168.2.5104.21.35.75
                                                                                                                                                                                                            Nov 23, 2024 10:32:13.071407080 CET49711443192.168.2.5104.21.35.75
                                                                                                                                                                                                            Nov 23, 2024 10:32:13.071590900 CET49711443192.168.2.5104.21.35.75
                                                                                                                                                                                                            Nov 23, 2024 10:32:13.071598053 CET44349711104.21.35.75192.168.2.5
                                                                                                                                                                                                            Nov 23, 2024 10:32:13.071666002 CET49711443192.168.2.5104.21.35.75

                                                                                                                                                                                                            UDP Packets

                                                                                                                                                                                                            TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                            Nov 23, 2024 10:32:11.490036011 CET5465253192.168.2.51.1.1.1
                                                                                                                                                                                                            Nov 23, 2024 10:32:11.832123041 CET53546521.1.1.1192.168.2.5

                                                                                                                                                                                                            DNS Queries

                                                                                                                                                                                                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                            Nov 23, 2024 10:32:11.490036011 CET192.168.2.51.1.1.10xb235Standard query (0)steamcomunty.comA (IP address)IN (0x0001)false

                                                                                                                                                                                                            DNS Answers

                                                                                                                                                                                                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                            Nov 23, 2024 10:32:11.832123041 CET1.1.1.1192.168.2.50xb235No error (0)steamcomunty.com104.21.35.75A (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 23, 2024 10:32:11.832123041 CET1.1.1.1192.168.2.50xb235No error (0)steamcomunty.com172.67.215.222A (IP address)IN (0x0001)false

                                                                                                                                                                                                            Statistics

                                                                                                                                                                                                            CPU Usage

                                                                                                                                                                                                            Click to jump to process

                                                                                                                                                                                                            Memory Usage

                                                                                                                                                                                                            Click to jump to process

                                                                                                                                                                                                            High Level Behavior Distribution

                                                                                                                                                                                                            Click to dive into process behavior distribution

                                                                                                                                                                                                            Behavior

                                                                                                                                                                                                            Click to jump to process

                                                                                                                                                                                                            System Behavior

                                                                                                                                                                                                            General

                                                                                                                                                                                                            Target ID:0
                                                                                                                                                                                                            Start time:04:32:03
                                                                                                                                                                                                            Start date:23/11/2024
                                                                                                                                                                                                            Path:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                            Commandline:"C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe"
                                                                                                                                                                                                            Imagebase:0x7ff6e2150000
                                                                                                                                                                                                            File size:14'451'360 bytes
                                                                                                                                                                                                            MD5 hash:0D471709FEBA575823C5D89293BDDF62
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                            General

                                                                                                                                                                                                            Target ID:2
                                                                                                                                                                                                            Start time:04:32:06
                                                                                                                                                                                                            Start date:23/11/2024
                                                                                                                                                                                                            Path:C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                            Commandline:"C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe"
                                                                                                                                                                                                            Imagebase:0x7ff6e2150000
                                                                                                                                                                                                            File size:14'451'360 bytes
                                                                                                                                                                                                            MD5 hash:0D471709FEBA575823C5D89293BDDF62
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                            Disassembly

                                                                                                                                                                                                            Reset < >

                                                                                                                                                                                                              Execution Graph

                                                                                                                                                                                                              Execution Coverage:9.6%
                                                                                                                                                                                                              Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                              Signature Coverage:14.9%
                                                                                                                                                                                                              Total number of Nodes:2000
                                                                                                                                                                                                              Total number of Limit Nodes:25
                                                                                                                                                                                                              execution_graph 19133 7ff6e217abe3 19134 7ff6e217abf3 19133->19134 19137 7ff6e2165478 LeaveCriticalSection 19134->19137 18871 7ff6e2169961 18872 7ff6e216a3d8 45 API calls 18871->18872 18873 7ff6e2169966 18872->18873 18874 7ff6e216998d GetModuleHandleW 18873->18874 18875 7ff6e21699d7 18873->18875 18874->18875 18881 7ff6e216999a 18874->18881 18883 7ff6e2169864 18875->18883 18881->18875 18897 7ff6e2169a88 GetModuleHandleExW 18881->18897 18903 7ff6e21702d8 EnterCriticalSection 18883->18903 18898 7ff6e2169abc GetProcAddress 18897->18898 18899 7ff6e2169ae5 18897->18899 18902 7ff6e2169ace 18898->18902 18900 7ff6e2169aea FreeLibrary 18899->18900 18901 7ff6e2169af1 18899->18901 18900->18901 18901->18875 18902->18899 18924 7ff6e215bae0 18925 7ff6e215bb0e 18924->18925 18926 7ff6e215baf5 18924->18926 18926->18925 18928 7ff6e216d5fc 12 API calls 18926->18928 18927 7ff6e215bb6e 18928->18927 18987 7ff6e217ad69 18990 7ff6e2165478 LeaveCriticalSection 18987->18990 16082 7ff6e215cc3c 16103 7ff6e215ce0c 16082->16103 16085 7ff6e215cd88 16257 7ff6e215d12c IsProcessorFeaturePresent 16085->16257 16086 7ff6e215cc58 __scrt_acquire_startup_lock 16088 7ff6e215cd92 16086->16088 16095 7ff6e215cc76 __scrt_release_startup_lock 16086->16095 16089 7ff6e215d12c 7 API calls 16088->16089 16091 7ff6e215cd9d _CreateFrameInfo 16089->16091 16090 7ff6e215cc9b 16092 7ff6e215cd21 16109 7ff6e215d274 16092->16109 16094 7ff6e215cd26 16112 7ff6e2151000 16094->16112 16095->16090 16095->16092 16246 7ff6e2169b2c 16095->16246 16100 7ff6e215cd49 16100->16091 16253 7ff6e215cf90 16100->16253 16104 7ff6e215ce14 16103->16104 16105 7ff6e215ce20 __scrt_dllmain_crt_thread_attach 16104->16105 16106 7ff6e215ce2d 16105->16106 16107 7ff6e215cc50 16105->16107 16106->16107 16264 7ff6e215d888 16106->16264 16107->16085 16107->16086 16291 7ff6e217a4d0 16109->16291 16111 7ff6e215d28b GetStartupInfoW 16111->16094 16113 7ff6e2151009 16112->16113 16293 7ff6e2165484 16113->16293 16115 7ff6e21537fb 16300 7ff6e21536b0 16115->16300 16119 7ff6e215c550 _log10_special 8 API calls 16121 7ff6e2153ca7 16119->16121 16251 7ff6e215d2b8 GetModuleHandleW 16121->16251 16122 7ff6e215391b 16469 7ff6e21545c0 16122->16469 16123 7ff6e215383c 16460 7ff6e2151c80 16123->16460 16127 7ff6e215385b 16372 7ff6e2158830 16127->16372 16128 7ff6e215396a 16492 7ff6e2152710 16128->16492 16132 7ff6e215388e 16139 7ff6e21538bb __vcrt_freefls 16132->16139 16464 7ff6e21589a0 16132->16464 16133 7ff6e215395d 16134 7ff6e2153962 16133->16134 16135 7ff6e2153984 16133->16135 16488 7ff6e216004c 16134->16488 16138 7ff6e2151c80 49 API calls 16135->16138 16140 7ff6e21539a3 16138->16140 16141 7ff6e2158830 14 API calls 16139->16141 16149 7ff6e21538de __vcrt_freefls 16139->16149 16144 7ff6e2151950 115 API calls 16140->16144 16141->16149 16143 7ff6e2153a0b 16145 7ff6e21589a0 40 API calls 16143->16145 16146 7ff6e21539ce 16144->16146 16147 7ff6e2153a17 16145->16147 16146->16127 16148 7ff6e21539de 16146->16148 16150 7ff6e21589a0 40 API calls 16147->16150 16151 7ff6e2152710 54 API calls 16148->16151 16154 7ff6e215390e __vcrt_freefls 16149->16154 16503 7ff6e2158940 16149->16503 16152 7ff6e2153a23 16150->16152 16160 7ff6e2153808 __vcrt_freefls 16151->16160 16153 7ff6e21589a0 40 API calls 16152->16153 16153->16154 16155 7ff6e2158830 14 API calls 16154->16155 16156 7ff6e2153a3b 16155->16156 16157 7ff6e2153b2f 16156->16157 16158 7ff6e2153a60 __vcrt_freefls 16156->16158 16159 7ff6e2152710 54 API calls 16157->16159 16161 7ff6e2158940 40 API calls 16158->16161 16169 7ff6e2153aab 16158->16169 16159->16160 16160->16119 16161->16169 16162 7ff6e2158830 14 API calls 16163 7ff6e2153bf4 __vcrt_freefls 16162->16163 16164 7ff6e2153c46 16163->16164 16165 7ff6e2153d41 16163->16165 16166 7ff6e2153cd4 16164->16166 16167 7ff6e2153c50 16164->16167 16510 7ff6e21544e0 16165->16510 16171 7ff6e2158830 14 API calls 16166->16171 16385 7ff6e21590e0 16167->16385 16169->16162 16174 7ff6e2153ce0 16171->16174 16172 7ff6e2153d4f 16175 7ff6e2153d65 16172->16175 16176 7ff6e2153d71 16172->16176 16177 7ff6e2153c61 16174->16177 16181 7ff6e2153ced 16174->16181 16513 7ff6e2154630 16175->16513 16179 7ff6e2151c80 49 API calls 16176->16179 16184 7ff6e2152710 54 API calls 16177->16184 16190 7ff6e2153cc8 __vcrt_freefls 16179->16190 16185 7ff6e2151c80 49 API calls 16181->16185 16182 7ff6e2153dbc 16435 7ff6e2159390 16182->16435 16184->16160 16187 7ff6e2153d0b 16185->16187 16187->16190 16191 7ff6e2153d12 16187->16191 16188 7ff6e2153da7 LoadLibraryExW 16188->16182 16189 7ff6e2153dcf SetDllDirectoryW 16194 7ff6e2153e02 16189->16194 16236 7ff6e2153e52 16189->16236 16190->16182 16190->16188 16192 7ff6e2152710 54 API calls 16191->16192 16192->16160 16196 7ff6e2158830 14 API calls 16194->16196 16195 7ff6e2154000 16198 7ff6e215400a PostMessageW GetMessageW 16195->16198 16199 7ff6e215402d 16195->16199 16202 7ff6e2153e0e __vcrt_freefls 16196->16202 16197 7ff6e2153f13 16440 7ff6e21533c0 16197->16440 16198->16199 16590 7ff6e2153360 16199->16590 16204 7ff6e2153eea 16202->16204 16208 7ff6e2153e46 16202->16208 16207 7ff6e2158940 40 API calls 16204->16207 16207->16236 16208->16236 16516 7ff6e2156dc0 16208->16516 16214 7ff6e2156fc0 FreeLibrary 16216 7ff6e2154053 16214->16216 16224 7ff6e2153e79 16226 7ff6e2153e9a 16224->16226 16237 7ff6e2153e7d 16224->16237 16537 7ff6e2156e00 16224->16537 16226->16237 16556 7ff6e21571b0 16226->16556 16236->16195 16236->16197 16237->16236 16572 7ff6e2152a50 16237->16572 16247 7ff6e2169b64 16246->16247 16248 7ff6e2169b43 16246->16248 18709 7ff6e216a3d8 16247->18709 16248->16092 16252 7ff6e215d2c9 16251->16252 16252->16100 16254 7ff6e215cfa1 16253->16254 16255 7ff6e215cd60 16254->16255 16256 7ff6e215d888 7 API calls 16254->16256 16255->16090 16256->16255 16258 7ff6e215d152 _CreateFrameInfo __scrt_get_show_window_mode 16257->16258 16259 7ff6e215d171 RtlCaptureContext RtlLookupFunctionEntry 16258->16259 16260 7ff6e215d19a RtlVirtualUnwind 16259->16260 16261 7ff6e215d1d6 __scrt_get_show_window_mode 16259->16261 16260->16261 16262 7ff6e215d208 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 16261->16262 16263 7ff6e215d256 _CreateFrameInfo 16262->16263 16263->16088 16265 7ff6e215d89a 16264->16265 16266 7ff6e215d890 16264->16266 16265->16107 16270 7ff6e215dc24 16266->16270 16271 7ff6e215dc33 16270->16271 16272 7ff6e215d895 16270->16272 16278 7ff6e215de60 16271->16278 16274 7ff6e215dc90 16272->16274 16275 7ff6e215dcbb 16274->16275 16276 7ff6e215dcbf 16275->16276 16277 7ff6e215dc9e DeleteCriticalSection 16275->16277 16276->16265 16277->16275 16282 7ff6e215dcc8 16278->16282 16283 7ff6e215ddb2 TlsFree 16282->16283 16288 7ff6e215dd0c __vcrt_InitializeCriticalSectionEx 16282->16288 16284 7ff6e215dd3a LoadLibraryExW 16286 7ff6e215dd5b GetLastError 16284->16286 16287 7ff6e215ddd9 16284->16287 16285 7ff6e215ddf9 GetProcAddress 16285->16283 16286->16288 16287->16285 16289 7ff6e215ddf0 FreeLibrary 16287->16289 16288->16283 16288->16284 16288->16285 16290 7ff6e215dd7d LoadLibraryExW 16288->16290 16289->16285 16290->16287 16290->16288 16292 7ff6e217a4c0 16291->16292 16292->16111 16292->16292 16294 7ff6e216f480 16293->16294 16296 7ff6e216f526 16294->16296 16298 7ff6e216f4d3 16294->16298 16295 7ff6e216a814 _invalid_parameter_noinfo 37 API calls 16299 7ff6e216f4fc 16295->16299 16603 7ff6e216f358 16296->16603 16298->16295 16299->16115 16611 7ff6e215c850 16300->16611 16303 7ff6e21536eb GetLastError 16618 7ff6e2152c50 16303->16618 16304 7ff6e2153710 16613 7ff6e2159280 FindFirstFileExW 16304->16613 16308 7ff6e215377d 16644 7ff6e2159440 16308->16644 16309 7ff6e2153723 16633 7ff6e2159300 CreateFileW 16309->16633 16311 7ff6e215c550 _log10_special 8 API calls 16314 7ff6e21537b5 16311->16314 16313 7ff6e215378b 16318 7ff6e2152810 49 API calls 16313->16318 16320 7ff6e2153706 16313->16320 16314->16160 16322 7ff6e2151950 16314->16322 16316 7ff6e215374c __vcrt_InitializeCriticalSectionEx 16316->16308 16317 7ff6e2153734 16636 7ff6e2152810 16317->16636 16318->16320 16320->16311 16323 7ff6e21545c0 108 API calls 16322->16323 16324 7ff6e2151985 16323->16324 16325 7ff6e2151c43 16324->16325 16327 7ff6e2157f90 83 API calls 16324->16327 16326 7ff6e215c550 _log10_special 8 API calls 16325->16326 16328 7ff6e2151c5e 16326->16328 16329 7ff6e21519cb 16327->16329 16328->16122 16328->16123 16371 7ff6e2151a03 16329->16371 17046 7ff6e21606d4 16329->17046 16330 7ff6e216004c 74 API calls 16330->16325 16332 7ff6e21519e5 16333 7ff6e2151a08 16332->16333 16334 7ff6e21519e9 16332->16334 17050 7ff6e216039c 16333->17050 16335 7ff6e2164f08 _get_daylight 11 API calls 16334->16335 16337 7ff6e21519ee 16335->16337 17053 7ff6e2152910 16337->17053 16340 7ff6e2151a26 16342 7ff6e2164f08 _get_daylight 11 API calls 16340->16342 16341 7ff6e2151a45 16344 7ff6e2151a7b 16341->16344 16345 7ff6e2151a5c 16341->16345 16343 7ff6e2151a2b 16342->16343 16346 7ff6e2152910 54 API calls 16343->16346 16348 7ff6e2151c80 49 API calls 16344->16348 16347 7ff6e2164f08 _get_daylight 11 API calls 16345->16347 16346->16371 16349 7ff6e2151a61 16347->16349 16350 7ff6e2151a92 16348->16350 16351 7ff6e2152910 54 API calls 16349->16351 16352 7ff6e2151c80 49 API calls 16350->16352 16351->16371 16353 7ff6e2151add 16352->16353 16354 7ff6e21606d4 73 API calls 16353->16354 16355 7ff6e2151b01 16354->16355 16356 7ff6e2151b16 16355->16356 16357 7ff6e2151b35 16355->16357 16358 7ff6e2164f08 _get_daylight 11 API calls 16356->16358 16359 7ff6e216039c _fread_nolock 53 API calls 16357->16359 16360 7ff6e2151b1b 16358->16360 16361 7ff6e2151b4a 16359->16361 16362 7ff6e2152910 54 API calls 16360->16362 16363 7ff6e2151b6f 16361->16363 16364 7ff6e2151b50 16361->16364 16362->16371 17068 7ff6e2160110 16363->17068 16365 7ff6e2164f08 _get_daylight 11 API calls 16364->16365 16367 7ff6e2151b55 16365->16367 16369 7ff6e2152910 54 API calls 16367->16369 16369->16371 16370 7ff6e2152710 54 API calls 16370->16371 16371->16330 16373 7ff6e215883a 16372->16373 16374 7ff6e2159390 2 API calls 16373->16374 16375 7ff6e2158859 GetEnvironmentVariableW 16374->16375 16376 7ff6e2158876 ExpandEnvironmentStringsW 16375->16376 16377 7ff6e21588c2 16375->16377 16376->16377 16378 7ff6e2158898 16376->16378 16379 7ff6e215c550 _log10_special 8 API calls 16377->16379 16380 7ff6e2159440 2 API calls 16378->16380 16381 7ff6e21588d4 16379->16381 16382 7ff6e21588aa 16380->16382 16381->16132 16383 7ff6e215c550 _log10_special 8 API calls 16382->16383 16384 7ff6e21588ba 16383->16384 16384->16132 16386 7ff6e21590f5 16385->16386 17286 7ff6e2158570 GetCurrentProcess OpenProcessToken 16386->17286 16389 7ff6e2158570 7 API calls 16390 7ff6e2159121 16389->16390 16391 7ff6e215913a 16390->16391 16392 7ff6e2159154 16390->16392 16394 7ff6e21526b0 48 API calls 16391->16394 16393 7ff6e21526b0 48 API calls 16392->16393 16395 7ff6e2159167 LocalFree LocalFree 16393->16395 16396 7ff6e2159152 16394->16396 16397 7ff6e2159183 16395->16397 16399 7ff6e215918f 16395->16399 16396->16395 17296 7ff6e2152b50 16397->17296 16400 7ff6e215c550 _log10_special 8 API calls 16399->16400 16401 7ff6e2153c55 16400->16401 16401->16177 16402 7ff6e2158660 16401->16402 16403 7ff6e2158678 16402->16403 16404 7ff6e21586fa GetTempPathW GetCurrentProcessId 16403->16404 16405 7ff6e215869c 16403->16405 17305 7ff6e21525c0 16404->17305 16407 7ff6e2158830 14 API calls 16405->16407 16409 7ff6e21586a8 16407->16409 16408 7ff6e2158728 __vcrt_freefls 16421 7ff6e2158765 __vcrt_freefls 16408->16421 17309 7ff6e2168b68 16408->17309 17312 7ff6e21581d0 16409->17312 16413 7ff6e21586e8 __vcrt_freefls 16434 7ff6e21587d4 __vcrt_freefls 16413->16434 16417 7ff6e21586ce __vcrt_freefls 16417->16404 16423 7ff6e21586dc 16417->16423 16420 7ff6e215c550 _log10_special 8 API calls 16422 7ff6e2153cbb 16420->16422 16426 7ff6e2159390 2 API calls 16421->16426 16421->16434 16422->16177 16422->16190 16425 7ff6e2152810 49 API calls 16423->16425 16425->16413 16427 7ff6e21587b1 16426->16427 16428 7ff6e21587b6 16427->16428 16429 7ff6e21587e9 16427->16429 16431 7ff6e2159390 2 API calls 16428->16431 16430 7ff6e2168238 38 API calls 16429->16430 16430->16434 16432 7ff6e21587c6 16431->16432 16433 7ff6e2168238 38 API calls 16432->16433 16433->16434 16434->16420 16436 7ff6e21593b2 MultiByteToWideChar 16435->16436 16437 7ff6e21593d6 16435->16437 16436->16437 16439 7ff6e21593ec __vcrt_freefls 16436->16439 16438 7ff6e21593f3 MultiByteToWideChar 16437->16438 16437->16439 16438->16439 16439->16189 16441 7ff6e21533ce __scrt_get_show_window_mode 16440->16441 16444 7ff6e21535c7 16441->16444 16446 7ff6e2151c80 49 API calls 16441->16446 16447 7ff6e21535e2 16441->16447 16452 7ff6e21535c9 16441->16452 16454 7ff6e2152a50 54 API calls 16441->16454 16457 7ff6e21535d0 16441->16457 17601 7ff6e2154560 16441->17601 17607 7ff6e2157e20 16441->17607 17618 7ff6e2151600 16441->17618 17666 7ff6e2157120 16441->17666 17670 7ff6e2154190 16441->17670 17714 7ff6e2154450 16441->17714 16442 7ff6e215c550 _log10_special 8 API calls 16443 7ff6e2153664 16442->16443 16443->16160 16459 7ff6e21590c0 LocalFree 16443->16459 16444->16442 16446->16441 16449 7ff6e2152710 54 API calls 16447->16449 16449->16444 16453 7ff6e2152710 54 API calls 16452->16453 16453->16444 16454->16441 16458 7ff6e2152710 54 API calls 16457->16458 16458->16444 16461 7ff6e2151ca5 16460->16461 16462 7ff6e2164984 49 API calls 16461->16462 16463 7ff6e2151cc8 16462->16463 16463->16127 16465 7ff6e2159390 2 API calls 16464->16465 16466 7ff6e21589b4 16465->16466 16467 7ff6e2168238 38 API calls 16466->16467 16468 7ff6e21589c6 __vcrt_freefls 16467->16468 16468->16139 16470 7ff6e21545cc 16469->16470 16471 7ff6e2159390 2 API calls 16470->16471 16472 7ff6e21545f4 16471->16472 16473 7ff6e2159390 2 API calls 16472->16473 16474 7ff6e2154607 16473->16474 17897 7ff6e2165f94 16474->17897 16477 7ff6e215c550 _log10_special 8 API calls 16478 7ff6e215392b 16477->16478 16478->16128 16479 7ff6e2157f90 16478->16479 16480 7ff6e2157fb4 16479->16480 16481 7ff6e21606d4 73 API calls 16480->16481 16486 7ff6e215808b __vcrt_freefls 16480->16486 16482 7ff6e2157fd0 16481->16482 16482->16486 18288 7ff6e21678c8 16482->18288 16484 7ff6e21606d4 73 API calls 16487 7ff6e2157fe5 16484->16487 16485 7ff6e216039c _fread_nolock 53 API calls 16485->16487 16486->16133 16487->16484 16487->16485 16487->16486 16489 7ff6e216007c 16488->16489 18303 7ff6e215fe28 16489->18303 16491 7ff6e2160095 16491->16128 16493 7ff6e215c850 16492->16493 16494 7ff6e2152734 GetCurrentProcessId 16493->16494 16495 7ff6e2151c80 49 API calls 16494->16495 16496 7ff6e2152787 16495->16496 16497 7ff6e2164984 49 API calls 16496->16497 16498 7ff6e21527cf 16497->16498 16499 7ff6e2152620 12 API calls 16498->16499 16500 7ff6e21527f1 16499->16500 16501 7ff6e215c550 _log10_special 8 API calls 16500->16501 16502 7ff6e2152801 16501->16502 16502->16160 16504 7ff6e2159390 2 API calls 16503->16504 16505 7ff6e215895c 16504->16505 16506 7ff6e2159390 2 API calls 16505->16506 16507 7ff6e215896c 16506->16507 16508 7ff6e2168238 38 API calls 16507->16508 16509 7ff6e215897a __vcrt_freefls 16508->16509 16509->16143 16511 7ff6e2151c80 49 API calls 16510->16511 16512 7ff6e21544fd 16511->16512 16512->16172 16514 7ff6e2151c80 49 API calls 16513->16514 16515 7ff6e2154660 16514->16515 16515->16190 16517 7ff6e2156dd5 16516->16517 16518 7ff6e2153e64 16517->16518 16519 7ff6e2164f08 _get_daylight 11 API calls 16517->16519 16522 7ff6e2157340 16518->16522 16520 7ff6e2156de2 16519->16520 16521 7ff6e2152910 54 API calls 16520->16521 16521->16518 18314 7ff6e2151470 16522->18314 16524 7ff6e2157368 16525 7ff6e21574b9 __vcrt_freefls 16524->16525 16526 7ff6e2154630 49 API calls 16524->16526 16525->16224 16527 7ff6e215738a 16526->16527 16528 7ff6e215738f 16527->16528 16529 7ff6e2154630 49 API calls 16527->16529 16530 7ff6e2152a50 54 API calls 16528->16530 16531 7ff6e21573ae 16529->16531 16530->16525 16531->16528 16532 7ff6e2154630 49 API calls 16531->16532 16533 7ff6e21573ca 16532->16533 16533->16528 16534 7ff6e21573d3 16533->16534 16535 7ff6e2152710 54 API calls 16534->16535 16536 7ff6e2157443 memcpy_s __vcrt_freefls 16534->16536 16535->16525 16536->16224 16553 7ff6e2156e1c 16537->16553 16538 7ff6e2156f3f 16539 7ff6e215c550 _log10_special 8 API calls 16538->16539 16540 7ff6e2156f51 16539->16540 16540->16226 16541 7ff6e2151840 45 API calls 16541->16553 16542 7ff6e2156faa 16544 7ff6e2152710 54 API calls 16542->16544 16543 7ff6e2151c80 49 API calls 16543->16553 16544->16538 16545 7ff6e2156f97 16547 7ff6e2152710 54 API calls 16545->16547 16546 7ff6e2154560 10 API calls 16546->16553 16547->16538 16548 7ff6e2157e20 52 API calls 16548->16553 16549 7ff6e2152a50 54 API calls 16549->16553 16550 7ff6e2156f84 16551 7ff6e2152710 54 API calls 16550->16551 16551->16538 16552 7ff6e2151600 118 API calls 16552->16553 16553->16538 16553->16541 16553->16542 16553->16543 16553->16545 16553->16546 16553->16548 16553->16549 16553->16550 16553->16552 16554 7ff6e2156f6d 16553->16554 16555 7ff6e2152710 54 API calls 16554->16555 16555->16538 18344 7ff6e2158e80 16556->18344 16558 7ff6e21571c9 16559 7ff6e2158e80 3 API calls 16558->16559 16560 7ff6e21571dc 16559->16560 16561 7ff6e215720f 16560->16561 16562 7ff6e21571f4 16560->16562 16573 7ff6e215c850 16572->16573 16574 7ff6e2152a74 GetCurrentProcessId 16573->16574 16575 7ff6e2151c80 49 API calls 16574->16575 16576 7ff6e2152ac7 16575->16576 16577 7ff6e2164984 49 API calls 16576->16577 16578 7ff6e2152b0f 16577->16578 16579 7ff6e2152620 12 API calls 16578->16579 16580 7ff6e2152b31 16579->16580 18420 7ff6e2156360 16590->18420 16594 7ff6e2153381 16598 7ff6e2153399 16594->16598 18488 7ff6e2156050 16594->18488 16596 7ff6e215338d 16596->16598 16599 7ff6e2153670 16598->16599 16600 7ff6e215367e 16599->16600 16601 7ff6e215368f 16600->16601 18708 7ff6e2158e60 FreeLibrary 16600->18708 16601->16214 16610 7ff6e216546c EnterCriticalSection 16603->16610 16612 7ff6e21536bc GetModuleFileNameW 16611->16612 16612->16303 16612->16304 16614 7ff6e21592bf FindClose 16613->16614 16615 7ff6e21592d2 16613->16615 16614->16615 16616 7ff6e215c550 _log10_special 8 API calls 16615->16616 16617 7ff6e215371a 16616->16617 16617->16308 16617->16309 16619 7ff6e215c850 16618->16619 16620 7ff6e2152c70 GetCurrentProcessId 16619->16620 16649 7ff6e21526b0 16620->16649 16622 7ff6e2152cb9 16653 7ff6e2164bd8 16622->16653 16625 7ff6e21526b0 48 API calls 16626 7ff6e2152d34 FormatMessageW 16625->16626 16628 7ff6e2152d6d 16626->16628 16629 7ff6e2152d7f MessageBoxW 16626->16629 16630 7ff6e21526b0 48 API calls 16628->16630 16631 7ff6e215c550 _log10_special 8 API calls 16629->16631 16630->16629 16632 7ff6e2152daf 16631->16632 16632->16320 16634 7ff6e2159340 GetFinalPathNameByHandleW CloseHandle 16633->16634 16635 7ff6e2153730 16633->16635 16634->16635 16635->16316 16635->16317 16637 7ff6e2152834 16636->16637 16638 7ff6e21526b0 48 API calls 16637->16638 16639 7ff6e2152887 16638->16639 16640 7ff6e2164bd8 48 API calls 16639->16640 16641 7ff6e21528d0 MessageBoxW 16640->16641 16642 7ff6e215c550 _log10_special 8 API calls 16641->16642 16643 7ff6e2152900 16642->16643 16643->16320 16645 7ff6e215946a WideCharToMultiByte 16644->16645 16648 7ff6e2159495 16644->16648 16647 7ff6e21594ab __vcrt_freefls 16645->16647 16645->16648 16646 7ff6e21594b2 WideCharToMultiByte 16646->16647 16647->16313 16648->16646 16648->16647 16650 7ff6e21526d5 16649->16650 16651 7ff6e2164bd8 48 API calls 16650->16651 16652 7ff6e21526f8 16651->16652 16652->16622 16657 7ff6e2164c32 16653->16657 16654 7ff6e2164c57 16655 7ff6e216a814 _invalid_parameter_noinfo 37 API calls 16654->16655 16659 7ff6e2164c81 16655->16659 16656 7ff6e2164c93 16671 7ff6e2162f90 16656->16671 16657->16654 16657->16656 16661 7ff6e215c550 _log10_special 8 API calls 16659->16661 16660 7ff6e216a948 __free_lconv_num 11 API calls 16660->16659 16663 7ff6e2152d04 16661->16663 16663->16625 16664 7ff6e2164d74 16664->16660 16665 7ff6e2164d40 16665->16664 16667 7ff6e2164d49 16665->16667 16666 7ff6e2164d9a 16666->16664 16668 7ff6e2164da4 16666->16668 16669 7ff6e216a948 __free_lconv_num 11 API calls 16667->16669 16670 7ff6e216a948 __free_lconv_num 11 API calls 16668->16670 16669->16659 16670->16659 16672 7ff6e2162fce 16671->16672 16673 7ff6e2162fbe 16671->16673 16674 7ff6e2162fd7 16672->16674 16680 7ff6e2163005 16672->16680 16675 7ff6e216a814 _invalid_parameter_noinfo 37 API calls 16673->16675 16676 7ff6e216a814 _invalid_parameter_noinfo 37 API calls 16674->16676 16677 7ff6e2162ffd 16675->16677 16676->16677 16677->16664 16677->16665 16677->16666 16677->16667 16680->16673 16680->16677 16682 7ff6e21639a4 16680->16682 16715 7ff6e21633f0 16680->16715 16752 7ff6e2162b80 16680->16752 16683 7ff6e2163a57 16682->16683 16684 7ff6e21639e6 16682->16684 16685 7ff6e2163a5c 16683->16685 16686 7ff6e2163ab0 16683->16686 16687 7ff6e21639ec 16684->16687 16688 7ff6e2163a81 16684->16688 16691 7ff6e2163a5e 16685->16691 16692 7ff6e2163a91 16685->16692 16693 7ff6e2163ac7 16686->16693 16695 7ff6e2163aba 16686->16695 16700 7ff6e2163abf 16686->16700 16689 7ff6e21639f1 16687->16689 16690 7ff6e2163a20 16687->16690 16775 7ff6e2161d54 16688->16775 16689->16693 16696 7ff6e21639f7 16689->16696 16690->16696 16690->16700 16694 7ff6e2163a00 16691->16694 16704 7ff6e2163a6d 16691->16704 16782 7ff6e2161944 16692->16782 16789 7ff6e21646ac 16693->16789 16710 7ff6e2163af0 16694->16710 16755 7ff6e2164158 16694->16755 16695->16688 16695->16700 16696->16694 16703 7ff6e2163a32 16696->16703 16711 7ff6e2163a1b 16696->16711 16700->16710 16793 7ff6e2162164 16700->16793 16703->16710 16765 7ff6e2164494 16703->16765 16704->16688 16705 7ff6e2163a72 16704->16705 16705->16710 16771 7ff6e2164558 16705->16771 16707 7ff6e215c550 _log10_special 8 API calls 16708 7ff6e2163dea 16707->16708 16708->16680 16710->16707 16711->16710 16712 7ff6e2163cdc 16711->16712 16800 7ff6e21647c0 16711->16800 16712->16710 16806 7ff6e216ea08 16712->16806 16716 7ff6e2163414 16715->16716 16717 7ff6e21633fe 16715->16717 16718 7ff6e2163454 16716->16718 16719 7ff6e216a814 _invalid_parameter_noinfo 37 API calls 16716->16719 16717->16718 16720 7ff6e2163a57 16717->16720 16721 7ff6e21639e6 16717->16721 16718->16680 16719->16718 16722 7ff6e2163a5c 16720->16722 16723 7ff6e2163ab0 16720->16723 16724 7ff6e21639ec 16721->16724 16725 7ff6e2163a81 16721->16725 16728 7ff6e2163a5e 16722->16728 16729 7ff6e2163a91 16722->16729 16730 7ff6e2163ac7 16723->16730 16732 7ff6e2163aba 16723->16732 16737 7ff6e2163abf 16723->16737 16726 7ff6e21639f1 16724->16726 16727 7ff6e2163a20 16724->16727 16734 7ff6e2161d54 38 API calls 16725->16734 16726->16730 16733 7ff6e21639f7 16726->16733 16727->16733 16727->16737 16731 7ff6e2163a00 16728->16731 16741 7ff6e2163a6d 16728->16741 16735 7ff6e2161944 38 API calls 16729->16735 16738 7ff6e21646ac 45 API calls 16730->16738 16736 7ff6e2164158 47 API calls 16731->16736 16751 7ff6e2163af0 16731->16751 16732->16725 16732->16737 16733->16731 16739 7ff6e2163a32 16733->16739 16748 7ff6e2163a1b 16733->16748 16734->16748 16735->16748 16736->16748 16740 7ff6e2162164 38 API calls 16737->16740 16737->16751 16738->16748 16742 7ff6e2164494 46 API calls 16739->16742 16739->16751 16740->16748 16741->16725 16743 7ff6e2163a72 16741->16743 16742->16748 16746 7ff6e2164558 37 API calls 16743->16746 16743->16751 16744 7ff6e215c550 _log10_special 8 API calls 16745 7ff6e2163dea 16744->16745 16745->16680 16746->16748 16747 7ff6e21647c0 45 API calls 16750 7ff6e2163cdc 16747->16750 16748->16747 16748->16750 16748->16751 16749 7ff6e216ea08 46 API calls 16749->16750 16750->16749 16750->16751 16751->16744 17029 7ff6e2160fc8 16752->17029 16756 7ff6e216417e 16755->16756 16818 7ff6e2160b80 16756->16818 16761 7ff6e21647c0 45 API calls 16762 7ff6e21642c3 16761->16762 16763 7ff6e21647c0 45 API calls 16762->16763 16764 7ff6e2164351 16762->16764 16763->16764 16764->16711 16766 7ff6e21644c9 16765->16766 16767 7ff6e21644e7 16766->16767 16768 7ff6e216450e 16766->16768 16769 7ff6e21647c0 45 API calls 16766->16769 16770 7ff6e216ea08 46 API calls 16767->16770 16768->16711 16769->16767 16770->16768 16772 7ff6e2164579 16771->16772 16773 7ff6e216a814 _invalid_parameter_noinfo 37 API calls 16772->16773 16774 7ff6e21645aa 16772->16774 16773->16774 16774->16711 16776 7ff6e2161d87 16775->16776 16777 7ff6e2161db6 16776->16777 16779 7ff6e2161e73 16776->16779 16781 7ff6e2161df3 16777->16781 16961 7ff6e2160c28 16777->16961 16780 7ff6e216a814 _invalid_parameter_noinfo 37 API calls 16779->16780 16780->16781 16781->16711 16783 7ff6e2161977 16782->16783 16784 7ff6e21619a6 16783->16784 16786 7ff6e2161a63 16783->16786 16785 7ff6e2160c28 12 API calls 16784->16785 16788 7ff6e21619e3 16784->16788 16785->16788 16787 7ff6e216a814 _invalid_parameter_noinfo 37 API calls 16786->16787 16787->16788 16788->16711 16790 7ff6e21646ef 16789->16790 16792 7ff6e21646f3 __crtLCMapStringW 16790->16792 16969 7ff6e2164748 16790->16969 16792->16711 16794 7ff6e2162197 16793->16794 16795 7ff6e21621c6 16794->16795 16797 7ff6e2162283 16794->16797 16796 7ff6e2160c28 12 API calls 16795->16796 16799 7ff6e2162203 16795->16799 16796->16799 16798 7ff6e216a814 _invalid_parameter_noinfo 37 API calls 16797->16798 16798->16799 16799->16711 16801 7ff6e21647d7 16800->16801 16973 7ff6e216d9b8 16801->16973 16808 7ff6e216ea39 16806->16808 16816 7ff6e216ea47 16806->16816 16807 7ff6e216ea67 16810 7ff6e216ea78 16807->16810 16811 7ff6e216ea9f 16807->16811 16808->16807 16809 7ff6e21647c0 45 API calls 16808->16809 16808->16816 16809->16807 17019 7ff6e21700a0 16810->17019 16813 7ff6e216eb2a 16811->16813 16814 7ff6e216eac9 16811->16814 16811->16816 16815 7ff6e216f8a0 _fread_nolock MultiByteToWideChar 16813->16815 16814->16816 17022 7ff6e216f8a0 16814->17022 16815->16816 16816->16712 16819 7ff6e2160bb7 16818->16819 16825 7ff6e2160ba6 16818->16825 16819->16825 16848 7ff6e216d5fc 16819->16848 16822 7ff6e216a948 __free_lconv_num 11 API calls 16824 7ff6e2160bf8 16822->16824 16823 7ff6e216a948 __free_lconv_num 11 API calls 16823->16825 16824->16823 16826 7ff6e216e570 16825->16826 16827 7ff6e216e58d 16826->16827 16828 7ff6e216e5c0 16826->16828 16829 7ff6e216a814 _invalid_parameter_noinfo 37 API calls 16827->16829 16828->16827 16831 7ff6e216e5f2 16828->16831 16830 7ff6e21642a1 16829->16830 16830->16761 16830->16762 16836 7ff6e216e705 16831->16836 16841 7ff6e216e63a 16831->16841 16832 7ff6e216e7f7 16888 7ff6e216da5c 16832->16888 16834 7ff6e216e7bd 16881 7ff6e216ddf4 16834->16881 16835 7ff6e216e78c 16874 7ff6e216e0d4 16835->16874 16836->16832 16836->16834 16836->16835 16838 7ff6e216e74f 16836->16838 16840 7ff6e216e745 16836->16840 16864 7ff6e216e304 16838->16864 16840->16834 16843 7ff6e216e74a 16840->16843 16841->16830 16855 7ff6e216a4a4 16841->16855 16843->16835 16843->16838 16846 7ff6e216a900 _isindst 17 API calls 16847 7ff6e216e854 16846->16847 16849 7ff6e216d647 16848->16849 16853 7ff6e216d60b _get_daylight 16848->16853 16850 7ff6e2164f08 _get_daylight 11 API calls 16849->16850 16852 7ff6e2160be4 16850->16852 16851 7ff6e216d62e HeapAlloc 16851->16852 16851->16853 16852->16822 16852->16824 16853->16849 16853->16851 16854 7ff6e2173590 _get_daylight 2 API calls 16853->16854 16854->16853 16856 7ff6e216a4bb 16855->16856 16857 7ff6e216a4b1 16855->16857 16858 7ff6e2164f08 _get_daylight 11 API calls 16856->16858 16857->16856 16861 7ff6e216a4d6 16857->16861 16863 7ff6e216a4c2 16858->16863 16859 7ff6e216a8e0 _invalid_parameter_noinfo 37 API calls 16860 7ff6e216a4ce 16859->16860 16860->16830 16860->16846 16861->16860 16862 7ff6e2164f08 _get_daylight 11 API calls 16861->16862 16862->16863 16863->16859 16897 7ff6e21740ac 16864->16897 16868 7ff6e216e3ac 16869 7ff6e216e3b0 16868->16869 16870 7ff6e216e401 16868->16870 16872 7ff6e216e3cc 16868->16872 16869->16830 16950 7ff6e216def0 16870->16950 16946 7ff6e216e1ac 16872->16946 16875 7ff6e21740ac 38 API calls 16874->16875 16876 7ff6e216e11e 16875->16876 16877 7ff6e2173af4 37 API calls 16876->16877 16878 7ff6e216e16e 16877->16878 16879 7ff6e216e172 16878->16879 16880 7ff6e216e1ac 45 API calls 16878->16880 16879->16830 16880->16879 16882 7ff6e21740ac 38 API calls 16881->16882 16883 7ff6e216de3f 16882->16883 16884 7ff6e2173af4 37 API calls 16883->16884 16885 7ff6e216de97 16884->16885 16886 7ff6e216de9b 16885->16886 16887 7ff6e216def0 45 API calls 16885->16887 16886->16830 16887->16886 16889 7ff6e216dad4 16888->16889 16890 7ff6e216daa1 16888->16890 16892 7ff6e216daec 16889->16892 16894 7ff6e216db6d 16889->16894 16891 7ff6e216a814 _invalid_parameter_noinfo 37 API calls 16890->16891 16896 7ff6e216dacd __scrt_get_show_window_mode 16891->16896 16893 7ff6e216ddf4 46 API calls 16892->16893 16893->16896 16895 7ff6e21647c0 45 API calls 16894->16895 16894->16896 16895->16896 16896->16830 16898 7ff6e21740ff fegetenv 16897->16898 16899 7ff6e2177e2c 37 API calls 16898->16899 16903 7ff6e2174152 16899->16903 16900 7ff6e217417f 16905 7ff6e216a4a4 __std_exception_copy 37 API calls 16900->16905 16901 7ff6e2174242 16902 7ff6e2177e2c 37 API calls 16901->16902 16904 7ff6e217426c 16902->16904 16903->16901 16906 7ff6e217421c 16903->16906 16907 7ff6e217416d 16903->16907 16908 7ff6e2177e2c 37 API calls 16904->16908 16909 7ff6e21741fd 16905->16909 16912 7ff6e216a4a4 __std_exception_copy 37 API calls 16906->16912 16907->16900 16907->16901 16910 7ff6e217427d 16908->16910 16911 7ff6e2175324 16909->16911 16916 7ff6e2174205 16909->16916 16913 7ff6e2178020 20 API calls 16910->16913 16914 7ff6e216a900 _isindst 17 API calls 16911->16914 16912->16909 16927 7ff6e21742e6 __scrt_get_show_window_mode 16913->16927 16915 7ff6e2175339 16914->16915 16917 7ff6e215c550 _log10_special 8 API calls 16916->16917 16918 7ff6e216e351 16917->16918 16942 7ff6e2173af4 16918->16942 16919 7ff6e2174c6b memcpy_s __scrt_get_show_window_mode 16921 7ff6e21749cf 16919->16921 16925 7ff6e217497b 16919->16925 16935 7ff6e2164f08 11 API calls _get_daylight 16919->16935 16941 7ff6e216a8e0 37 API calls _invalid_parameter_noinfo 16919->16941 16920 7ff6e217468f __scrt_get_show_window_mode 16923 7ff6e2173c10 37 API calls 16921->16923 16922 7ff6e2174783 memcpy_s __scrt_get_show_window_mode 16922->16925 16937 7ff6e2164f08 11 API calls _get_daylight 16922->16937 16939 7ff6e216a8e0 37 API calls _invalid_parameter_noinfo 16922->16939 16929 7ff6e21750e7 16923->16929 16924 7ff6e2175142 16932 7ff6e21752c8 16924->16932 16938 7ff6e2173c10 37 API calls 16924->16938 16940 7ff6e217533c memcpy_s 37 API calls 16924->16940 16925->16921 16925->16925 16928 7ff6e217533c memcpy_s 37 API calls 16925->16928 16926 7ff6e2174327 memcpy_s 16926->16919 16926->16922 16927->16920 16927->16926 16930 7ff6e2164f08 _get_daylight 11 API calls 16927->16930 16928->16921 16929->16924 16929->16929 16934 7ff6e217533c memcpy_s 37 API calls 16929->16934 16931 7ff6e2174760 16930->16931 16933 7ff6e216a8e0 _invalid_parameter_noinfo 37 API calls 16931->16933 16936 7ff6e2177e2c 37 API calls 16932->16936 16933->16926 16934->16924 16935->16919 16936->16916 16937->16922 16938->16924 16939->16922 16940->16924 16941->16919 16943 7ff6e2173b13 16942->16943 16944 7ff6e216a814 _invalid_parameter_noinfo 37 API calls 16943->16944 16945 7ff6e2173b3e memcpy_s 16943->16945 16944->16945 16945->16868 16947 7ff6e216e1d8 memcpy_s 16946->16947 16948 7ff6e21647c0 45 API calls 16947->16948 16949 7ff6e216e292 memcpy_s __scrt_get_show_window_mode 16947->16949 16948->16949 16949->16869 16951 7ff6e216df2b 16950->16951 16956 7ff6e216df78 memcpy_s 16950->16956 16952 7ff6e216a814 _invalid_parameter_noinfo 37 API calls 16951->16952 16953 7ff6e216df57 16952->16953 16953->16869 16954 7ff6e216dfe3 16955 7ff6e216a4a4 __std_exception_copy 37 API calls 16954->16955 16960 7ff6e216e025 memcpy_s 16955->16960 16956->16954 16957 7ff6e21647c0 45 API calls 16956->16957 16957->16954 16958 7ff6e216a900 _isindst 17 API calls 16959 7ff6e216e0d0 16958->16959 16960->16958 16962 7ff6e2160c5f 16961->16962 16968 7ff6e2160c4e 16961->16968 16963 7ff6e216d5fc _fread_nolock 12 API calls 16962->16963 16962->16968 16964 7ff6e2160c90 16963->16964 16965 7ff6e2160ca4 16964->16965 16966 7ff6e216a948 __free_lconv_num 11 API calls 16964->16966 16967 7ff6e216a948 __free_lconv_num 11 API calls 16965->16967 16966->16965 16967->16968 16968->16781 16970 7ff6e2164766 16969->16970 16971 7ff6e216476e 16969->16971 16972 7ff6e21647c0 45 API calls 16970->16972 16971->16792 16972->16971 16974 7ff6e21647ff 16973->16974 16975 7ff6e216d9d1 16973->16975 16977 7ff6e216da24 16974->16977 16975->16974 16981 7ff6e2173304 16975->16981 16978 7ff6e216da3d 16977->16978 16979 7ff6e216480f 16977->16979 16978->16979 17016 7ff6e2172650 16978->17016 16979->16712 16993 7ff6e216b150 GetLastError 16981->16993 16984 7ff6e217335e 16984->16974 16994 7ff6e216b174 FlsGetValue 16993->16994 16995 7ff6e216b191 FlsSetValue 16993->16995 16996 7ff6e216b18b 16994->16996 17013 7ff6e216b181 16994->17013 16997 7ff6e216b1a3 16995->16997 16995->17013 16996->16995 16999 7ff6e216eb98 _get_daylight 11 API calls 16997->16999 16998 7ff6e216b1fd SetLastError 17000 7ff6e216b21d 16998->17000 17001 7ff6e216b20a 16998->17001 17002 7ff6e216b1b2 16999->17002 17003 7ff6e216a504 _CreateFrameInfo 38 API calls 17000->17003 17001->16984 17015 7ff6e21702d8 EnterCriticalSection 17001->17015 17004 7ff6e216b1d0 FlsSetValue 17002->17004 17005 7ff6e216b1c0 FlsSetValue 17002->17005 17006 7ff6e216b222 17003->17006 17008 7ff6e216b1dc FlsSetValue 17004->17008 17009 7ff6e216b1ee 17004->17009 17007 7ff6e216b1c9 17005->17007 17011 7ff6e216a948 __free_lconv_num 11 API calls 17007->17011 17008->17007 17010 7ff6e216aef4 _get_daylight 11 API calls 17009->17010 17012 7ff6e216b1f6 17010->17012 17011->17013 17014 7ff6e216a948 __free_lconv_num 11 API calls 17012->17014 17013->16998 17014->16998 17017 7ff6e216b150 _CreateFrameInfo 45 API calls 17016->17017 17018 7ff6e2172659 17017->17018 17025 7ff6e2176d88 17019->17025 17023 7ff6e216f8a9 MultiByteToWideChar 17022->17023 17028 7ff6e2176dec 17025->17028 17026 7ff6e215c550 _log10_special 8 API calls 17027 7ff6e21700bd 17026->17027 17027->16816 17028->17026 17030 7ff6e2160ffd 17029->17030 17031 7ff6e216100f 17029->17031 17032 7ff6e2164f08 _get_daylight 11 API calls 17030->17032 17034 7ff6e216101d 17031->17034 17038 7ff6e2161059 17031->17038 17033 7ff6e2161002 17032->17033 17035 7ff6e216a8e0 _invalid_parameter_noinfo 37 API calls 17033->17035 17036 7ff6e216a814 _invalid_parameter_noinfo 37 API calls 17034->17036 17041 7ff6e216100d 17035->17041 17036->17041 17037 7ff6e21613d5 17039 7ff6e2164f08 _get_daylight 11 API calls 17037->17039 17037->17041 17038->17037 17040 7ff6e2164f08 _get_daylight 11 API calls 17038->17040 17042 7ff6e2161669 17039->17042 17043 7ff6e21613ca 17040->17043 17041->16680 17044 7ff6e216a8e0 _invalid_parameter_noinfo 37 API calls 17042->17044 17045 7ff6e216a8e0 _invalid_parameter_noinfo 37 API calls 17043->17045 17044->17041 17045->17037 17047 7ff6e2160704 17046->17047 17074 7ff6e2160464 17047->17074 17049 7ff6e216071d 17049->16332 17086 7ff6e21603bc 17050->17086 17054 7ff6e215c850 17053->17054 17055 7ff6e2152930 GetCurrentProcessId 17054->17055 17056 7ff6e2151c80 49 API calls 17055->17056 17057 7ff6e2152979 17056->17057 17100 7ff6e2164984 17057->17100 17062 7ff6e2151c80 49 API calls 17063 7ff6e21529ff 17062->17063 17130 7ff6e2152620 17063->17130 17066 7ff6e215c550 _log10_special 8 API calls 17067 7ff6e2152a31 17066->17067 17067->16371 17069 7ff6e2160119 17068->17069 17070 7ff6e2151b89 17068->17070 17071 7ff6e2164f08 _get_daylight 11 API calls 17069->17071 17070->16370 17070->16371 17072 7ff6e216011e 17071->17072 17073 7ff6e216a8e0 _invalid_parameter_noinfo 37 API calls 17072->17073 17073->17070 17075 7ff6e21604ce 17074->17075 17076 7ff6e216048e 17074->17076 17075->17076 17077 7ff6e21604da 17075->17077 17078 7ff6e216a814 _invalid_parameter_noinfo 37 API calls 17076->17078 17085 7ff6e216546c EnterCriticalSection 17077->17085 17084 7ff6e21604b5 17078->17084 17084->17049 17087 7ff6e21603e6 17086->17087 17098 7ff6e2151a20 17086->17098 17088 7ff6e2160432 17087->17088 17089 7ff6e21603f5 __scrt_get_show_window_mode 17087->17089 17087->17098 17099 7ff6e216546c EnterCriticalSection 17088->17099 17091 7ff6e2164f08 _get_daylight 11 API calls 17089->17091 17094 7ff6e216040a 17091->17094 17096 7ff6e216a8e0 _invalid_parameter_noinfo 37 API calls 17094->17096 17096->17098 17098->16340 17098->16341 17103 7ff6e21649de 17100->17103 17101 7ff6e2164a03 17102 7ff6e216a814 _invalid_parameter_noinfo 37 API calls 17101->17102 17117 7ff6e2164a2d 17102->17117 17103->17101 17104 7ff6e2164a3f 17103->17104 17139 7ff6e2162c10 17104->17139 17106 7ff6e2164b1c 17109 7ff6e216a948 __free_lconv_num 11 API calls 17106->17109 17108 7ff6e215c550 _log10_special 8 API calls 17110 7ff6e21529c3 17108->17110 17109->17117 17118 7ff6e2165160 17110->17118 17111 7ff6e2164af1 17114 7ff6e216a948 __free_lconv_num 11 API calls 17111->17114 17112 7ff6e2164b40 17112->17106 17113 7ff6e2164b4a 17112->17113 17116 7ff6e216a948 __free_lconv_num 11 API calls 17113->17116 17114->17117 17115 7ff6e2164ae8 17115->17106 17115->17111 17116->17117 17117->17108 17119 7ff6e216b2c8 _get_daylight 11 API calls 17118->17119 17120 7ff6e2165177 17119->17120 17121 7ff6e21529e5 17120->17121 17122 7ff6e216eb98 _get_daylight 11 API calls 17120->17122 17125 7ff6e21651b7 17120->17125 17121->17062 17123 7ff6e21651ac 17122->17123 17124 7ff6e216a948 __free_lconv_num 11 API calls 17123->17124 17124->17125 17125->17121 17277 7ff6e216ec20 17125->17277 17128 7ff6e216a900 _isindst 17 API calls 17129 7ff6e21651fc 17128->17129 17131 7ff6e215262f 17130->17131 17132 7ff6e2159390 2 API calls 17131->17132 17133 7ff6e2152660 17132->17133 17134 7ff6e2152683 MessageBoxA 17133->17134 17135 7ff6e215266f MessageBoxW 17133->17135 17136 7ff6e2152690 17134->17136 17135->17136 17137 7ff6e215c550 _log10_special 8 API calls 17136->17137 17138 7ff6e21526a0 17137->17138 17138->17066 17140 7ff6e2162c4e 17139->17140 17141 7ff6e2162c3e 17139->17141 17142 7ff6e2162c57 17140->17142 17151 7ff6e2162c85 17140->17151 17143 7ff6e216a814 _invalid_parameter_noinfo 37 API calls 17141->17143 17144 7ff6e216a814 _invalid_parameter_noinfo 37 API calls 17142->17144 17145 7ff6e2162c7d 17143->17145 17144->17145 17145->17106 17145->17111 17145->17112 17145->17115 17146 7ff6e21647c0 45 API calls 17146->17151 17148 7ff6e2162f34 17150 7ff6e216a814 _invalid_parameter_noinfo 37 API calls 17148->17150 17150->17141 17151->17141 17151->17145 17151->17146 17151->17148 17153 7ff6e21635a0 17151->17153 17179 7ff6e2163268 17151->17179 17209 7ff6e2162af0 17151->17209 17154 7ff6e21635e2 17153->17154 17155 7ff6e2163655 17153->17155 17158 7ff6e21635e8 17154->17158 17159 7ff6e216367f 17154->17159 17156 7ff6e216365a 17155->17156 17157 7ff6e21636af 17155->17157 17160 7ff6e216365c 17156->17160 17161 7ff6e216368f 17156->17161 17157->17159 17170 7ff6e21636be 17157->17170 17177 7ff6e2163618 17157->17177 17166 7ff6e21635ed 17158->17166 17158->17170 17226 7ff6e2161b50 17159->17226 17162 7ff6e21635fd 17160->17162 17169 7ff6e216366b 17160->17169 17233 7ff6e2161740 17161->17233 17178 7ff6e21636ed 17162->17178 17212 7ff6e2163f04 17162->17212 17166->17162 17168 7ff6e2163630 17166->17168 17166->17177 17168->17178 17222 7ff6e21643c0 17168->17222 17169->17159 17171 7ff6e2163670 17169->17171 17170->17178 17240 7ff6e2161f60 17170->17240 17174 7ff6e2164558 37 API calls 17171->17174 17171->17178 17173 7ff6e215c550 _log10_special 8 API calls 17175 7ff6e2163983 17173->17175 17174->17177 17175->17151 17177->17178 17247 7ff6e216e858 17177->17247 17178->17173 17180 7ff6e2163289 17179->17180 17181 7ff6e2163273 17179->17181 17182 7ff6e216a814 _invalid_parameter_noinfo 37 API calls 17180->17182 17191 7ff6e21632c7 17180->17191 17183 7ff6e21635e2 17181->17183 17184 7ff6e2163655 17181->17184 17181->17191 17182->17191 17187 7ff6e21635e8 17183->17187 17188 7ff6e216367f 17183->17188 17185 7ff6e216365a 17184->17185 17186 7ff6e21636af 17184->17186 17189 7ff6e216365c 17185->17189 17190 7ff6e216368f 17185->17190 17186->17188 17197 7ff6e21636be 17186->17197 17208 7ff6e2163618 17186->17208 17195 7ff6e21635ed 17187->17195 17187->17197 17192 7ff6e2161b50 38 API calls 17188->17192 17199 7ff6e216366b 17189->17199 17201 7ff6e21635fd 17189->17201 17193 7ff6e2161740 38 API calls 17190->17193 17191->17151 17192->17208 17193->17208 17194 7ff6e2163f04 47 API calls 17194->17208 17196 7ff6e2163630 17195->17196 17195->17201 17195->17208 17200 7ff6e21643c0 47 API calls 17196->17200 17206 7ff6e21636ed 17196->17206 17198 7ff6e2161f60 38 API calls 17197->17198 17197->17206 17198->17208 17199->17188 17202 7ff6e2163670 17199->17202 17200->17208 17201->17194 17201->17206 17204 7ff6e2164558 37 API calls 17202->17204 17202->17206 17203 7ff6e215c550 _log10_special 8 API calls 17205 7ff6e2163983 17203->17205 17204->17208 17205->17151 17206->17203 17207 7ff6e216e858 47 API calls 17207->17208 17208->17206 17208->17207 17260 7ff6e2160d14 17209->17260 17213 7ff6e2163f26 17212->17213 17214 7ff6e2160b80 12 API calls 17213->17214 17215 7ff6e2163f6e 17214->17215 17216 7ff6e216e570 46 API calls 17215->17216 17217 7ff6e2164041 17216->17217 17218 7ff6e21647c0 45 API calls 17217->17218 17220 7ff6e2164063 17217->17220 17218->17220 17219 7ff6e21647c0 45 API calls 17221 7ff6e21640ec 17219->17221 17220->17219 17220->17220 17220->17221 17221->17177 17223 7ff6e21643d8 17222->17223 17225 7ff6e2164440 17222->17225 17224 7ff6e216e858 47 API calls 17223->17224 17223->17225 17224->17225 17225->17177 17227 7ff6e2161b83 17226->17227 17228 7ff6e2161bb2 17227->17228 17230 7ff6e2161c6f 17227->17230 17229 7ff6e2160b80 12 API calls 17228->17229 17232 7ff6e2161bef 17228->17232 17229->17232 17231 7ff6e216a814 _invalid_parameter_noinfo 37 API calls 17230->17231 17231->17232 17232->17177 17234 7ff6e2161773 17233->17234 17235 7ff6e21617a2 17234->17235 17237 7ff6e216185f 17234->17237 17236 7ff6e2160b80 12 API calls 17235->17236 17239 7ff6e21617df 17235->17239 17236->17239 17238 7ff6e216a814 _invalid_parameter_noinfo 37 API calls 17237->17238 17238->17239 17239->17177 17241 7ff6e2161f93 17240->17241 17242 7ff6e2161fc2 17241->17242 17244 7ff6e216207f 17241->17244 17243 7ff6e2160b80 12 API calls 17242->17243 17245 7ff6e2161fff 17242->17245 17243->17245 17246 7ff6e216a814 _invalid_parameter_noinfo 37 API calls 17244->17246 17245->17177 17246->17245 17248 7ff6e216e880 17247->17248 17249 7ff6e216e8c5 17248->17249 17250 7ff6e21647c0 45 API calls 17248->17250 17254 7ff6e216e885 __scrt_get_show_window_mode 17248->17254 17256 7ff6e216e8ae __scrt_get_show_window_mode 17248->17256 17249->17254 17249->17256 17257 7ff6e21707e8 17249->17257 17250->17249 17251 7ff6e216a814 _invalid_parameter_noinfo 37 API calls 17251->17254 17254->17177 17256->17251 17256->17254 17259 7ff6e217080c WideCharToMultiByte 17257->17259 17261 7ff6e2160d53 17260->17261 17262 7ff6e2160d41 17260->17262 17265 7ff6e2160d60 17261->17265 17268 7ff6e2160d9d 17261->17268 17263 7ff6e2164f08 _get_daylight 11 API calls 17262->17263 17264 7ff6e2160d46 17263->17264 17266 7ff6e216a8e0 _invalid_parameter_noinfo 37 API calls 17264->17266 17267 7ff6e216a814 _invalid_parameter_noinfo 37 API calls 17265->17267 17273 7ff6e2160d51 17266->17273 17267->17273 17269 7ff6e2160e46 17268->17269 17271 7ff6e2164f08 _get_daylight 11 API calls 17268->17271 17270 7ff6e2164f08 _get_daylight 11 API calls 17269->17270 17269->17273 17272 7ff6e2160ef0 17270->17272 17274 7ff6e2160e3b 17271->17274 17276 7ff6e216a8e0 _invalid_parameter_noinfo 37 API calls 17272->17276 17273->17151 17275 7ff6e216a8e0 _invalid_parameter_noinfo 37 API calls 17274->17275 17275->17269 17276->17273 17282 7ff6e216ec3d 17277->17282 17278 7ff6e216ec42 17279 7ff6e21651dd 17278->17279 17280 7ff6e2164f08 _get_daylight 11 API calls 17278->17280 17279->17121 17279->17128 17281 7ff6e216ec4c 17280->17281 17283 7ff6e216a8e0 _invalid_parameter_noinfo 37 API calls 17281->17283 17282->17278 17282->17279 17284 7ff6e216ec8c 17282->17284 17283->17279 17284->17279 17285 7ff6e2164f08 _get_daylight 11 API calls 17284->17285 17285->17281 17287 7ff6e21585b1 GetTokenInformation 17286->17287 17289 7ff6e2158633 __vcrt_freefls 17286->17289 17288 7ff6e21585d2 GetLastError 17287->17288 17290 7ff6e21585dd 17287->17290 17288->17289 17288->17290 17291 7ff6e215864c 17289->17291 17292 7ff6e2158646 CloseHandle 17289->17292 17290->17289 17293 7ff6e21585f9 GetTokenInformation 17290->17293 17291->16389 17292->17291 17293->17289 17294 7ff6e215861c 17293->17294 17294->17289 17295 7ff6e2158626 ConvertSidToStringSidW 17294->17295 17295->17289 17297 7ff6e215c850 17296->17297 17298 7ff6e2152b74 GetCurrentProcessId 17297->17298 17299 7ff6e21526b0 48 API calls 17298->17299 17300 7ff6e2152bc7 17299->17300 17301 7ff6e2164bd8 48 API calls 17300->17301 17302 7ff6e2152c10 MessageBoxW 17301->17302 17303 7ff6e215c550 _log10_special 8 API calls 17302->17303 17304 7ff6e2152c40 17303->17304 17304->16399 17306 7ff6e21525e5 17305->17306 17307 7ff6e2164bd8 48 API calls 17306->17307 17308 7ff6e2152604 17307->17308 17308->16408 17354 7ff6e2168794 17309->17354 17313 7ff6e21581dc 17312->17313 17314 7ff6e2159390 2 API calls 17313->17314 17315 7ff6e21581fb 17314->17315 17316 7ff6e2158216 ExpandEnvironmentStringsW 17315->17316 17317 7ff6e2158203 17315->17317 17319 7ff6e215823c __vcrt_freefls 17316->17319 17318 7ff6e2152810 49 API calls 17317->17318 17343 7ff6e215820f __vcrt_freefls 17318->17343 17320 7ff6e2158253 17319->17320 17321 7ff6e2158240 17319->17321 17325 7ff6e21582bf 17320->17325 17326 7ff6e2158261 GetDriveTypeW 17320->17326 17323 7ff6e2152810 49 API calls 17321->17323 17322 7ff6e215c550 _log10_special 8 API calls 17324 7ff6e21583af 17322->17324 17323->17343 17324->16413 17344 7ff6e2168238 17324->17344 17492 7ff6e2167e08 17325->17492 17329 7ff6e2158295 17326->17329 17330 7ff6e21582b0 17326->17330 17332 7ff6e2152810 49 API calls 17329->17332 17485 7ff6e216796c 17330->17485 17331 7ff6e21582d1 17334 7ff6e21582d9 17331->17334 17337 7ff6e21582ec 17331->17337 17332->17343 17335 7ff6e2152810 49 API calls 17334->17335 17335->17343 17336 7ff6e215834e CreateDirectoryW 17339 7ff6e215835d GetLastError 17336->17339 17336->17343 17337->17336 17338 7ff6e21526b0 48 API calls 17337->17338 17340 7ff6e2158328 CreateDirectoryW 17338->17340 17339->17343 17340->17337 17343->17322 17345 7ff6e2168258 17344->17345 17346 7ff6e2168245 17344->17346 17593 7ff6e2167ebc 17345->17593 17347 7ff6e2164f08 _get_daylight 11 API calls 17346->17347 17349 7ff6e216824a 17347->17349 17351 7ff6e216a8e0 _invalid_parameter_noinfo 37 API calls 17349->17351 17352 7ff6e2168256 17351->17352 17352->16417 17395 7ff6e2171558 17354->17395 17454 7ff6e21712d0 17395->17454 17475 7ff6e21702d8 EnterCriticalSection 17454->17475 17486 7ff6e216798a 17485->17486 17489 7ff6e21679bd 17485->17489 17486->17489 17504 7ff6e2170474 17486->17504 17489->17343 17490 7ff6e216a900 _isindst 17 API calls 17491 7ff6e21679ed 17490->17491 17493 7ff6e2167e92 17492->17493 17494 7ff6e2167e24 17492->17494 17538 7ff6e21707c0 17493->17538 17494->17493 17495 7ff6e2167e29 17494->17495 17497 7ff6e2167e5e 17495->17497 17498 7ff6e2167e41 17495->17498 17521 7ff6e2167c4c GetFullPathNameW 17497->17521 17513 7ff6e2167bd8 GetFullPathNameW 17498->17513 17499 7ff6e2167e56 __vcrt_freefls 17499->17331 17505 7ff6e2170481 17504->17505 17506 7ff6e217048b 17504->17506 17505->17506 17510 7ff6e21704a7 17505->17510 17507 7ff6e2164f08 _get_daylight 11 API calls 17506->17507 17512 7ff6e2170493 17507->17512 17508 7ff6e216a8e0 _invalid_parameter_noinfo 37 API calls 17509 7ff6e21679b9 17508->17509 17509->17489 17509->17490 17510->17509 17511 7ff6e2164f08 _get_daylight 11 API calls 17510->17511 17511->17512 17512->17508 17514 7ff6e2167c14 17513->17514 17515 7ff6e2167bfe GetLastError 17513->17515 17517 7ff6e2167c10 17514->17517 17520 7ff6e2164f08 _get_daylight 11 API calls 17514->17520 17516 7ff6e2164e7c _fread_nolock 11 API calls 17515->17516 17518 7ff6e2167c0b 17516->17518 17517->17499 17519 7ff6e2164f08 _get_daylight 11 API calls 17518->17519 17519->17517 17520->17517 17522 7ff6e2167c7f GetLastError 17521->17522 17526 7ff6e2167c95 __vcrt_freefls 17521->17526 17523 7ff6e2164e7c _fread_nolock 11 API calls 17522->17523 17524 7ff6e2167c8c 17523->17524 17525 7ff6e2164f08 _get_daylight 11 API calls 17524->17525 17527 7ff6e2167c91 17525->17527 17526->17527 17528 7ff6e2167cef GetFullPathNameW 17526->17528 17529 7ff6e2167d24 17527->17529 17528->17522 17528->17527 17532 7ff6e2167d98 memcpy_s 17529->17532 17533 7ff6e2167d4d __scrt_get_show_window_mode 17529->17533 17530 7ff6e2167d81 17531 7ff6e2164f08 _get_daylight 11 API calls 17530->17531 17534 7ff6e2167d86 17531->17534 17532->17499 17533->17530 17533->17532 17535 7ff6e2167dba 17533->17535 17535->17532 17537 7ff6e2164f08 _get_daylight 11 API calls 17535->17537 17537->17534 17541 7ff6e21705d0 17538->17541 17542 7ff6e21705fb 17541->17542 17543 7ff6e2170612 17541->17543 17546 7ff6e2164f08 _get_daylight 11 API calls 17542->17546 17544 7ff6e2170616 17543->17544 17545 7ff6e2170637 17543->17545 17567 7ff6e217073c 17544->17567 17579 7ff6e216f5b8 17545->17579 17562 7ff6e2170600 17546->17562 17550 7ff6e217063c 17551 7ff6e217061f 17552 7ff6e216a8e0 _invalid_parameter_noinfo 37 API calls 17566 7ff6e217060b __vcrt_freefls 17552->17566 17557 7ff6e215c550 _log10_special 8 API calls 17561 7ff6e2170731 17557->17561 17561->17499 17562->17552 17566->17557 17568 7ff6e2170786 17567->17568 17569 7ff6e2170756 17567->17569 17570 7ff6e2170771 17568->17570 17571 7ff6e2170791 GetDriveTypeW 17568->17571 17572 7ff6e2164ee8 _fread_nolock 11 API calls 17569->17572 17575 7ff6e215c550 _log10_special 8 API calls 17570->17575 17571->17570 17573 7ff6e217075b 17572->17573 17574 7ff6e2164f08 _get_daylight 11 API calls 17573->17574 17576 7ff6e2170766 17574->17576 17577 7ff6e217061b 17575->17577 17577->17550 17577->17551 17580 7ff6e217a4d0 __scrt_get_show_window_mode 17579->17580 17581 7ff6e216f5ee GetCurrentDirectoryW 17580->17581 17582 7ff6e216f62c 17581->17582 17583 7ff6e216f605 17581->17583 17584 7ff6e216eb98 _get_daylight 11 API calls 17582->17584 17585 7ff6e215c550 _log10_special 8 API calls 17583->17585 17586 7ff6e216f63b 17584->17586 17587 7ff6e216f699 17585->17587 17587->17550 17600 7ff6e21702d8 EnterCriticalSection 17593->17600 17602 7ff6e215456a 17601->17602 17603 7ff6e2159390 2 API calls 17602->17603 17604 7ff6e215458f 17603->17604 17605 7ff6e215c550 _log10_special 8 API calls 17604->17605 17606 7ff6e21545b7 17605->17606 17606->16441 17609 7ff6e2157e2e 17607->17609 17608 7ff6e2157f52 17611 7ff6e215c550 _log10_special 8 API calls 17608->17611 17609->17608 17610 7ff6e2151c80 49 API calls 17609->17610 17615 7ff6e2157eb5 17610->17615 17612 7ff6e2157f83 17611->17612 17612->16441 17613 7ff6e2151c80 49 API calls 17613->17615 17614 7ff6e2154560 10 API calls 17614->17615 17615->17608 17615->17613 17615->17614 17616 7ff6e2159390 2 API calls 17615->17616 17617 7ff6e2157f23 CreateDirectoryW 17616->17617 17617->17608 17617->17615 17619 7ff6e2151637 17618->17619 17620 7ff6e2151613 17618->17620 17622 7ff6e21545c0 108 API calls 17619->17622 17739 7ff6e2151050 17620->17739 17624 7ff6e215164b 17622->17624 17623 7ff6e2151618 17625 7ff6e215162e 17623->17625 17629 7ff6e2152710 54 API calls 17623->17629 17626 7ff6e2151682 17624->17626 17627 7ff6e2151653 17624->17627 17625->16441 17628 7ff6e21545c0 108 API calls 17626->17628 17630 7ff6e2164f08 _get_daylight 11 API calls 17627->17630 17631 7ff6e2151696 17628->17631 17629->17625 17632 7ff6e2151658 17630->17632 17634 7ff6e21516b8 17631->17634 17635 7ff6e215169e 17631->17635 17633 7ff6e2152910 54 API calls 17632->17633 17636 7ff6e2151671 17633->17636 17638 7ff6e21606d4 73 API calls 17634->17638 17637 7ff6e2152710 54 API calls 17635->17637 17636->16441 17639 7ff6e21516ae 17637->17639 17640 7ff6e21516cd 17638->17640 17645 7ff6e216004c 74 API calls 17639->17645 17641 7ff6e21516f9 17640->17641 17642 7ff6e21516d1 17640->17642 17643 7ff6e2151717 17641->17643 17644 7ff6e21516ff 17641->17644 17646 7ff6e2164f08 _get_daylight 11 API calls 17642->17646 17651 7ff6e2151739 17643->17651 17661 7ff6e2151761 17643->17661 17717 7ff6e2151210 17644->17717 17648 7ff6e2151829 17645->17648 17649 7ff6e21516d6 17646->17649 17648->16441 17650 7ff6e2152910 54 API calls 17649->17650 17657 7ff6e21516ef __vcrt_freefls 17650->17657 17653 7ff6e2164f08 _get_daylight 11 API calls 17651->17653 17652 7ff6e216004c 74 API calls 17652->17639 17654 7ff6e215173e 17653->17654 17655 7ff6e2152910 54 API calls 17654->17655 17655->17657 17656 7ff6e216039c _fread_nolock 53 API calls 17656->17661 17657->17652 17658 7ff6e21517da 17660 7ff6e2164f08 _get_daylight 11 API calls 17658->17660 17662 7ff6e21517ca 17660->17662 17661->17656 17661->17657 17661->17658 17663 7ff6e21517c5 17661->17663 17770 7ff6e2160adc 17661->17770 17665 7ff6e2152910 54 API calls 17662->17665 17664 7ff6e2164f08 _get_daylight 11 API calls 17663->17664 17664->17662 17665->17657 17667 7ff6e215718b 17666->17667 17669 7ff6e2157144 17666->17669 17667->16441 17669->17667 17803 7ff6e2165024 17669->17803 17671 7ff6e21541a1 17670->17671 17672 7ff6e21544e0 49 API calls 17671->17672 17673 7ff6e21541db 17672->17673 17674 7ff6e21544e0 49 API calls 17673->17674 17675 7ff6e21541eb 17674->17675 17676 7ff6e215423c 17675->17676 17677 7ff6e215420d 17675->17677 17678 7ff6e2154110 51 API calls 17676->17678 17834 7ff6e2154110 17677->17834 17680 7ff6e215423a 17678->17680 17681 7ff6e215429c 17680->17681 17682 7ff6e2154267 17680->17682 17684 7ff6e2154110 51 API calls 17681->17684 17841 7ff6e2157cf0 17682->17841 17686 7ff6e21542c0 17684->17686 17689 7ff6e2154110 51 API calls 17686->17689 17695 7ff6e2154312 17686->17695 17687 7ff6e2154393 17690 7ff6e2151950 115 API calls 17687->17690 17688 7ff6e2152710 54 API calls 17692 7ff6e2154297 17688->17692 17693 7ff6e21542e9 17689->17693 17694 7ff6e215439d 17690->17694 17691 7ff6e215c550 _log10_special 8 API calls 17696 7ff6e2154435 17691->17696 17692->17691 17693->17695 17699 7ff6e2154110 51 API calls 17693->17699 17697 7ff6e21543a5 17694->17697 17698 7ff6e21543fe 17694->17698 17695->17687 17701 7ff6e215438c 17695->17701 17703 7ff6e2154317 17695->17703 17705 7ff6e215437b 17695->17705 17696->16441 17867 7ff6e2151840 17697->17867 17700 7ff6e2152710 54 API calls 17698->17700 17699->17695 17700->17703 17701->17697 17701->17703 17706 7ff6e2152710 54 API calls 17703->17706 17709 7ff6e2152710 54 API calls 17705->17709 17706->17692 17707 7ff6e21543bc 17710 7ff6e2152710 54 API calls 17707->17710 17708 7ff6e21543d2 17711 7ff6e2151600 118 API calls 17708->17711 17709->17703 17710->17692 17712 7ff6e21543e0 17711->17712 17712->17692 17713 7ff6e2152710 54 API calls 17712->17713 17713->17692 17715 7ff6e2151c80 49 API calls 17714->17715 17716 7ff6e2154474 17715->17716 17716->16441 17718 7ff6e2151268 17717->17718 17719 7ff6e2151297 17718->17719 17720 7ff6e215126f 17718->17720 17723 7ff6e21512d4 17719->17723 17724 7ff6e21512b1 17719->17724 17721 7ff6e2152710 54 API calls 17720->17721 17722 7ff6e2151282 17721->17722 17722->17657 17727 7ff6e21512e6 17723->17727 17737 7ff6e2151309 memcpy_s 17723->17737 17725 7ff6e2164f08 _get_daylight 11 API calls 17724->17725 17726 7ff6e21512b6 17725->17726 17728 7ff6e2152910 54 API calls 17726->17728 17729 7ff6e2164f08 _get_daylight 11 API calls 17727->17729 17733 7ff6e21512cf __vcrt_freefls 17728->17733 17730 7ff6e21512eb 17729->17730 17732 7ff6e2152910 54 API calls 17730->17732 17731 7ff6e216039c _fread_nolock 53 API calls 17731->17737 17732->17733 17733->17657 17734 7ff6e21513cf 17735 7ff6e2152710 54 API calls 17734->17735 17735->17733 17736 7ff6e2160adc 76 API calls 17736->17737 17737->17731 17737->17733 17737->17734 17737->17736 17738 7ff6e2160110 37 API calls 17737->17738 17738->17737 17740 7ff6e21545c0 108 API calls 17739->17740 17741 7ff6e215108c 17740->17741 17742 7ff6e21510a9 17741->17742 17743 7ff6e2151094 17741->17743 17744 7ff6e21606d4 73 API calls 17742->17744 17745 7ff6e2152710 54 API calls 17743->17745 17746 7ff6e21510bf 17744->17746 17751 7ff6e21510a4 __vcrt_freefls 17745->17751 17747 7ff6e21510e6 17746->17747 17748 7ff6e21510c3 17746->17748 17753 7ff6e21510f7 17747->17753 17754 7ff6e2151122 17747->17754 17749 7ff6e2164f08 _get_daylight 11 API calls 17748->17749 17750 7ff6e21510c8 17749->17750 17752 7ff6e2152910 54 API calls 17750->17752 17751->17623 17760 7ff6e21510e1 __vcrt_freefls 17752->17760 17756 7ff6e2164f08 _get_daylight 11 API calls 17753->17756 17755 7ff6e2151129 17754->17755 17764 7ff6e215113c 17754->17764 17757 7ff6e2151210 92 API calls 17755->17757 17758 7ff6e2151100 17756->17758 17757->17760 17761 7ff6e2152910 54 API calls 17758->17761 17759 7ff6e216004c 74 API calls 17762 7ff6e21511b4 17759->17762 17760->17759 17761->17760 17762->17751 17774 7ff6e21546f0 17762->17774 17763 7ff6e216039c _fread_nolock 53 API calls 17763->17764 17764->17760 17764->17763 17766 7ff6e21511ed 17764->17766 17767 7ff6e2164f08 _get_daylight 11 API calls 17766->17767 17768 7ff6e21511f2 17767->17768 17769 7ff6e2152910 54 API calls 17768->17769 17769->17760 17771 7ff6e2160b0c 17770->17771 17788 7ff6e216082c 17771->17788 17773 7ff6e2160b2a 17773->17661 17775 7ff6e2154700 17774->17775 17776 7ff6e2159390 2 API calls 17775->17776 17777 7ff6e215472b 17776->17777 17778 7ff6e215479e 17777->17778 17779 7ff6e2159390 2 API calls 17777->17779 17780 7ff6e215c550 _log10_special 8 API calls 17778->17780 17781 7ff6e2154746 17779->17781 17782 7ff6e21547b9 17780->17782 17781->17778 17783 7ff6e215474b CreateSymbolicLinkW 17781->17783 17782->17751 17783->17778 17784 7ff6e2154775 17783->17784 17784->17778 17785 7ff6e215477e GetLastError 17784->17785 17785->17778 17789 7ff6e216084c 17788->17789 17790 7ff6e2160879 17788->17790 17789->17790 17791 7ff6e2160856 17789->17791 17792 7ff6e2160881 17789->17792 17790->17773 17793 7ff6e216a814 _invalid_parameter_noinfo 37 API calls 17791->17793 17795 7ff6e216076c 17792->17795 17793->17790 17802 7ff6e216546c EnterCriticalSection 17795->17802 17804 7ff6e216505e 17803->17804 17805 7ff6e2165031 17803->17805 17808 7ff6e2165081 17804->17808 17809 7ff6e216509d 17804->17809 17806 7ff6e2164f08 _get_daylight 11 API calls 17805->17806 17807 7ff6e2164fe8 17805->17807 17810 7ff6e216503b 17806->17810 17807->17669 17811 7ff6e2164f08 _get_daylight 11 API calls 17808->17811 17818 7ff6e2164f4c 17809->17818 17813 7ff6e216a8e0 _invalid_parameter_noinfo 37 API calls 17810->17813 17814 7ff6e2165086 17811->17814 17816 7ff6e2165046 17813->17816 17815 7ff6e216a8e0 _invalid_parameter_noinfo 37 API calls 17814->17815 17817 7ff6e2165091 17815->17817 17816->17669 17817->17669 17819 7ff6e2164f70 17818->17819 17825 7ff6e2164f6b 17818->17825 17820 7ff6e216b150 _CreateFrameInfo 45 API calls 17819->17820 17819->17825 17821 7ff6e2164f8b 17820->17821 17826 7ff6e216d984 17821->17826 17825->17817 17827 7ff6e216d999 17826->17827 17829 7ff6e2164fae 17826->17829 17828 7ff6e2173304 45 API calls 17827->17828 17827->17829 17828->17829 17830 7ff6e216d9f0 17829->17830 17831 7ff6e216da18 17830->17831 17832 7ff6e216da05 17830->17832 17831->17825 17832->17831 17833 7ff6e2172650 45 API calls 17832->17833 17833->17831 17835 7ff6e2154136 17834->17835 17836 7ff6e2164984 49 API calls 17835->17836 17837 7ff6e215415c 17836->17837 17838 7ff6e215416d 17837->17838 17839 7ff6e2154560 10 API calls 17837->17839 17838->17680 17840 7ff6e215417f 17839->17840 17840->17680 17842 7ff6e2157d05 17841->17842 17843 7ff6e21545c0 108 API calls 17842->17843 17844 7ff6e2157d2b 17843->17844 17845 7ff6e21545c0 108 API calls 17844->17845 17859 7ff6e2157d52 17844->17859 17846 7ff6e2157d42 17845->17846 17848 7ff6e2157d5c 17846->17848 17849 7ff6e2157d4d 17846->17849 17847 7ff6e215c550 _log10_special 8 API calls 17850 7ff6e2154277 17847->17850 17871 7ff6e21600e4 17848->17871 17851 7ff6e216004c 74 API calls 17849->17851 17850->17688 17850->17692 17851->17859 17853 7ff6e2157d61 17855 7ff6e216039c _fread_nolock 53 API calls 17853->17855 17858 7ff6e2157dc6 17853->17858 17860 7ff6e2160adc 76 API calls 17853->17860 17862 7ff6e2157dc1 17853->17862 17863 7ff6e2160110 37 API calls 17853->17863 17865 7ff6e2157dbf 17853->17865 17866 7ff6e21600e4 37 API calls 17853->17866 17854 7ff6e216004c 74 API calls 17855->17853 17861 7ff6e2160110 37 API calls 17858->17861 17859->17847 17860->17853 17861->17862 17862->17865 17877 7ff6e2167318 17862->17877 17863->17853 17865->17854 17866->17853 17869 7ff6e21518d5 17867->17869 17870 7ff6e2151865 17867->17870 17868 7ff6e2165024 45 API calls 17868->17870 17869->17707 17869->17708 17870->17868 17870->17869 17872 7ff6e21600ed 17871->17872 17876 7ff6e21600fd 17871->17876 17873 7ff6e2164f08 _get_daylight 11 API calls 17872->17873 17874 7ff6e21600f2 17873->17874 17875 7ff6e216a8e0 _invalid_parameter_noinfo 37 API calls 17874->17875 17875->17876 17876->17853 17878 7ff6e2167320 17877->17878 17898 7ff6e2165ec8 17897->17898 17899 7ff6e2165eee 17898->17899 17902 7ff6e2165f21 17898->17902 17900 7ff6e2164f08 _get_daylight 11 API calls 17899->17900 17901 7ff6e2165ef3 17900->17901 17903 7ff6e216a8e0 _invalid_parameter_noinfo 37 API calls 17901->17903 17904 7ff6e2165f27 17902->17904 17905 7ff6e2165f34 17902->17905 17906 7ff6e2154616 17903->17906 17907 7ff6e2164f08 _get_daylight 11 API calls 17904->17907 17916 7ff6e216ac28 17905->17916 17906->16477 17907->17906 17929 7ff6e21702d8 EnterCriticalSection 17916->17929 18289 7ff6e21678f8 18288->18289 18292 7ff6e21673d4 18289->18292 18291 7ff6e2167911 18291->16487 18293 7ff6e21673ef 18292->18293 18294 7ff6e216741e 18292->18294 18295 7ff6e216a814 _invalid_parameter_noinfo 37 API calls 18293->18295 18302 7ff6e216546c EnterCriticalSection 18294->18302 18299 7ff6e216740f 18295->18299 18299->18291 18304 7ff6e215fe43 18303->18304 18307 7ff6e215fe71 18303->18307 18305 7ff6e216a814 _invalid_parameter_noinfo 37 API calls 18304->18305 18306 7ff6e215fe63 18305->18306 18306->16491 18307->18306 18313 7ff6e216546c EnterCriticalSection 18307->18313 18315 7ff6e21545c0 108 API calls 18314->18315 18316 7ff6e2151493 18315->18316 18317 7ff6e215149b 18316->18317 18318 7ff6e21514bc 18316->18318 18319 7ff6e2152710 54 API calls 18317->18319 18320 7ff6e21606d4 73 API calls 18318->18320 18322 7ff6e21514ab 18319->18322 18321 7ff6e21514d1 18320->18321 18323 7ff6e21514f8 18321->18323 18324 7ff6e21514d5 18321->18324 18322->16524 18328 7ff6e2151508 18323->18328 18329 7ff6e2151532 18323->18329 18325 7ff6e2164f08 _get_daylight 11 API calls 18324->18325 18326 7ff6e21514da 18325->18326 18327 7ff6e2152910 54 API calls 18326->18327 18334 7ff6e21514f3 __vcrt_freefls 18327->18334 18330 7ff6e2164f08 _get_daylight 11 API calls 18328->18330 18331 7ff6e2151538 18329->18331 18339 7ff6e215154b 18329->18339 18333 7ff6e2151510 18330->18333 18332 7ff6e2151210 92 API calls 18331->18332 18332->18334 18335 7ff6e2152910 54 API calls 18333->18335 18336 7ff6e216004c 74 API calls 18334->18336 18335->18334 18337 7ff6e21515c4 18336->18337 18337->16524 18338 7ff6e216039c _fread_nolock 53 API calls 18338->18339 18339->18334 18339->18338 18340 7ff6e21515d6 18339->18340 18341 7ff6e2164f08 _get_daylight 11 API calls 18340->18341 18342 7ff6e21515db 18341->18342 18343 7ff6e2152910 54 API calls 18342->18343 18343->18334 18345 7ff6e2159390 2 API calls 18344->18345 18346 7ff6e2158e94 LoadLibraryExW 18345->18346 18347 7ff6e2158eb3 __vcrt_freefls 18346->18347 18347->16558 18421 7ff6e2156375 18420->18421 18422 7ff6e2151c80 49 API calls 18421->18422 18423 7ff6e21563b1 18422->18423 18424 7ff6e21563ba 18423->18424 18425 7ff6e21563dd 18423->18425 18427 7ff6e2152710 54 API calls 18424->18427 18426 7ff6e2154630 49 API calls 18425->18426 18428 7ff6e21563f5 18426->18428 18444 7ff6e21563d3 18427->18444 18429 7ff6e2156413 18428->18429 18430 7ff6e2152710 54 API calls 18428->18430 18431 7ff6e2154560 10 API calls 18429->18431 18430->18429 18433 7ff6e215641d 18431->18433 18432 7ff6e215c550 _log10_special 8 API calls 18434 7ff6e215336e 18432->18434 18435 7ff6e215642b 18433->18435 18436 7ff6e2158e80 3 API calls 18433->18436 18434->16598 18451 7ff6e2156500 18434->18451 18437 7ff6e2154630 49 API calls 18435->18437 18436->18435 18438 7ff6e2156444 18437->18438 18439 7ff6e2156469 18438->18439 18440 7ff6e2156449 18438->18440 18441 7ff6e2158e80 3 API calls 18439->18441 18442 7ff6e2152710 54 API calls 18440->18442 18443 7ff6e2156476 18441->18443 18442->18444 18445 7ff6e2156482 18443->18445 18446 7ff6e21564c1 18443->18446 18444->18432 18447 7ff6e2159390 2 API calls 18445->18447 18510 7ff6e2155830 GetProcAddress 18446->18510 18449 7ff6e215649a GetLastError 18447->18449 18450 7ff6e2152c50 51 API calls 18449->18450 18450->18444 18600 7ff6e2155400 18451->18600 18453 7ff6e2156526 18454 7ff6e215652e 18453->18454 18455 7ff6e215653f 18453->18455 18456 7ff6e2152710 54 API calls 18454->18456 18607 7ff6e2154c90 18455->18607 18462 7ff6e215653a 18456->18462 18459 7ff6e215654b 18461 7ff6e2152710 54 API calls 18459->18461 18460 7ff6e215655c 18463 7ff6e215656c 18460->18463 18465 7ff6e215657d 18460->18465 18461->18462 18462->16594 18464 7ff6e2152710 54 API calls 18463->18464 18464->18462 18466 7ff6e215659c 18465->18466 18467 7ff6e21565ad 18465->18467 18468 7ff6e2152710 54 API calls 18466->18468 18469 7ff6e21565bc 18467->18469 18470 7ff6e21565cd 18467->18470 18468->18462 18489 7ff6e2156070 18488->18489 18489->18489 18490 7ff6e2156099 18489->18490 18496 7ff6e21560b0 __vcrt_freefls 18489->18496 18491 7ff6e2152710 54 API calls 18490->18491 18492 7ff6e21560a5 18491->18492 18492->16596 18493 7ff6e21561bb 18493->16596 18494 7ff6e2151470 116 API calls 18494->18496 18495 7ff6e2152710 54 API calls 18495->18496 18496->18493 18496->18494 18496->18495 18511 7ff6e2155852 GetLastError 18510->18511 18512 7ff6e215587f GetProcAddress 18510->18512 18513 7ff6e215585f 18511->18513 18514 7ff6e21558aa GetProcAddress 18512->18514 18515 7ff6e215589b GetLastError 18512->18515 18516 7ff6e2152c50 51 API calls 18513->18516 18517 7ff6e21558c6 GetLastError 18514->18517 18518 7ff6e21558d5 GetProcAddress 18514->18518 18515->18513 18519 7ff6e2155874 18516->18519 18517->18513 18520 7ff6e2155903 GetProcAddress 18518->18520 18521 7ff6e21558f1 GetLastError 18518->18521 18519->18444 18522 7ff6e215591f GetLastError 18520->18522 18523 7ff6e2155931 GetProcAddress 18520->18523 18521->18513 18522->18513 18602 7ff6e215542c 18600->18602 18601 7ff6e2155434 18601->18453 18602->18601 18605 7ff6e21555d4 18602->18605 18631 7ff6e2166aa4 18602->18631 18603 7ff6e2155797 __vcrt_freefls 18603->18453 18604 7ff6e21547d0 47 API calls 18604->18605 18605->18603 18605->18604 18608 7ff6e2154cc0 18607->18608 18609 7ff6e215c550 _log10_special 8 API calls 18608->18609 18610 7ff6e2154d2a 18609->18610 18610->18459 18610->18460 18632 7ff6e2166ad4 18631->18632 18635 7ff6e2165fa0 18632->18635 18634 7ff6e2166b04 18634->18602 18636 7ff6e2165fe3 18635->18636 18637 7ff6e2165fd1 18635->18637 18638 7ff6e216602d 18636->18638 18640 7ff6e2165ff0 18636->18640 18639 7ff6e2164f08 _get_daylight 11 API calls 18637->18639 18641 7ff6e2166048 18638->18641 18644 7ff6e21647c0 45 API calls 18638->18644 18642 7ff6e2165fd6 18639->18642 18643 7ff6e216a814 _invalid_parameter_noinfo 37 API calls 18640->18643 18647 7ff6e216606a 18641->18647 18656 7ff6e2166a2c 18641->18656 18646 7ff6e216a8e0 _invalid_parameter_noinfo 37 API calls 18642->18646 18654 7ff6e2165fe1 18643->18654 18644->18641 18646->18654 18648 7ff6e216610b 18647->18648 18650 7ff6e2164f08 _get_daylight 11 API calls 18647->18650 18649 7ff6e2164f08 _get_daylight 11 API calls 18648->18649 18648->18654 18651 7ff6e21661b6 18649->18651 18652 7ff6e2166100 18650->18652 18653 7ff6e216a8e0 _invalid_parameter_noinfo 37 API calls 18651->18653 18655 7ff6e216a8e0 _invalid_parameter_noinfo 37 API calls 18652->18655 18653->18654 18654->18634 18655->18648 18657 7ff6e2166a66 18656->18657 18658 7ff6e2166a4f 18656->18658 18660 7ff6e2166a54 18657->18660 18667 7ff6e216ff98 18657->18667 18662 7ff6e216ff68 18658->18662 18660->18641 18663 7ff6e216b150 _CreateFrameInfo 45 API calls 18662->18663 18664 7ff6e216ff71 18663->18664 18668 7ff6e2164f4c 45 API calls 18667->18668 18670 7ff6e216ffd1 18668->18670 18708->16601 18710 7ff6e216b150 _CreateFrameInfo 45 API calls 18709->18710 18711 7ff6e216a3e1 18710->18711 18714 7ff6e216a504 18711->18714 18723 7ff6e2173650 18714->18723 18749 7ff6e2173608 18723->18749 18754 7ff6e21702d8 EnterCriticalSection 18749->18754 19022 7ff6e2169d50 19025 7ff6e2169ccc 19022->19025 19032 7ff6e21702d8 EnterCriticalSection 19025->19032 19251 7ff6e216afd0 19252 7ff6e216afd5 19251->19252 19253 7ff6e216afea 19251->19253 19257 7ff6e216aff0 19252->19257 19258 7ff6e216b032 19257->19258 19259 7ff6e216b03a 19257->19259 19260 7ff6e216a948 __free_lconv_num 11 API calls 19258->19260 19261 7ff6e216a948 __free_lconv_num 11 API calls 19259->19261 19260->19259 19262 7ff6e216b047 19261->19262 19263 7ff6e216a948 __free_lconv_num 11 API calls 19262->19263 19264 7ff6e216b054 19263->19264 19265 7ff6e216a948 __free_lconv_num 11 API calls 19264->19265 19266 7ff6e216b061 19265->19266 19267 7ff6e216a948 __free_lconv_num 11 API calls 19266->19267 19268 7ff6e216b06e 19267->19268 19269 7ff6e216a948 __free_lconv_num 11 API calls 19268->19269 19270 7ff6e216b07b 19269->19270 19271 7ff6e216a948 __free_lconv_num 11 API calls 19270->19271 19272 7ff6e216b088 19271->19272 19273 7ff6e216a948 __free_lconv_num 11 API calls 19272->19273 19274 7ff6e216b095 19273->19274 19275 7ff6e216a948 __free_lconv_num 11 API calls 19274->19275 19276 7ff6e216b0a5 19275->19276 19277 7ff6e216a948 __free_lconv_num 11 API calls 19276->19277 19278 7ff6e216b0b5 19277->19278 19283 7ff6e216ae94 19278->19283 19297 7ff6e21702d8 EnterCriticalSection 19283->19297 19036 7ff6e215cb50 19037 7ff6e215cb60 19036->19037 19053 7ff6e2169ba8 19037->19053 19039 7ff6e215cb6c 19059 7ff6e215ce48 19039->19059 19041 7ff6e215d12c 7 API calls 19043 7ff6e215cc05 19041->19043 19042 7ff6e215cb84 _RTC_Initialize 19051 7ff6e215cbd9 19042->19051 19064 7ff6e215cff8 19042->19064 19045 7ff6e215cb99 19067 7ff6e2169014 19045->19067 19051->19041 19052 7ff6e215cbf5 19051->19052 19054 7ff6e2169bb9 19053->19054 19055 7ff6e2169bc1 19054->19055 19056 7ff6e2164f08 _get_daylight 11 API calls 19054->19056 19055->19039 19057 7ff6e2169bd0 19056->19057 19058 7ff6e216a8e0 _invalid_parameter_noinfo 37 API calls 19057->19058 19058->19055 19060 7ff6e215ce59 19059->19060 19063 7ff6e215ce5e __scrt_acquire_startup_lock 19059->19063 19061 7ff6e215d12c 7 API calls 19060->19061 19060->19063 19062 7ff6e215ced2 19061->19062 19063->19042 19092 7ff6e215cfbc 19064->19092 19066 7ff6e215d001 19066->19045 19068 7ff6e2169034 19067->19068 19069 7ff6e215cba5 19067->19069 19070 7ff6e216903c 19068->19070 19071 7ff6e2169052 GetModuleFileNameW 19068->19071 19069->19051 19091 7ff6e215d0cc InitializeSListHead 19069->19091 19072 7ff6e2164f08 _get_daylight 11 API calls 19070->19072 19075 7ff6e216907d 19071->19075 19073 7ff6e2169041 19072->19073 19074 7ff6e216a8e0 _invalid_parameter_noinfo 37 API calls 19073->19074 19074->19069 19107 7ff6e2168fb4 19075->19107 19078 7ff6e21690c5 19079 7ff6e2164f08 _get_daylight 11 API calls 19078->19079 19080 7ff6e21690ca 19079->19080 19081 7ff6e216a948 __free_lconv_num 11 API calls 19080->19081 19081->19069 19082 7ff6e21690dd 19083 7ff6e21690ff 19082->19083 19085 7ff6e216912b 19082->19085 19086 7ff6e2169144 19082->19086 19084 7ff6e216a948 __free_lconv_num 11 API calls 19083->19084 19084->19069 19087 7ff6e216a948 __free_lconv_num 11 API calls 19085->19087 19088 7ff6e216a948 __free_lconv_num 11 API calls 19086->19088 19089 7ff6e2169134 19087->19089 19088->19083 19090 7ff6e216a948 __free_lconv_num 11 API calls 19089->19090 19090->19069 19093 7ff6e215cfd6 19092->19093 19095 7ff6e215cfcf 19092->19095 19096 7ff6e216a1ec 19093->19096 19095->19066 19099 7ff6e2169e28 19096->19099 19106 7ff6e21702d8 EnterCriticalSection 19099->19106 19108 7ff6e2168fcc 19107->19108 19112 7ff6e2169004 19107->19112 19109 7ff6e216eb98 _get_daylight 11 API calls 19108->19109 19108->19112 19110 7ff6e2168ffa 19109->19110 19111 7ff6e216a948 __free_lconv_num 11 API calls 19110->19111 19111->19112 19112->19078 19112->19082 19299 7ff6e2177c20 19302 7ff6e21725f0 19299->19302 19303 7ff6e21725fd 19302->19303 19307 7ff6e2172642 19302->19307 19308 7ff6e216b224 19303->19308 19309 7ff6e216b235 FlsGetValue 19308->19309 19310 7ff6e216b250 FlsSetValue 19308->19310 19312 7ff6e216b242 19309->19312 19313 7ff6e216b24a 19309->19313 19311 7ff6e216b25d 19310->19311 19310->19312 19315 7ff6e216eb98 _get_daylight 11 API calls 19311->19315 19314 7ff6e216a504 _CreateFrameInfo 45 API calls 19312->19314 19316 7ff6e216b248 19312->19316 19313->19310 19317 7ff6e216b2c5 19314->19317 19318 7ff6e216b26c 19315->19318 19328 7ff6e21722c4 19316->19328 19319 7ff6e216b28a FlsSetValue 19318->19319 19320 7ff6e216b27a FlsSetValue 19318->19320 19322 7ff6e216b2a8 19319->19322 19323 7ff6e216b296 FlsSetValue 19319->19323 19321 7ff6e216b283 19320->19321 19324 7ff6e216a948 __free_lconv_num 11 API calls 19321->19324 19325 7ff6e216aef4 _get_daylight 11 API calls 19322->19325 19323->19321 19324->19312 19326 7ff6e216b2b0 19325->19326 19327 7ff6e216a948 __free_lconv_num 11 API calls 19326->19327 19327->19316 19351 7ff6e2172534 19328->19351 19330 7ff6e21722f9 19366 7ff6e2171fc4 19330->19366 19333 7ff6e216d5fc _fread_nolock 12 API calls 19334 7ff6e2172327 19333->19334 19335 7ff6e217232f 19334->19335 19338 7ff6e217233e 19334->19338 19336 7ff6e216a948 __free_lconv_num 11 API calls 19335->19336 19337 7ff6e2172316 19336->19337 19337->19307 19338->19338 19373 7ff6e217266c 19338->19373 19341 7ff6e217243a 19342 7ff6e2164f08 _get_daylight 11 API calls 19341->19342 19343 7ff6e217243f 19342->19343 19345 7ff6e216a948 __free_lconv_num 11 API calls 19343->19345 19344 7ff6e2172495 19347 7ff6e21724fc 19344->19347 19384 7ff6e2171df4 19344->19384 19345->19337 19346 7ff6e2172454 19346->19344 19350 7ff6e216a948 __free_lconv_num 11 API calls 19346->19350 19349 7ff6e216a948 __free_lconv_num 11 API calls 19347->19349 19349->19337 19350->19344 19352 7ff6e2172557 19351->19352 19353 7ff6e2172561 19352->19353 19399 7ff6e21702d8 EnterCriticalSection 19352->19399 19356 7ff6e21725d3 19353->19356 19358 7ff6e216a504 _CreateFrameInfo 45 API calls 19353->19358 19356->19330 19360 7ff6e21725eb 19358->19360 19362 7ff6e2172642 19360->19362 19363 7ff6e216b224 50 API calls 19360->19363 19362->19330 19364 7ff6e217262c 19363->19364 19365 7ff6e21722c4 65 API calls 19364->19365 19365->19362 19367 7ff6e2164f4c 45 API calls 19366->19367 19368 7ff6e2171fd8 19367->19368 19369 7ff6e2171ff6 19368->19369 19370 7ff6e2171fe4 GetOEMCP 19368->19370 19371 7ff6e217200b 19369->19371 19372 7ff6e2171ffb GetACP 19369->19372 19370->19371 19371->19333 19371->19337 19372->19371 19374 7ff6e2171fc4 47 API calls 19373->19374 19375 7ff6e2172699 19374->19375 19377 7ff6e21726d6 IsValidCodePage 19375->19377 19382 7ff6e21727ef 19375->19382 19383 7ff6e21726f0 __scrt_get_show_window_mode 19375->19383 19376 7ff6e215c550 _log10_special 8 API calls 19378 7ff6e2172431 19376->19378 19379 7ff6e21726e7 19377->19379 19377->19382 19378->19341 19378->19346 19380 7ff6e2172716 GetCPInfo 19379->19380 19379->19383 19380->19382 19380->19383 19382->19376 19400 7ff6e21720dc 19383->19400 19456 7ff6e21702d8 EnterCriticalSection 19384->19456 19401 7ff6e2172119 GetCPInfo 19400->19401 19402 7ff6e217220f 19400->19402 19401->19402 19407 7ff6e217212c 19401->19407 19403 7ff6e215c550 _log10_special 8 API calls 19402->19403 19405 7ff6e21722ae 19403->19405 19404 7ff6e2172e40 48 API calls 19406 7ff6e21721a3 19404->19406 19405->19382 19411 7ff6e2177b84 19406->19411 19407->19404 19410 7ff6e2177b84 54 API calls 19410->19402 19412 7ff6e2164f4c 45 API calls 19411->19412 19413 7ff6e2177ba9 19412->19413 19416 7ff6e2177850 19413->19416 19417 7ff6e2177891 19416->19417 19418 7ff6e216f8a0 _fread_nolock MultiByteToWideChar 19417->19418 19421 7ff6e21778db 19418->19421 19419 7ff6e2177b59 19420 7ff6e215c550 _log10_special 8 API calls 19419->19420 19422 7ff6e21721d6 19420->19422 19421->19419 19423 7ff6e216d5fc _fread_nolock 12 API calls 19421->19423 19424 7ff6e2177a11 19421->19424 19426 7ff6e2177913 19421->19426 19422->19410 19423->19426 19424->19419 19425 7ff6e216a948 __free_lconv_num 11 API calls 19424->19425 19425->19419 19426->19424 19427 7ff6e216f8a0 _fread_nolock MultiByteToWideChar 19426->19427 19428 7ff6e2177986 19427->19428 19428->19424 19447 7ff6e216f0e4 19428->19447 19431 7ff6e2177a22 19434 7ff6e216d5fc _fread_nolock 12 API calls 19431->19434 19435 7ff6e2177af4 19431->19435 19437 7ff6e2177a40 19431->19437 19432 7ff6e21779d1 19432->19424 19433 7ff6e216f0e4 __crtLCMapStringW 6 API calls 19432->19433 19433->19424 19434->19437 19435->19424 19436 7ff6e216a948 __free_lconv_num 11 API calls 19435->19436 19436->19424 19437->19424 19438 7ff6e216f0e4 __crtLCMapStringW 6 API calls 19437->19438 19439 7ff6e2177ac0 19438->19439 19439->19435 19440 7ff6e2177af6 19439->19440 19441 7ff6e2177ae0 19439->19441 19443 7ff6e21707e8 WideCharToMultiByte 19440->19443 19442 7ff6e21707e8 WideCharToMultiByte 19441->19442 19444 7ff6e2177aee 19442->19444 19443->19444 19444->19435 19445 7ff6e2177b0e 19444->19445 19445->19424 19446 7ff6e216a948 __free_lconv_num 11 API calls 19445->19446 19446->19424 19448 7ff6e216ed10 __crtLCMapStringW 5 API calls 19447->19448 19449 7ff6e216f122 19448->19449 19451 7ff6e216f12a 19449->19451 19453 7ff6e216f1d0 19449->19453 19451->19424 19451->19431 19451->19432 19452 7ff6e216f193 LCMapStringW 19452->19451 19454 7ff6e216ed10 __crtLCMapStringW 5 API calls 19453->19454 19455 7ff6e216f1fe __crtLCMapStringW 19454->19455 19455->19452 20603 7ff6e216c520 20614 7ff6e21702d8 EnterCriticalSection 20603->20614 18758 7ff6e2165628 18759 7ff6e2165642 18758->18759 18760 7ff6e216565f 18758->18760 18761 7ff6e2164ee8 _fread_nolock 11 API calls 18759->18761 18760->18759 18762 7ff6e2165672 CreateFileW 18760->18762 18763 7ff6e2165647 18761->18763 18764 7ff6e21656dc 18762->18764 18765 7ff6e21656a6 18762->18765 18767 7ff6e2164f08 _get_daylight 11 API calls 18763->18767 18809 7ff6e2165c04 18764->18809 18783 7ff6e216577c GetFileType 18765->18783 18770 7ff6e216564f 18767->18770 18774 7ff6e216a8e0 _invalid_parameter_noinfo 37 API calls 18770->18774 18772 7ff6e21656e5 18778 7ff6e2164e7c _fread_nolock 11 API calls 18772->18778 18773 7ff6e2165710 18830 7ff6e21659c4 18773->18830 18777 7ff6e216565a 18774->18777 18775 7ff6e21656bb CloseHandle 18775->18777 18776 7ff6e21656d1 CloseHandle 18776->18777 18782 7ff6e21656ef 18778->18782 18782->18777 18784 7ff6e21657ca 18783->18784 18785 7ff6e2165887 18783->18785 18786 7ff6e21657f6 GetFileInformationByHandle 18784->18786 18789 7ff6e2165b00 21 API calls 18784->18789 18787 7ff6e216588f 18785->18787 18788 7ff6e21658b1 18785->18788 18790 7ff6e21658a2 GetLastError 18786->18790 18791 7ff6e216581f 18786->18791 18787->18790 18792 7ff6e2165893 18787->18792 18793 7ff6e21658d4 PeekNamedPipe 18788->18793 18800 7ff6e2165872 18788->18800 18794 7ff6e21657e4 18789->18794 18797 7ff6e2164e7c _fread_nolock 11 API calls 18790->18797 18795 7ff6e21659c4 51 API calls 18791->18795 18796 7ff6e2164f08 _get_daylight 11 API calls 18792->18796 18793->18800 18794->18786 18794->18800 18799 7ff6e216582a 18795->18799 18796->18800 18797->18800 18798 7ff6e215c550 _log10_special 8 API calls 18801 7ff6e21656b4 18798->18801 18847 7ff6e2165924 18799->18847 18800->18798 18801->18775 18801->18776 18804 7ff6e2165924 10 API calls 18805 7ff6e2165849 18804->18805 18806 7ff6e2165924 10 API calls 18805->18806 18807 7ff6e216585a 18806->18807 18807->18800 18808 7ff6e2164f08 _get_daylight 11 API calls 18807->18808 18808->18800 18810 7ff6e2165c3a 18809->18810 18811 7ff6e2164f08 _get_daylight 11 API calls 18810->18811 18829 7ff6e2165cd2 __vcrt_freefls 18810->18829 18813 7ff6e2165c4c 18811->18813 18812 7ff6e215c550 _log10_special 8 API calls 18814 7ff6e21656e1 18812->18814 18815 7ff6e2164f08 _get_daylight 11 API calls 18813->18815 18814->18772 18814->18773 18816 7ff6e2165c54 18815->18816 18817 7ff6e2167e08 45 API calls 18816->18817 18818 7ff6e2165c69 18817->18818 18819 7ff6e2165c7b 18818->18819 18820 7ff6e2165c71 18818->18820 18822 7ff6e2164f08 _get_daylight 11 API calls 18819->18822 18821 7ff6e2164f08 _get_daylight 11 API calls 18820->18821 18826 7ff6e2165c76 18821->18826 18823 7ff6e2165c80 18822->18823 18824 7ff6e2164f08 _get_daylight 11 API calls 18823->18824 18823->18829 18825 7ff6e2165c8a 18824->18825 18827 7ff6e2167e08 45 API calls 18825->18827 18828 7ff6e2165cc4 GetDriveTypeW 18826->18828 18826->18829 18827->18826 18828->18829 18829->18812 18832 7ff6e21659ec 18830->18832 18831 7ff6e216571d 18840 7ff6e2165b00 18831->18840 18832->18831 18854 7ff6e216f724 18832->18854 18834 7ff6e2165a80 18834->18831 18835 7ff6e216f724 51 API calls 18834->18835 18836 7ff6e2165a93 18835->18836 18836->18831 18837 7ff6e216f724 51 API calls 18836->18837 18838 7ff6e2165aa6 18837->18838 18838->18831 18839 7ff6e216f724 51 API calls 18838->18839 18839->18831 18841 7ff6e2165b1a 18840->18841 18842 7ff6e2165b51 18841->18842 18843 7ff6e2165b2a 18841->18843 18844 7ff6e216f5b8 21 API calls 18842->18844 18845 7ff6e2164e7c _fread_nolock 11 API calls 18843->18845 18846 7ff6e2165b3a 18843->18846 18844->18846 18845->18846 18846->18782 18848 7ff6e216594d FileTimeToSystemTime 18847->18848 18849 7ff6e2165940 18847->18849 18850 7ff6e2165961 SystemTimeToTzSpecificLocalTime 18848->18850 18851 7ff6e2165948 18848->18851 18849->18848 18849->18851 18850->18851 18852 7ff6e215c550 _log10_special 8 API calls 18851->18852 18853 7ff6e2165839 18852->18853 18853->18804 18855 7ff6e216f731 18854->18855 18856 7ff6e216f755 18854->18856 18855->18856 18857 7ff6e216f736 18855->18857 18858 7ff6e216f78f 18856->18858 18861 7ff6e216f7ae 18856->18861 18859 7ff6e2164f08 _get_daylight 11 API calls 18857->18859 18860 7ff6e2164f08 _get_daylight 11 API calls 18858->18860 18862 7ff6e216f73b 18859->18862 18863 7ff6e216f794 18860->18863 18864 7ff6e2164f4c 45 API calls 18861->18864 18865 7ff6e216a8e0 _invalid_parameter_noinfo 37 API calls 18862->18865 18867 7ff6e216a8e0 _invalid_parameter_noinfo 37 API calls 18863->18867 18868 7ff6e216f7bb 18864->18868 18866 7ff6e216f746 18865->18866 18866->18834 18869 7ff6e216f79f 18867->18869 18868->18869 18870 7ff6e21704dc 51 API calls 18868->18870 18869->18834 18870->18868 19669 7ff6e21716b0 19680 7ff6e21773e4 19669->19680 19681 7ff6e21773f1 19680->19681 19682 7ff6e216a948 __free_lconv_num 11 API calls 19681->19682 19683 7ff6e217740d 19681->19683 19682->19681 19684 7ff6e216a948 __free_lconv_num 11 API calls 19683->19684 19685 7ff6e21716b9 19683->19685 19684->19683 19686 7ff6e21702d8 EnterCriticalSection 19685->19686 19479 7ff6e217adfe 19480 7ff6e217ae0d 19479->19480 19481 7ff6e217ae17 19479->19481 19483 7ff6e2170338 LeaveCriticalSection 19480->19483 15898 7ff6e216f98c 15899 7ff6e216fb7e 15898->15899 15901 7ff6e216f9ce _isindst 15898->15901 15950 7ff6e2164f08 15899->15950 15901->15899 15904 7ff6e216fa4e _isindst 15901->15904 15919 7ff6e2176194 15904->15919 15909 7ff6e216fbaa 15962 7ff6e216a900 IsProcessorFeaturePresent 15909->15962 15916 7ff6e216faab 15918 7ff6e216fb6e 15916->15918 15943 7ff6e21761d8 15916->15943 15953 7ff6e215c550 15918->15953 15920 7ff6e21761a3 15919->15920 15923 7ff6e216fa6c 15919->15923 15966 7ff6e21702d8 EnterCriticalSection 15920->15966 15925 7ff6e2175598 15923->15925 15926 7ff6e21755a1 15925->15926 15928 7ff6e216fa81 15925->15928 15927 7ff6e2164f08 _get_daylight 11 API calls 15926->15927 15929 7ff6e21755a6 15927->15929 15928->15909 15931 7ff6e21755c8 15928->15931 15967 7ff6e216a8e0 15929->15967 15932 7ff6e216fa92 15931->15932 15933 7ff6e21755d1 15931->15933 15932->15909 15937 7ff6e21755f8 15932->15937 15934 7ff6e2164f08 _get_daylight 11 API calls 15933->15934 15935 7ff6e21755d6 15934->15935 15936 7ff6e216a8e0 _invalid_parameter_noinfo 37 API calls 15935->15936 15936->15932 15938 7ff6e2175601 15937->15938 15942 7ff6e216faa3 15937->15942 15939 7ff6e2164f08 _get_daylight 11 API calls 15938->15939 15940 7ff6e2175606 15939->15940 15941 7ff6e216a8e0 _invalid_parameter_noinfo 37 API calls 15940->15941 15941->15942 15942->15909 15942->15916 16051 7ff6e21702d8 EnterCriticalSection 15943->16051 16052 7ff6e216b2c8 GetLastError 15950->16052 15952 7ff6e2164f11 15952->15918 15954 7ff6e215c559 15953->15954 15955 7ff6e215c564 15954->15955 15956 7ff6e215c8e0 IsProcessorFeaturePresent 15954->15956 15957 7ff6e215c8f8 15956->15957 16069 7ff6e215cad8 RtlCaptureContext 15957->16069 15963 7ff6e216a913 15962->15963 16074 7ff6e216a614 15963->16074 15970 7ff6e216a778 15967->15970 15969 7ff6e216a8f9 15969->15928 15971 7ff6e216a7a3 15970->15971 15974 7ff6e216a814 15971->15974 15973 7ff6e216a7ca 15973->15969 15984 7ff6e216a55c 15974->15984 15977 7ff6e216a84f 15977->15973 15980 7ff6e216a900 _isindst 17 API calls 15981 7ff6e216a8df 15980->15981 15982 7ff6e216a778 _invalid_parameter_noinfo 37 API calls 15981->15982 15983 7ff6e216a8f9 15982->15983 15983->15973 15985 7ff6e216a578 GetLastError 15984->15985 15986 7ff6e216a5b3 15984->15986 15987 7ff6e216a588 15985->15987 15986->15977 15990 7ff6e216a5c8 15986->15990 15993 7ff6e216b390 15987->15993 15991 7ff6e216a5fc 15990->15991 15992 7ff6e216a5e4 GetLastError SetLastError 15990->15992 15991->15977 15991->15980 15992->15991 15994 7ff6e216b3ca FlsSetValue 15993->15994 15995 7ff6e216b3af FlsGetValue 15993->15995 15997 7ff6e216a5a3 SetLastError 15994->15997 15998 7ff6e216b3d7 15994->15998 15996 7ff6e216b3c4 15995->15996 15995->15997 15996->15994 15997->15986 16010 7ff6e216eb98 15998->16010 16000 7ff6e216b3e6 16001 7ff6e216b404 FlsSetValue 16000->16001 16002 7ff6e216b3f4 FlsSetValue 16000->16002 16004 7ff6e216b422 16001->16004 16005 7ff6e216b410 FlsSetValue 16001->16005 16003 7ff6e216b3fd 16002->16003 16017 7ff6e216a948 16003->16017 16023 7ff6e216aef4 16004->16023 16005->16003 16015 7ff6e216eba9 _get_daylight 16010->16015 16011 7ff6e216ebfa 16014 7ff6e2164f08 _get_daylight 10 API calls 16011->16014 16012 7ff6e216ebde HeapAlloc 16013 7ff6e216ebf8 16012->16013 16012->16015 16013->16000 16014->16013 16015->16011 16015->16012 16028 7ff6e2173590 16015->16028 16018 7ff6e216a94d RtlFreeHeap 16017->16018 16020 7ff6e216a97c 16017->16020 16019 7ff6e216a968 GetLastError 16018->16019 16018->16020 16021 7ff6e216a975 __free_lconv_num 16019->16021 16020->15997 16022 7ff6e2164f08 _get_daylight 9 API calls 16021->16022 16022->16020 16037 7ff6e216adcc 16023->16037 16031 7ff6e21735d0 16028->16031 16036 7ff6e21702d8 EnterCriticalSection 16031->16036 16049 7ff6e21702d8 EnterCriticalSection 16037->16049 16053 7ff6e216b309 FlsSetValue 16052->16053 16054 7ff6e216b2ec 16052->16054 16055 7ff6e216b31b 16053->16055 16059 7ff6e216b2f9 16053->16059 16054->16053 16054->16059 16057 7ff6e216eb98 _get_daylight 5 API calls 16055->16057 16056 7ff6e216b375 SetLastError 16056->15952 16058 7ff6e216b32a 16057->16058 16060 7ff6e216b348 FlsSetValue 16058->16060 16061 7ff6e216b338 FlsSetValue 16058->16061 16059->16056 16063 7ff6e216b366 16060->16063 16064 7ff6e216b354 FlsSetValue 16060->16064 16062 7ff6e216b341 16061->16062 16065 7ff6e216a948 __free_lconv_num 5 API calls 16062->16065 16066 7ff6e216aef4 _get_daylight 5 API calls 16063->16066 16064->16062 16065->16059 16067 7ff6e216b36e 16066->16067 16068 7ff6e216a948 __free_lconv_num 5 API calls 16067->16068 16068->16056 16070 7ff6e215caf2 RtlLookupFunctionEntry 16069->16070 16071 7ff6e215cb08 RtlVirtualUnwind 16070->16071 16072 7ff6e215c90b 16070->16072 16071->16070 16071->16072 16073 7ff6e215c8a0 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 16072->16073 16075 7ff6e216a64e _CreateFrameInfo __scrt_get_show_window_mode 16074->16075 16076 7ff6e216a676 RtlCaptureContext RtlLookupFunctionEntry 16075->16076 16077 7ff6e216a6e6 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 16076->16077 16078 7ff6e216a6b0 RtlVirtualUnwind 16076->16078 16080 7ff6e216a738 _CreateFrameInfo 16077->16080 16078->16077 16079 7ff6e215c550 _log10_special 8 API calls 16081 7ff6e216a757 GetCurrentProcess TerminateProcess 16079->16081 16080->16079 19493 7ff6e2165410 19494 7ff6e216541b 19493->19494 19502 7ff6e216f2a4 19494->19502 19515 7ff6e21702d8 EnterCriticalSection 19502->19515

                                                                                                                                                                                                              Executed Functions

                                                                                                                                                                                                              Function 00007FF6E21589E0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257synchronizationwindowregistryCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 0 7ff6e21589e0-7ff6e2158b26 call 7ff6e215c850 call 7ff6e2159390 SetConsoleCtrlHandler GetStartupInfoW call 7ff6e21653f0 call 7ff6e216a47c call 7ff6e216871c call 7ff6e21653f0 call 7ff6e216a47c call 7ff6e216871c call 7ff6e21653f0 call 7ff6e216a47c call 7ff6e216871c GetCommandLineW CreateProcessW 23 7ff6e2158b4d-7ff6e2158b89 RegisterClassW 0->23 24 7ff6e2158b28-7ff6e2158b48 GetLastError call 7ff6e2152c50 0->24 26 7ff6e2158b8b GetLastError 23->26 27 7ff6e2158b91-7ff6e2158be5 CreateWindowExW 23->27 31 7ff6e2158e39-7ff6e2158e5f call 7ff6e215c550 24->31 26->27 29 7ff6e2158be7-7ff6e2158bed GetLastError 27->29 30 7ff6e2158bef-7ff6e2158bf4 ShowWindow 27->30 32 7ff6e2158bfa-7ff6e2158c0a WaitForSingleObject 29->32 30->32 34 7ff6e2158c0c 32->34 35 7ff6e2158c88-7ff6e2158c8f 32->35 39 7ff6e2158c10-7ff6e2158c13 34->39 36 7ff6e2158cd2-7ff6e2158cd9 35->36 37 7ff6e2158c91-7ff6e2158ca1 WaitForSingleObject 35->37 42 7ff6e2158cdf-7ff6e2158cf5 QueryPerformanceFrequency QueryPerformanceCounter 36->42 43 7ff6e2158dc0-7ff6e2158dd9 GetMessageW 36->43 40 7ff6e2158ca7-7ff6e2158cb7 TerminateProcess 37->40 41 7ff6e2158df8-7ff6e2158e02 37->41 44 7ff6e2158c1b-7ff6e2158c22 39->44 45 7ff6e2158c15 GetLastError 39->45 48 7ff6e2158cb9 GetLastError 40->48 49 7ff6e2158cbf-7ff6e2158ccd WaitForSingleObject 40->49 46 7ff6e2158e04-7ff6e2158e0a DestroyWindow 41->46 47 7ff6e2158e11-7ff6e2158e35 GetExitCodeProcess CloseHandle * 2 41->47 50 7ff6e2158d00-7ff6e2158d38 MsgWaitForMultipleObjects PeekMessageW 42->50 52 7ff6e2158ddb-7ff6e2158de9 TranslateMessage DispatchMessageW 43->52 53 7ff6e2158def-7ff6e2158df6 43->53 44->37 51 7ff6e2158c24-7ff6e2158c41 PeekMessageW 44->51 45->44 46->47 47->31 48->49 49->41 54 7ff6e2158d3a 50->54 55 7ff6e2158d73-7ff6e2158d7a 50->55 56 7ff6e2158c76-7ff6e2158c86 WaitForSingleObject 51->56 57 7ff6e2158c43-7ff6e2158c74 TranslateMessage DispatchMessageW PeekMessageW 51->57 52->53 53->41 53->43 58 7ff6e2158d40-7ff6e2158d71 TranslateMessage DispatchMessageW PeekMessageW 54->58 55->43 59 7ff6e2158d7c-7ff6e2158da5 QueryPerformanceCounter 55->59 56->35 56->39 57->56 57->57 58->55 58->58 59->50 60 7ff6e2158dab-7ff6e2158db2 59->60 60->41 61 7ff6e2158db4-7ff6e2158db8 60->61 61->43
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
                                                                                                                                                                                                              • String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
                                                                                                                                                                                                              • API String ID: 3832162212-3165540532
                                                                                                                                                                                                              • Opcode ID: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
                                                                                                                                                                                                              • Instruction ID: d34f318321396c6ef3bccb8f269c3551d5259abaa500b26c299c64c913794145
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9FD13E32E08A8686E7109F34E8543EA2766FF8575CF400235DB5EC2AA4DFBDD7858705
                                                                                                                                                                                                              Function 00007FF6E2151000 Relevance: 60.0, APIs: 6, Strings: 28, Instructions: 509COMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 62 7ff6e2151000-7ff6e2153806 call 7ff6e215fe18 call 7ff6e215fe20 call 7ff6e215c850 call 7ff6e21653f0 call 7ff6e2165484 call 7ff6e21536b0 76 7ff6e2153808-7ff6e215380f 62->76 77 7ff6e2153814-7ff6e2153836 call 7ff6e2151950 62->77 78 7ff6e2153c97-7ff6e2153cb2 call 7ff6e215c550 76->78 83 7ff6e215391b-7ff6e2153931 call 7ff6e21545c0 77->83 84 7ff6e215383c-7ff6e2153856 call 7ff6e2151c80 77->84 89 7ff6e215396a-7ff6e215397f call 7ff6e2152710 83->89 90 7ff6e2153933-7ff6e2153960 call 7ff6e2157f90 83->90 88 7ff6e215385b-7ff6e215389b call 7ff6e2158830 84->88 97 7ff6e215389d-7ff6e21538a3 88->97 98 7ff6e21538c1-7ff6e21538cc call 7ff6e2164f30 88->98 102 7ff6e2153c8f 89->102 100 7ff6e2153962-7ff6e2153965 call 7ff6e216004c 90->100 101 7ff6e2153984-7ff6e21539a6 call 7ff6e2151c80 90->101 103 7ff6e21538a5-7ff6e21538ad 97->103 104 7ff6e21538af-7ff6e21538bd call 7ff6e21589a0 97->104 110 7ff6e21539fc-7ff6e2153a2a call 7ff6e2158940 call 7ff6e21589a0 * 3 98->110 111 7ff6e21538d2-7ff6e21538e1 call 7ff6e2158830 98->111 100->89 115 7ff6e21539b0-7ff6e21539b9 101->115 102->78 103->104 104->98 138 7ff6e2153a2f-7ff6e2153a3e call 7ff6e2158830 110->138 120 7ff6e21538e7-7ff6e21538ed 111->120 121 7ff6e21539f4-7ff6e21539f7 call 7ff6e2164f30 111->121 115->115 118 7ff6e21539bb-7ff6e21539d8 call 7ff6e2151950 115->118 118->88 127 7ff6e21539de-7ff6e21539ef call 7ff6e2152710 118->127 125 7ff6e21538f0-7ff6e21538fc 120->125 121->110 128 7ff6e2153905-7ff6e2153908 125->128 129 7ff6e21538fe-7ff6e2153903 125->129 127->102 128->121 132 7ff6e215390e-7ff6e2153916 call 7ff6e2164f30 128->132 129->125 129->128 132->138 141 7ff6e2153a44-7ff6e2153a47 138->141 142 7ff6e2153b45-7ff6e2153b53 138->142 141->142 143 7ff6e2153a4d-7ff6e2153a50 141->143 144 7ff6e2153a67 142->144 145 7ff6e2153b59-7ff6e2153b5d 142->145 146 7ff6e2153a56-7ff6e2153a5a 143->146 147 7ff6e2153b14-7ff6e2153b17 143->147 148 7ff6e2153a6b-7ff6e2153a90 call 7ff6e2164f30 144->148 145->148 146->147 149 7ff6e2153a60 146->149 150 7ff6e2153b19-7ff6e2153b1d 147->150 151 7ff6e2153b2f-7ff6e2153b40 call 7ff6e2152710 147->151 157 7ff6e2153aab-7ff6e2153ac0 148->157 158 7ff6e2153a92-7ff6e2153aa6 call 7ff6e2158940 148->158 149->144 150->151 153 7ff6e2153b1f-7ff6e2153b2a 150->153 159 7ff6e2153c7f-7ff6e2153c87 151->159 153->148 161 7ff6e2153ac6-7ff6e2153aca 157->161 162 7ff6e2153be8-7ff6e2153bfa call 7ff6e2158830 157->162 158->157 159->102 164 7ff6e2153bcd-7ff6e2153be2 call 7ff6e2151940 161->164 165 7ff6e2153ad0-7ff6e2153ae8 call 7ff6e2165250 161->165 171 7ff6e2153bfc-7ff6e2153c02 162->171 172 7ff6e2153c2e 162->172 164->161 164->162 175 7ff6e2153aea-7ff6e2153b02 call 7ff6e2165250 165->175 176 7ff6e2153b62-7ff6e2153b7a call 7ff6e2165250 165->176 173 7ff6e2153c04-7ff6e2153c1c 171->173 174 7ff6e2153c1e-7ff6e2153c2c 171->174 177 7ff6e2153c31-7ff6e2153c40 call 7ff6e2164f30 172->177 173->177 174->177 175->164 186 7ff6e2153b08-7ff6e2153b0f 175->186 184 7ff6e2153b7c-7ff6e2153b80 176->184 185 7ff6e2153b87-7ff6e2153b9f call 7ff6e2165250 176->185 187 7ff6e2153c46-7ff6e2153c4a 177->187 188 7ff6e2153d41-7ff6e2153d63 call 7ff6e21544e0 177->188 184->185 197 7ff6e2153bac-7ff6e2153bc4 call 7ff6e2165250 185->197 198 7ff6e2153ba1-7ff6e2153ba5 185->198 186->164 190 7ff6e2153cd4-7ff6e2153ce6 call 7ff6e2158830 187->190 191 7ff6e2153c50-7ff6e2153c5f call 7ff6e21590e0 187->191 201 7ff6e2153d65-7ff6e2153d6f call 7ff6e2154630 188->201 202 7ff6e2153d71-7ff6e2153d82 call 7ff6e2151c80 188->202 206 7ff6e2153ce8-7ff6e2153ceb 190->206 207 7ff6e2153d35-7ff6e2153d3c 190->207 204 7ff6e2153cb3-7ff6e2153cb6 call 7ff6e2158660 191->204 205 7ff6e2153c61 191->205 197->164 219 7ff6e2153bc6 197->219 198->197 210 7ff6e2153d87-7ff6e2153d96 201->210 202->210 218 7ff6e2153cbb-7ff6e2153cbd 204->218 213 7ff6e2153c68 call 7ff6e2152710 205->213 206->207 214 7ff6e2153ced-7ff6e2153d10 call 7ff6e2151c80 206->214 207->213 216 7ff6e2153dbc-7ff6e2153dd2 call 7ff6e2159390 210->216 217 7ff6e2153d98-7ff6e2153d9f 210->217 226 7ff6e2153c6d-7ff6e2153c77 213->226 230 7ff6e2153d2b-7ff6e2153d33 call 7ff6e2164f30 214->230 231 7ff6e2153d12-7ff6e2153d26 call 7ff6e2152710 call 7ff6e2164f30 214->231 234 7ff6e2153dd4 216->234 235 7ff6e2153de0-7ff6e2153dfc SetDllDirectoryW 216->235 217->216 222 7ff6e2153da1-7ff6e2153da5 217->222 224 7ff6e2153cc8-7ff6e2153ccf 218->224 225 7ff6e2153cbf-7ff6e2153cc6 218->225 219->164 222->216 228 7ff6e2153da7-7ff6e2153db6 LoadLibraryExW 222->228 224->210 225->213 226->159 228->216 230->210 231->226 234->235 238 7ff6e2153ef9-7ff6e2153f00 235->238 239 7ff6e2153e02-7ff6e2153e11 call 7ff6e2158830 235->239 241 7ff6e2153f06-7ff6e2153f0d 238->241 242 7ff6e2154000-7ff6e2154008 238->242 251 7ff6e2153e2a-7ff6e2153e34 call 7ff6e2164f30 239->251 252 7ff6e2153e13-7ff6e2153e19 239->252 241->242 245 7ff6e2153f13-7ff6e2153f1d call 7ff6e21533c0 241->245 246 7ff6e215400a-7ff6e2154027 PostMessageW GetMessageW 242->246 247 7ff6e215402d-7ff6e215405f call 7ff6e21536a0 call 7ff6e2153360 call 7ff6e2153670 call 7ff6e2156fc0 call 7ff6e2156d70 242->247 245->226 259 7ff6e2153f23-7ff6e2153f37 call 7ff6e21590c0 245->259 246->247 261 7ff6e2153eea-7ff6e2153ef4 call 7ff6e2158940 251->261 262 7ff6e2153e3a-7ff6e2153e40 251->262 256 7ff6e2153e1b-7ff6e2153e23 252->256 257 7ff6e2153e25-7ff6e2153e27 252->257 256->257 257->251 272 7ff6e2153f5c-7ff6e2153f9f call 7ff6e2158940 call 7ff6e21589e0 call 7ff6e2156fc0 call 7ff6e2156d70 call 7ff6e21588e0 259->272 273 7ff6e2153f39-7ff6e2153f56 PostMessageW GetMessageW 259->273 261->238 262->261 266 7ff6e2153e46-7ff6e2153e4c 262->266 270 7ff6e2153e57-7ff6e2153e59 266->270 271 7ff6e2153e4e-7ff6e2153e50 266->271 270->238 276 7ff6e2153e5f-7ff6e2153e7b call 7ff6e2156dc0 call 7ff6e2157340 270->276 275 7ff6e2153e52 271->275 271->276 310 7ff6e2153fed-7ff6e2153ff4 call 7ff6e2151900 272->310 311 7ff6e2153fa1-7ff6e2153fb7 call 7ff6e2158ed0 call 7ff6e21588e0 272->311 273->272 275->238 290 7ff6e2153e7d-7ff6e2153e84 276->290 291 7ff6e2153e86-7ff6e2153e8d 276->291 293 7ff6e2153ed3-7ff6e2153ee8 call 7ff6e2152a50 call 7ff6e2156fc0 call 7ff6e2156d70 290->293 294 7ff6e2153ea7-7ff6e2153eb1 call 7ff6e21571b0 291->294 295 7ff6e2153e8f-7ff6e2153e9c call 7ff6e2156e00 291->295 293->238 305 7ff6e2153ebc-7ff6e2153eca call 7ff6e21574f0 294->305 306 7ff6e2153eb3-7ff6e2153eba 294->306 295->294 304 7ff6e2153e9e-7ff6e2153ea5 295->304 304->293 305->238 319 7ff6e2153ecc 305->319 306->293 318 7ff6e2153ff9-7ff6e2153ffb 310->318 311->310 323 7ff6e2153fb9-7ff6e2153fce 311->323 318->226 319->293 324 7ff6e2153fe8 call 7ff6e2152a50 323->324 325 7ff6e2153fd0-7ff6e2153fe3 call 7ff6e2152710 call 7ff6e2151900 323->325 324->310 325->226
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ErrorFileLastModuleName
                                                                                                                                                                                                              • String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
                                                                                                                                                                                                              • API String ID: 2776309574-4232158417
                                                                                                                                                                                                              • Opcode ID: 1c0c080c3661273316168b0c257fe8fed071b4bd607a6398fd676193384e9d95
                                                                                                                                                                                                              • Instruction ID: fad8cc674aa4c5e35a163e9aed1c6309e523e12c0ecdb3f728acf6881d5253ff
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1c0c080c3661273316168b0c257fe8fed071b4bd607a6398fd676193384e9d95
                                                                                                                                                                                                              • Instruction Fuzzy Hash: AA329E23E4C68691FA15DB24D4543F92293AF85788F8440B2DB4DC32D6EFAEE754C30A
                                                                                                                                                                                                              Function 00007FF6E2175C00 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334timeCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 479 7ff6e2175c00-7ff6e2175c3b call 7ff6e2175588 call 7ff6e2175590 call 7ff6e21755f8 486 7ff6e2175e65-7ff6e2175eb1 call 7ff6e216a900 call 7ff6e2175588 call 7ff6e2175590 call 7ff6e21755f8 479->486 487 7ff6e2175c41-7ff6e2175c4c call 7ff6e2175598 479->487 513 7ff6e2175eb7-7ff6e2175ec2 call 7ff6e2175598 486->513 514 7ff6e2175fef-7ff6e217605d call 7ff6e216a900 call 7ff6e2171578 486->514 487->486 493 7ff6e2175c52-7ff6e2175c5c 487->493 495 7ff6e2175c7e-7ff6e2175c82 493->495 496 7ff6e2175c5e-7ff6e2175c61 493->496 498 7ff6e2175c85-7ff6e2175c8d 495->498 497 7ff6e2175c64-7ff6e2175c6f 496->497 500 7ff6e2175c7a-7ff6e2175c7c 497->500 501 7ff6e2175c71-7ff6e2175c78 497->501 498->498 502 7ff6e2175c8f-7ff6e2175ca2 call 7ff6e216d5fc 498->502 500->495 504 7ff6e2175cab-7ff6e2175cb9 500->504 501->497 501->500 509 7ff6e2175cba-7ff6e2175cc6 call 7ff6e216a948 502->509 510 7ff6e2175ca4-7ff6e2175ca6 call 7ff6e216a948 502->510 521 7ff6e2175ccd-7ff6e2175cd5 509->521 510->504 513->514 523 7ff6e2175ec8-7ff6e2175ed3 call 7ff6e21755c8 513->523 533 7ff6e217606b-7ff6e217606e 514->533 534 7ff6e217605f-7ff6e2176066 514->534 521->521 524 7ff6e2175cd7-7ff6e2175ce8 call 7ff6e2170474 521->524 523->514 531 7ff6e2175ed9-7ff6e2175efc call 7ff6e216a948 GetTimeZoneInformation 523->531 524->486 532 7ff6e2175cee-7ff6e2175d44 call 7ff6e217a4d0 * 4 call 7ff6e2175b1c 524->532 547 7ff6e2175fc4-7ff6e2175fee call 7ff6e2175580 call 7ff6e2175570 call 7ff6e2175578 531->547 548 7ff6e2175f02-7ff6e2175f23 531->548 591 7ff6e2175d46-7ff6e2175d4a 532->591 538 7ff6e21760a5-7ff6e21760b8 call 7ff6e216d5fc 533->538 539 7ff6e2176070 533->539 537 7ff6e21760fb-7ff6e21760fe 534->537 543 7ff6e2176104-7ff6e217610c call 7ff6e2175c00 537->543 544 7ff6e2176073 537->544 557 7ff6e21760ba 538->557 558 7ff6e21760c3-7ff6e21760de call 7ff6e2171578 538->558 539->544 545 7ff6e2176078-7ff6e21760a4 call 7ff6e216a948 call 7ff6e215c550 543->545 544->545 546 7ff6e2176073 call 7ff6e2175e7c 544->546 546->545 552 7ff6e2175f25-7ff6e2175f2b 548->552 553 7ff6e2175f2e-7ff6e2175f35 548->553 552->553 560 7ff6e2175f49 553->560 561 7ff6e2175f37-7ff6e2175f3f 553->561 565 7ff6e21760bc-7ff6e21760c1 call 7ff6e216a948 557->565 574 7ff6e21760e5-7ff6e21760f7 call 7ff6e216a948 558->574 575 7ff6e21760e0-7ff6e21760e3 558->575 570 7ff6e2175f4b-7ff6e2175fbf call 7ff6e217a4d0 * 4 call 7ff6e2172b5c call 7ff6e2176114 * 2 560->570 561->560 567 7ff6e2175f41-7ff6e2175f47 561->567 565->539 567->570 570->547 574->537 575->565 593 7ff6e2175d4c 591->593 594 7ff6e2175d50-7ff6e2175d54 591->594 593->594 594->591 596 7ff6e2175d56-7ff6e2175d7b call 7ff6e2166b58 594->596 602 7ff6e2175d7e-7ff6e2175d82 596->602 604 7ff6e2175d84-7ff6e2175d8f 602->604 605 7ff6e2175d91-7ff6e2175d95 602->605 604->605 607 7ff6e2175d97-7ff6e2175d9b 604->607 605->602 610 7ff6e2175e1c-7ff6e2175e20 607->610 611 7ff6e2175d9d-7ff6e2175dc5 call 7ff6e2166b58 607->611 612 7ff6e2175e27-7ff6e2175e34 610->612 613 7ff6e2175e22-7ff6e2175e24 610->613 619 7ff6e2175dc7 611->619 620 7ff6e2175de3-7ff6e2175de7 611->620 615 7ff6e2175e36-7ff6e2175e4c call 7ff6e2175b1c 612->615 616 7ff6e2175e4f-7ff6e2175e5e call 7ff6e2175580 call 7ff6e2175570 612->616 613->612 615->616 616->486 623 7ff6e2175dca-7ff6e2175dd1 619->623 620->610 625 7ff6e2175de9-7ff6e2175e07 call 7ff6e2166b58 620->625 623->620 626 7ff6e2175dd3-7ff6e2175de1 623->626 631 7ff6e2175e13-7ff6e2175e1a 625->631 626->620 626->623 631->610 632 7ff6e2175e09-7ff6e2175e0d 631->632 632->610 633 7ff6e2175e0f 632->633 633->631
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF6E2175C45
                                                                                                                                                                                                                • Part of subcall function 00007FF6E2175598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E21755AC
                                                                                                                                                                                                                • Part of subcall function 00007FF6E216A948: RtlFreeHeap.NTDLL(?,?,?,00007FF6E2172D22,?,?,?,00007FF6E2172D5F,?,?,00000000,00007FF6E2173225,?,?,?,00007FF6E2173157), ref: 00007FF6E216A95E
                                                                                                                                                                                                                • Part of subcall function 00007FF6E216A948: GetLastError.KERNEL32(?,?,?,00007FF6E2172D22,?,?,?,00007FF6E2172D5F,?,?,00000000,00007FF6E2173225,?,?,?,00007FF6E2173157), ref: 00007FF6E216A968
                                                                                                                                                                                                                • Part of subcall function 00007FF6E216A900: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF6E216A8DF,?,?,?,?,?,00007FF6E216A7CA), ref: 00007FF6E216A909
                                                                                                                                                                                                                • Part of subcall function 00007FF6E216A900: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6E216A8DF,?,?,?,?,?,00007FF6E216A7CA), ref: 00007FF6E216A92E
                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF6E2175C34
                                                                                                                                                                                                                • Part of subcall function 00007FF6E21755F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E217560C
                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF6E2175EAA
                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF6E2175EBB
                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF6E2175ECC
                                                                                                                                                                                                              • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6E217610C), ref: 00007FF6E2175EF3
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
                                                                                                                                                                                                              • String ID: Eastern Standard Time$Eastern Summer Time
                                                                                                                                                                                                              • API String ID: 4070488512-239921721
                                                                                                                                                                                                              • Opcode ID: c8e181fbda5929fcc8f6a75e148055e791a7ddaa32984997676ab034941af52a
                                                                                                                                                                                                              • Instruction ID: c21f94be5ef94d7bb4a99adc6697a178678c1d8f23b357d24c335c03a63720ff
                                                                                                                                                                                                              • Opcode Fuzzy Hash: c8e181fbda5929fcc8f6a75e148055e791a7ddaa32984997676ab034941af52a
                                                                                                                                                                                                              • Instruction Fuzzy Hash: DAD1BC23E1824296E7249F25D8803F96762EBC6788F448035EF0DC76D5DFBEE641874A
                                                                                                                                                                                                              Function 00007FF6E2176964 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 693 7ff6e2176964-7ff6e21769d7 call 7ff6e2176698 696 7ff6e21769d9-7ff6e21769e2 call 7ff6e2164ee8 693->696 697 7ff6e21769f1-7ff6e21769fb call 7ff6e2168520 693->697 704 7ff6e21769e5-7ff6e21769ec call 7ff6e2164f08 696->704 702 7ff6e21769fd-7ff6e2176a14 call 7ff6e2164ee8 call 7ff6e2164f08 697->702 703 7ff6e2176a16-7ff6e2176a7f CreateFileW 697->703 702->704 707 7ff6e2176afc-7ff6e2176b07 GetFileType 703->707 708 7ff6e2176a81-7ff6e2176a87 703->708 715 7ff6e2176d32-7ff6e2176d52 704->715 710 7ff6e2176b5a-7ff6e2176b61 707->710 711 7ff6e2176b09-7ff6e2176b44 GetLastError call 7ff6e2164e7c CloseHandle 707->711 713 7ff6e2176ac9-7ff6e2176af7 GetLastError call 7ff6e2164e7c 708->713 714 7ff6e2176a89-7ff6e2176a8d 708->714 718 7ff6e2176b69-7ff6e2176b6c 710->718 719 7ff6e2176b63-7ff6e2176b67 710->719 711->704 727 7ff6e2176b4a-7ff6e2176b55 call 7ff6e2164f08 711->727 713->704 714->713 720 7ff6e2176a8f-7ff6e2176ac7 CreateFileW 714->720 725 7ff6e2176b72-7ff6e2176bc7 call 7ff6e2168438 718->725 726 7ff6e2176b6e 718->726 719->725 720->707 720->713 732 7ff6e2176bc9-7ff6e2176bd5 call 7ff6e21768a0 725->732 733 7ff6e2176be6-7ff6e2176c17 call 7ff6e2176418 725->733 726->725 727->704 732->733 738 7ff6e2176bd7 732->738 739 7ff6e2176c1d-7ff6e2176c5f 733->739 740 7ff6e2176c19-7ff6e2176c1b 733->740 741 7ff6e2176bd9-7ff6e2176be1 call 7ff6e216aac0 738->741 742 7ff6e2176c81-7ff6e2176c8c 739->742 743 7ff6e2176c61-7ff6e2176c65 739->743 740->741 741->715 746 7ff6e2176c92-7ff6e2176c96 742->746 747 7ff6e2176d30 742->747 743->742 745 7ff6e2176c67-7ff6e2176c7c 743->745 745->742 746->747 749 7ff6e2176c9c-7ff6e2176ce1 CloseHandle CreateFileW 746->749 747->715 750 7ff6e2176d16-7ff6e2176d2b 749->750 751 7ff6e2176ce3-7ff6e2176d11 GetLastError call 7ff6e2164e7c call 7ff6e2168660 749->751 750->747 751->750
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1617910340-0
                                                                                                                                                                                                              • Opcode ID: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
                                                                                                                                                                                                              • Instruction ID: 0d847bccb3289a34f2cba70938e7d9977cbf713cc589450f8c2d6dc6fccd3c3e
                                                                                                                                                                                                              • Opcode Fuzzy Hash: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2EC1AD33F28A8585EB10CFA9C4902AC3762EB8AB98B010225DB1ED77D4CF7AD651C305
                                                                                                                                                                                                              Function 00007FF6E21583C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • FindFirstFileW.KERNELBASE(?,00007FF6E2158919,00007FF6E2153F9D), ref: 00007FF6E215842B
                                                                                                                                                                                                              • RemoveDirectoryW.KERNEL32(?,00007FF6E2158919,00007FF6E2153F9D), ref: 00007FF6E21584AE
                                                                                                                                                                                                              • DeleteFileW.KERNELBASE(?,00007FF6E2158919,00007FF6E2153F9D), ref: 00007FF6E21584CD
                                                                                                                                                                                                              • FindNextFileW.KERNELBASE(?,00007FF6E2158919,00007FF6E2153F9D), ref: 00007FF6E21584DB
                                                                                                                                                                                                              • FindClose.KERNELBASE(?,00007FF6E2158919,00007FF6E2153F9D), ref: 00007FF6E21584EC
                                                                                                                                                                                                              • RemoveDirectoryW.KERNELBASE(?,00007FF6E2158919,00007FF6E2153F9D), ref: 00007FF6E21584F5
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
                                                                                                                                                                                                              • String ID: %s\*
                                                                                                                                                                                                              • API String ID: 1057558799-766152087
                                                                                                                                                                                                              • Opcode ID: 7c12b01ff297979e1ecdf005a6213684df6049b407edb1b83f88227167b7eee2
                                                                                                                                                                                                              • Instruction ID: 9cecd306de45bf0d5a2691eabb3e9b2d1649b7ecf0d442e53a0356671f710a82
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7c12b01ff297979e1ecdf005a6213684df6049b407edb1b83f88227167b7eee2
                                                                                                                                                                                                              • Instruction Fuzzy Hash: E5418F23E4C54681EA209F20F4483FA63A2FB95758F410272DB9EC26C4DFAED785C706
                                                                                                                                                                                                              Function 00007FF6E2175E7C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 1014 7ff6e2175e7c-7ff6e2175eb1 call 7ff6e2175588 call 7ff6e2175590 call 7ff6e21755f8 1021 7ff6e2175eb7-7ff6e2175ec2 call 7ff6e2175598 1014->1021 1022 7ff6e2175fef-7ff6e217605d call 7ff6e216a900 call 7ff6e2171578 1014->1022 1021->1022 1028 7ff6e2175ec8-7ff6e2175ed3 call 7ff6e21755c8 1021->1028 1034 7ff6e217606b-7ff6e217606e 1022->1034 1035 7ff6e217605f-7ff6e2176066 1022->1035 1028->1022 1033 7ff6e2175ed9-7ff6e2175efc call 7ff6e216a948 GetTimeZoneInformation 1028->1033 1046 7ff6e2175fc4-7ff6e2175fee call 7ff6e2175580 call 7ff6e2175570 call 7ff6e2175578 1033->1046 1047 7ff6e2175f02-7ff6e2175f23 1033->1047 1038 7ff6e21760a5-7ff6e21760b8 call 7ff6e216d5fc 1034->1038 1039 7ff6e2176070 1034->1039 1037 7ff6e21760fb-7ff6e21760fe 1035->1037 1042 7ff6e2176104-7ff6e217610c call 7ff6e2175c00 1037->1042 1043 7ff6e2176073 1037->1043 1054 7ff6e21760ba 1038->1054 1055 7ff6e21760c3-7ff6e21760de call 7ff6e2171578 1038->1055 1039->1043 1044 7ff6e2176078-7ff6e21760a4 call 7ff6e216a948 call 7ff6e215c550 1042->1044 1043->1044 1045 7ff6e2176073 call 7ff6e2175e7c 1043->1045 1045->1044 1050 7ff6e2175f25-7ff6e2175f2b 1047->1050 1051 7ff6e2175f2e-7ff6e2175f35 1047->1051 1050->1051 1057 7ff6e2175f49 1051->1057 1058 7ff6e2175f37-7ff6e2175f3f 1051->1058 1061 7ff6e21760bc-7ff6e21760c1 call 7ff6e216a948 1054->1061 1069 7ff6e21760e5-7ff6e21760f7 call 7ff6e216a948 1055->1069 1070 7ff6e21760e0-7ff6e21760e3 1055->1070 1065 7ff6e2175f4b-7ff6e2175fbf call 7ff6e217a4d0 * 4 call 7ff6e2172b5c call 7ff6e2176114 * 2 1057->1065 1058->1057 1063 7ff6e2175f41-7ff6e2175f47 1058->1063 1061->1039 1063->1065 1065->1046 1069->1037 1070->1061
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF6E2175EAA
                                                                                                                                                                                                                • Part of subcall function 00007FF6E21755F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E217560C
                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF6E2175EBB
                                                                                                                                                                                                                • Part of subcall function 00007FF6E2175598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E21755AC
                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF6E2175ECC
                                                                                                                                                                                                                • Part of subcall function 00007FF6E21755C8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E21755DC
                                                                                                                                                                                                                • Part of subcall function 00007FF6E216A948: RtlFreeHeap.NTDLL(?,?,?,00007FF6E2172D22,?,?,?,00007FF6E2172D5F,?,?,00000000,00007FF6E2173225,?,?,?,00007FF6E2173157), ref: 00007FF6E216A95E
                                                                                                                                                                                                                • Part of subcall function 00007FF6E216A948: GetLastError.KERNEL32(?,?,?,00007FF6E2172D22,?,?,?,00007FF6E2172D5F,?,?,00000000,00007FF6E2173225,?,?,?,00007FF6E2173157), ref: 00007FF6E216A968
                                                                                                                                                                                                              • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6E217610C), ref: 00007FF6E2175EF3
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
                                                                                                                                                                                                              • String ID: Eastern Standard Time$Eastern Summer Time
                                                                                                                                                                                                              • API String ID: 3458911817-239921721
                                                                                                                                                                                                              • Opcode ID: 6f2171165b001c2744b9d494c76d2a7753c36df5ed5d67f3075860c83c0dbe14
                                                                                                                                                                                                              • Instruction ID: 99d2a59c9df3fa0981c408bdb53a70e523697dc7540e0f17aadc0cc14e9d67e3
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6f2171165b001c2744b9d494c76d2a7753c36df5ed5d67f3075860c83c0dbe14
                                                                                                                                                                                                              • Instruction Fuzzy Hash: C8519B33E0864286E720DF25D8813E96762FB89788F404135EB0DC36D5DFBEE600874A
                                                                                                                                                                                                              Function 00007FF6E2159280 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Find$CloseFileFirst
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2295610775-0
                                                                                                                                                                                                              • Opcode ID: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
                                                                                                                                                                                                              • Instruction ID: dafe307e0607b00f08d51c152ec2e7c48ee04cff9de743b5296253bb86369ae2
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
                                                                                                                                                                                                              • Instruction Fuzzy Hash: DBF0A423E1864186F7608B60F4887B67351BB8432CF040235DB6EC2AD4DF7DD248CA09
                                                                                                                                                                                                              Function 00007FF6E2151950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184COMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 331 7ff6e2151950-7ff6e215198b call 7ff6e21545c0 334 7ff6e2151c4e-7ff6e2151c72 call 7ff6e215c550 331->334 335 7ff6e2151991-7ff6e21519d1 call 7ff6e2157f90 331->335 340 7ff6e2151c3b-7ff6e2151c3e call 7ff6e216004c 335->340 341 7ff6e21519d7-7ff6e21519e7 call 7ff6e21606d4 335->341 345 7ff6e2151c43-7ff6e2151c4b 340->345 346 7ff6e2151a08-7ff6e2151a24 call 7ff6e216039c 341->346 347 7ff6e21519e9-7ff6e2151a03 call 7ff6e2164f08 call 7ff6e2152910 341->347 345->334 353 7ff6e2151a26-7ff6e2151a40 call 7ff6e2164f08 call 7ff6e2152910 346->353 354 7ff6e2151a45-7ff6e2151a5a call 7ff6e2164f28 346->354 347->340 353->340 360 7ff6e2151a7b-7ff6e2151b05 call 7ff6e2151c80 * 2 call 7ff6e21606d4 call 7ff6e2164f44 354->360 361 7ff6e2151a5c-7ff6e2151a76 call 7ff6e2164f08 call 7ff6e2152910 354->361 375 7ff6e2151b0a-7ff6e2151b14 360->375 361->340 376 7ff6e2151b16-7ff6e2151b30 call 7ff6e2164f08 call 7ff6e2152910 375->376 377 7ff6e2151b35-7ff6e2151b4e call 7ff6e216039c 375->377 376->340 383 7ff6e2151b6f-7ff6e2151b8b call 7ff6e2160110 377->383 384 7ff6e2151b50-7ff6e2151b6a call 7ff6e2164f08 call 7ff6e2152910 377->384 391 7ff6e2151b8d-7ff6e2151b99 call 7ff6e2152710 383->391 392 7ff6e2151b9e-7ff6e2151bac 383->392 384->340 391->340 392->340 394 7ff6e2151bb2-7ff6e2151bb9 392->394 397 7ff6e2151bc1-7ff6e2151bc7 394->397 398 7ff6e2151bc9-7ff6e2151bd6 397->398 399 7ff6e2151be0-7ff6e2151bef 397->399 400 7ff6e2151bf1-7ff6e2151bfa 398->400 399->399 399->400 401 7ff6e2151bfc-7ff6e2151bff 400->401 402 7ff6e2151c0f 400->402 401->402 403 7ff6e2151c01-7ff6e2151c04 401->403 404 7ff6e2151c11-7ff6e2151c24 402->404 403->402 405 7ff6e2151c06-7ff6e2151c09 403->405 406 7ff6e2151c2d-7ff6e2151c39 404->406 407 7ff6e2151c26 404->407 405->402 408 7ff6e2151c0b-7ff6e2151c0d 405->408 406->340 406->397 407->406 408->404
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 00007FF6E2157F90: _fread_nolock.LIBCMT ref: 00007FF6E215803A
                                                                                                                                                                                                              • _fread_nolock.LIBCMT ref: 00007FF6E2151A1B
                                                                                                                                                                                                                • Part of subcall function 00007FF6E2152910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF6E2151B6A), ref: 00007FF6E215295E
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _fread_nolock$CurrentProcess
                                                                                                                                                                                                              • String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
                                                                                                                                                                                                              • API String ID: 2397952137-3497178890
                                                                                                                                                                                                              • Opcode ID: 70c875ae13451ebc6921e11026a808857521fb963ce313c5eb273bd5d0283093
                                                                                                                                                                                                              • Instruction ID: e280768a830f528bfaf53595ea54fdf141a7295d116ef14f411f5e8142ff26dd
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 70c875ae13451ebc6921e11026a808857521fb963ce313c5eb273bd5d0283093
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 96818273E0868686EB21DB14D0803F923A3AF85748F444475EB4EC7785DEBEE745874A
                                                                                                                                                                                                              Function 00007FF6E2151600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145COMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 409 7ff6e2151600-7ff6e2151611 410 7ff6e2151637-7ff6e2151651 call 7ff6e21545c0 409->410 411 7ff6e2151613-7ff6e215161c call 7ff6e2151050 409->411 418 7ff6e2151682-7ff6e215169c call 7ff6e21545c0 410->418 419 7ff6e2151653-7ff6e2151681 call 7ff6e2164f08 call 7ff6e2152910 410->419 416 7ff6e215162e-7ff6e2151636 411->416 417 7ff6e215161e-7ff6e2151629 call 7ff6e2152710 411->417 417->416 426 7ff6e21516b8-7ff6e21516cf call 7ff6e21606d4 418->426 427 7ff6e215169e-7ff6e21516b3 call 7ff6e2152710 418->427 434 7ff6e21516f9-7ff6e21516fd 426->434 435 7ff6e21516d1-7ff6e21516f4 call 7ff6e2164f08 call 7ff6e2152910 426->435 433 7ff6e2151821-7ff6e2151824 call 7ff6e216004c 427->433 442 7ff6e2151829-7ff6e215183b 433->442 436 7ff6e2151717-7ff6e2151737 call 7ff6e2164f44 434->436 437 7ff6e21516ff-7ff6e215170b call 7ff6e2151210 434->437 447 7ff6e2151819-7ff6e215181c call 7ff6e216004c 435->447 448 7ff6e2151739-7ff6e215175c call 7ff6e2164f08 call 7ff6e2152910 436->448 449 7ff6e2151761-7ff6e215176c 436->449 444 7ff6e2151710-7ff6e2151712 437->444 444->447 447->433 462 7ff6e215180f-7ff6e2151814 448->462 453 7ff6e2151802-7ff6e215180a call 7ff6e2164f30 449->453 454 7ff6e2151772-7ff6e2151777 449->454 453->462 457 7ff6e2151780-7ff6e21517a2 call 7ff6e216039c 454->457 464 7ff6e21517da-7ff6e21517e6 call 7ff6e2164f08 457->464 465 7ff6e21517a4-7ff6e21517bc call 7ff6e2160adc 457->465 462->447 472 7ff6e21517ed-7ff6e21517f8 call 7ff6e2152910 464->472 470 7ff6e21517c5-7ff6e21517d8 call 7ff6e2164f08 465->470 471 7ff6e21517be-7ff6e21517c1 465->471 470->472 471->457 473 7ff6e21517c3 471->473 476 7ff6e21517fd 472->476 473->476 476->453
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CurrentProcess
                                                                                                                                                                                                              • String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                                                                                                                                                                                              • API String ID: 2050909247-1550345328
                                                                                                                                                                                                              • Opcode ID: 699b07d72f1735d7c885b9dbb6de8a58e33d3d0405fcbb6628763dd0b7ee24f4
                                                                                                                                                                                                              • Instruction ID: 14f70254904721b0c814fe08b53c9a12940062c80676413d58f49948e9547f18
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 699b07d72f1735d7c885b9dbb6de8a58e33d3d0405fcbb6628763dd0b7ee24f4
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5F51AC63E4864282EA11AB55D4402E92393BF8179CF484571EF1DC77D2DFBEE744830A
                                                                                                                                                                                                              Function 00007FF6E2158660 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116COMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetTempPathW.KERNEL32(?,?,00000000,00007FF6E2153CBB), ref: 00007FF6E2158704
                                                                                                                                                                                                              • GetCurrentProcessId.KERNEL32(?,00000000,00007FF6E2153CBB), ref: 00007FF6E215870A
                                                                                                                                                                                                              • CreateDirectoryW.KERNELBASE(?,00000000,00007FF6E2153CBB), ref: 00007FF6E215874C
                                                                                                                                                                                                                • Part of subcall function 00007FF6E2158830: GetEnvironmentVariableW.KERNEL32(00007FF6E215388E), ref: 00007FF6E2158867
                                                                                                                                                                                                                • Part of subcall function 00007FF6E2158830: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF6E2158889
                                                                                                                                                                                                                • Part of subcall function 00007FF6E2168238: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E2168251
                                                                                                                                                                                                                • Part of subcall function 00007FF6E2152810: MessageBoxW.USER32 ref: 00007FF6E21528EA
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
                                                                                                                                                                                                              • String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
                                                                                                                                                                                                              • API String ID: 3563477958-1339014028
                                                                                                                                                                                                              • Opcode ID: 191653d34e5a06968e8282251bef030903df87164e49fe651f79a53b4d97858f
                                                                                                                                                                                                              • Instruction ID: b6b1e06ab56150865575e8018c6460c5ad60f7de8c75506e6a76c0b049cfb0fc
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 191653d34e5a06968e8282251bef030903df87164e49fe651f79a53b4d97858f
                                                                                                                                                                                                              • Instruction Fuzzy Hash: DE41B523E2964644EA20AB65A8513F91293AF857CCF810071DF0DC77DADEBED745C24A
                                                                                                                                                                                                              Function 00007FF6E2151210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158COMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 756 7ff6e2151210-7ff6e215126d call 7ff6e215bd80 759 7ff6e2151297-7ff6e21512af call 7ff6e2164f44 756->759 760 7ff6e215126f-7ff6e2151296 call 7ff6e2152710 756->760 765 7ff6e21512d4-7ff6e21512e4 call 7ff6e2164f44 759->765 766 7ff6e21512b1-7ff6e21512cf call 7ff6e2164f08 call 7ff6e2152910 759->766 771 7ff6e21512e6-7ff6e2151304 call 7ff6e2164f08 call 7ff6e2152910 765->771 772 7ff6e2151309-7ff6e215131b 765->772 779 7ff6e2151439-7ff6e215144e call 7ff6e215ba60 call 7ff6e2164f30 * 2 766->779 771->779 775 7ff6e2151320-7ff6e2151345 call 7ff6e216039c 772->775 785 7ff6e215134b-7ff6e2151355 call 7ff6e2160110 775->785 786 7ff6e2151431 775->786 793 7ff6e2151453-7ff6e215146d 779->793 785->786 792 7ff6e215135b-7ff6e2151367 785->792 786->779 794 7ff6e2151370-7ff6e2151398 call 7ff6e215a1c0 792->794 797 7ff6e215139a-7ff6e215139d 794->797 798 7ff6e2151416-7ff6e215142c call 7ff6e2152710 794->798 799 7ff6e215139f-7ff6e21513a9 797->799 800 7ff6e2151411 797->800 798->786 802 7ff6e21513ab-7ff6e21513b9 call 7ff6e2160adc 799->802 803 7ff6e21513d4-7ff6e21513d7 799->803 800->798 808 7ff6e21513be-7ff6e21513c1 802->808 805 7ff6e21513ea-7ff6e21513ef 803->805 806 7ff6e21513d9-7ff6e21513e7 call 7ff6e2179e30 803->806 805->794 807 7ff6e21513f5-7ff6e21513f8 805->807 806->805 810 7ff6e21513fa-7ff6e21513fd 807->810 811 7ff6e215140c-7ff6e215140f 807->811 812 7ff6e21513c3-7ff6e21513cd call 7ff6e2160110 808->812 813 7ff6e21513cf-7ff6e21513d2 808->813 810->798 815 7ff6e21513ff-7ff6e2151407 810->815 811->786 812->805 812->813 813->798 815->775
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CurrentProcess
                                                                                                                                                                                                              • String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                                                                                                                                                              • API String ID: 2050909247-2813020118
                                                                                                                                                                                                              • Opcode ID: b715c76ab38b7b4dfee5c32bc52a61b3ea5d4668c2ab7e2166fd60b1101cc4ae
                                                                                                                                                                                                              • Instruction ID: 8c5a92bd6e53f7045fc4d07042ef86adc34abfbca8375d64d92e7f31b9c8af18
                                                                                                                                                                                                              • Opcode Fuzzy Hash: b715c76ab38b7b4dfee5c32bc52a61b3ea5d4668c2ab7e2166fd60b1101cc4ae
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5451DF23E4864285EA61AB11E4503FA6293BF81798F480175EF0DC77C5EFBEE641C70A
                                                                                                                                                                                                              Function 00007FF6E216ED10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • FreeLibrary.KERNEL32(?,?,?,00007FF6E216F0AA,?,?,-00000018,00007FF6E216AD53,?,?,?,00007FF6E216AC4A,?,?,?,00007FF6E2165F3E), ref: 00007FF6E216EE8C
                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,?,?,00007FF6E216F0AA,?,?,-00000018,00007FF6E216AD53,?,?,?,00007FF6E216AC4A,?,?,?,00007FF6E2165F3E), ref: 00007FF6E216EE98
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: AddressFreeLibraryProc
                                                                                                                                                                                                              • String ID: api-ms-$ext-ms-
                                                                                                                                                                                                              • API String ID: 3013587201-537541572
                                                                                                                                                                                                              • Opcode ID: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
                                                                                                                                                                                                              • Instruction ID: 02a5e0b0d5784069128e0ac7d93baa69024115d0f734a7f67243c0751cba561d
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8A41F933F2D60141EA15CB56D8407F92293BF49B98F984639DE1DC7384EFBEE6058209
                                                                                                                                                                                                              Function 00007FF6E21536B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61COMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetModuleFileNameW.KERNEL32(?,00007FF6E2153804), ref: 00007FF6E21536E1
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00007FF6E2153804), ref: 00007FF6E21536EB
                                                                                                                                                                                                                • Part of subcall function 00007FF6E2152C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF6E2153706,?,00007FF6E2153804), ref: 00007FF6E2152C9E
                                                                                                                                                                                                                • Part of subcall function 00007FF6E2152C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6E2153706,?,00007FF6E2153804), ref: 00007FF6E2152D63
                                                                                                                                                                                                                • Part of subcall function 00007FF6E2152C50: MessageBoxW.USER32 ref: 00007FF6E2152D99
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
                                                                                                                                                                                                              • String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
                                                                                                                                                                                                              • API String ID: 3187769757-2863816727
                                                                                                                                                                                                              • Opcode ID: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
                                                                                                                                                                                                              • Instruction ID: 2bd2243f81b6cd83946e9cb5a380921d6839b4a9877ad4fb7bbf521e3f0b8684
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
                                                                                                                                                                                                              • Instruction Fuzzy Hash: E1219F63F5864281FA209B20E8443FA2252BF8834CF800172E75EC75D5EEAEE705C34A
                                                                                                                                                                                                              Function 00007FF6E216BA5C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 901 7ff6e216ba5c-7ff6e216ba82 902 7ff6e216ba9d-7ff6e216baa1 901->902 903 7ff6e216ba84-7ff6e216ba98 call 7ff6e2164ee8 call 7ff6e2164f08 901->903 905 7ff6e216be77-7ff6e216be83 call 7ff6e2164ee8 call 7ff6e2164f08 902->905 906 7ff6e216baa7-7ff6e216baae 902->906 919 7ff6e216be8e 903->919 925 7ff6e216be89 call 7ff6e216a8e0 905->925 906->905 908 7ff6e216bab4-7ff6e216bae2 906->908 908->905 911 7ff6e216bae8-7ff6e216baef 908->911 914 7ff6e216bb08-7ff6e216bb0b 911->914 915 7ff6e216baf1-7ff6e216bb03 call 7ff6e2164ee8 call 7ff6e2164f08 911->915 917 7ff6e216be73-7ff6e216be75 914->917 918 7ff6e216bb11-7ff6e216bb17 914->918 915->925 922 7ff6e216be91-7ff6e216bea8 917->922 918->917 923 7ff6e216bb1d-7ff6e216bb20 918->923 919->922 923->915 926 7ff6e216bb22-7ff6e216bb47 923->926 925->919 929 7ff6e216bb7a-7ff6e216bb81 926->929 930 7ff6e216bb49-7ff6e216bb4b 926->930 934 7ff6e216bb56-7ff6e216bb6d call 7ff6e2164ee8 call 7ff6e2164f08 call 7ff6e216a8e0 929->934 935 7ff6e216bb83-7ff6e216bbab call 7ff6e216d5fc call 7ff6e216a948 * 2 929->935 932 7ff6e216bb4d-7ff6e216bb54 930->932 933 7ff6e216bb72-7ff6e216bb78 930->933 932->933 932->934 938 7ff6e216bbf8-7ff6e216bc0f 933->938 966 7ff6e216bd00 934->966 962 7ff6e216bbad-7ff6e216bbc3 call 7ff6e2164f08 call 7ff6e2164ee8 935->962 963 7ff6e216bbc8-7ff6e216bbf3 call 7ff6e216c284 935->963 941 7ff6e216bc8a-7ff6e216bc94 call 7ff6e217391c 938->941 942 7ff6e216bc11-7ff6e216bc19 938->942 954 7ff6e216bc9a-7ff6e216bcaf 941->954 955 7ff6e216bd1e 941->955 942->941 943 7ff6e216bc1b-7ff6e216bc1d 942->943 943->941 947 7ff6e216bc1f-7ff6e216bc35 943->947 947->941 951 7ff6e216bc37-7ff6e216bc43 947->951 951->941 956 7ff6e216bc45-7ff6e216bc47 951->956 954->955 960 7ff6e216bcb1-7ff6e216bcc3 GetConsoleMode 954->960 958 7ff6e216bd23-7ff6e216bd43 ReadFile 955->958 956->941 961 7ff6e216bc49-7ff6e216bc61 956->961 964 7ff6e216be3d-7ff6e216be46 GetLastError 958->964 965 7ff6e216bd49-7ff6e216bd51 958->965 960->955 967 7ff6e216bcc5-7ff6e216bccd 960->967 961->941 971 7ff6e216bc63-7ff6e216bc6f 961->971 962->966 963->938 968 7ff6e216be48-7ff6e216be5e call 7ff6e2164f08 call 7ff6e2164ee8 964->968 969 7ff6e216be63-7ff6e216be66 964->969 965->964 973 7ff6e216bd57 965->973 970 7ff6e216bd03-7ff6e216bd0d call 7ff6e216a948 966->970 967->958 975 7ff6e216bccf-7ff6e216bcf1 ReadConsoleW 967->975 968->966 979 7ff6e216be6c-7ff6e216be6e 969->979 980 7ff6e216bcf9-7ff6e216bcfb call 7ff6e2164e7c 969->980 970->922 971->941 978 7ff6e216bc71-7ff6e216bc73 971->978 982 7ff6e216bd5e-7ff6e216bd73 973->982 984 7ff6e216bd12-7ff6e216bd1c 975->984 985 7ff6e216bcf3 GetLastError 975->985 978->941 989 7ff6e216bc75-7ff6e216bc85 978->989 979->970 980->966 982->970 991 7ff6e216bd75-7ff6e216bd80 982->991 984->982 985->980 989->941 994 7ff6e216bda7-7ff6e216bdaf 991->994 995 7ff6e216bd82-7ff6e216bd9b call 7ff6e216b674 991->995 996 7ff6e216be2b-7ff6e216be38 call 7ff6e216b4b4 994->996 997 7ff6e216bdb1-7ff6e216bdc3 994->997 1003 7ff6e216bda0-7ff6e216bda2 995->1003 996->1003 1000 7ff6e216bdc5 997->1000 1001 7ff6e216be1e-7ff6e216be26 997->1001 1004 7ff6e216bdca-7ff6e216bdd1 1000->1004 1001->970 1003->970 1006 7ff6e216be0d-7ff6e216be18 1004->1006 1007 7ff6e216bdd3-7ff6e216bdd7 1004->1007 1006->1001 1008 7ff6e216bdd9-7ff6e216bde0 1007->1008 1009 7ff6e216bdf3 1007->1009 1008->1009 1010 7ff6e216bde2-7ff6e216bde6 1008->1010 1011 7ff6e216bdf9-7ff6e216be09 1009->1011 1010->1009 1012 7ff6e216bde8-7ff6e216bdf1 1010->1012 1011->1004 1013 7ff6e216be0b 1011->1013 1012->1011 1013->1001
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                              • Opcode ID: bd5e670e2ac73c9d5051395424effa1a9c5fa8f9f080fcfac4df12f3bd03b0fb
                                                                                                                                                                                                              • Instruction ID: 492d430053e0d7cf1c2dbfa9cb2693a0f9569cbe61735da1678834133986f1ef
                                                                                                                                                                                                              • Opcode Fuzzy Hash: bd5e670e2ac73c9d5051395424effa1a9c5fa8f9f080fcfac4df12f3bd03b0fb
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8AC1F033D2868681E6608B1590803FD6B52EB81B98F550131EB4ED7791CEFFE745870A
                                                                                                                                                                                                              Function 00007FF6E2158570 Relevance: 10.6, APIs: 7, Instructions: 63COMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 995526605-0
                                                                                                                                                                                                              • Opcode ID: 1c88e2159774aae00215e56fe2a2a719af09135261df6dbcfc7a62e4558c2eb4
                                                                                                                                                                                                              • Instruction ID: 4323e6d103b4b3498319d9643d724ab856bddbdb4d8cd012e415deaf337ec80e
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1c88e2159774aae00215e56fe2a2a719af09135261df6dbcfc7a62e4558c2eb4
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 17216432E0C64641EB108B59F4443AAA3A2FFC17A8F500235E76DC3AD4DFADD6458745
                                                                                                                                                                                                              Function 00007FF6E21590E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 00007FF6E2158570: GetCurrentProcess.KERNEL32 ref: 00007FF6E2158590
                                                                                                                                                                                                                • Part of subcall function 00007FF6E2158570: OpenProcessToken.ADVAPI32 ref: 00007FF6E21585A3
                                                                                                                                                                                                                • Part of subcall function 00007FF6E2158570: GetTokenInformation.KERNELBASE ref: 00007FF6E21585C8
                                                                                                                                                                                                                • Part of subcall function 00007FF6E2158570: GetLastError.KERNEL32 ref: 00007FF6E21585D2
                                                                                                                                                                                                                • Part of subcall function 00007FF6E2158570: GetTokenInformation.KERNELBASE ref: 00007FF6E2158612
                                                                                                                                                                                                                • Part of subcall function 00007FF6E2158570: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6E215862E
                                                                                                                                                                                                                • Part of subcall function 00007FF6E2158570: CloseHandle.KERNEL32 ref: 00007FF6E2158646
                                                                                                                                                                                                              • LocalFree.KERNEL32(?,00007FF6E2153C55), ref: 00007FF6E215916C
                                                                                                                                                                                                              • LocalFree.KERNEL32(?,00007FF6E2153C55), ref: 00007FF6E2159175
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                                                                                                                                                              • String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
                                                                                                                                                                                                              • API String ID: 6828938-1529539262
                                                                                                                                                                                                              • Opcode ID: 5ed7a9ba3e6ce910408607b93085540bd422a8d0f9e00f9f84049ca226c14b37
                                                                                                                                                                                                              • Instruction ID: ca79256b2201b0e9c25f9119f18bf51f1d685f183fb2bcda15a90feb3d907493
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5ed7a9ba3e6ce910408607b93085540bd422a8d0f9e00f9f84049ca226c14b37
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 29217E23E0874281F610AB50E8553EA62A2FF89788F444071EB4DC37C6DFBEDA44C786
                                                                                                                                                                                                              Function 00007FF6E2157E20 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateDirectoryW.KERNELBASE(00000000,?,00007FF6E215352C,?,00000000,00007FF6E2153F1B), ref: 00007FF6E2157F32
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CreateDirectory
                                                                                                                                                                                                              • String ID: %.*s$%s%c$\
                                                                                                                                                                                                              • API String ID: 4241100979-1685191245
                                                                                                                                                                                                              • Opcode ID: 302ffdc47f1f131389ecc473fe7ae023bae846d875cccfc6523225b15fd92315
                                                                                                                                                                                                              • Instruction ID: c463de639151b2a20e2dccdaefdc30b5360a639a126e70f1264d9c112f97a014
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 302ffdc47f1f131389ecc473fe7ae023bae846d875cccfc6523225b15fd92315
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8B31E122F19AC545EA218B20E8503EA6256FB84BE8F040231EF6DC7BC9DF6DD3028705
                                                                                                                                                                                                              Function 00007FF6E216CF60 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6E216CF4B), ref: 00007FF6E216D07C
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6E216CF4B), ref: 00007FF6E216D107
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ConsoleErrorLastMode
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 953036326-0
                                                                                                                                                                                                              • Opcode ID: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
                                                                                                                                                                                                              • Instruction ID: bbe36dfc50154ff811872fef0901d9746f4721379bd6ee3374ba3ef7169d3319
                                                                                                                                                                                                              • Opcode Fuzzy Hash: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0791B633E2865145F7509F6598803FD27A2BB4478CF544139DF0ED6684DFBAD642C70A
                                                                                                                                                                                                              Function 00007FF6E216F98C Relevance: 6.2, APIs: 4, Instructions: 162COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _get_daylight$_isindst
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 4170891091-0
                                                                                                                                                                                                              • Opcode ID: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
                                                                                                                                                                                                              • Instruction ID: 79549f2cd96a98e9e411ca4400af2d3accca44a6a7150b61b93e2ad45f33d56a
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4F511473F142528AEB28CF6499913FC2762AB4435CF140235DF1ED2AE5DF79A602C705
                                                                                                                                                                                                              Function 00007FF6E216577C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2780335769-0
                                                                                                                                                                                                              • Opcode ID: 6aefb500db5e0848cb3e1a230f039049599ff649377a7022c72adab745f1037c
                                                                                                                                                                                                              • Instruction ID: 14e35ba40ae6f47b8af5e0545336bc8860c4aaa4d73f5676cdd2c989ddd3b2a8
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6aefb500db5e0848cb3e1a230f039049599ff649377a7022c72adab745f1037c
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 13517B33E286419AFB10CF65D4903BD27A6AB48B9CF108434DF49C7A88DFB9D6808706
                                                                                                                                                                                                              Function 00007FF6E2165628 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1279662727-0
                                                                                                                                                                                                              • Opcode ID: 8f3d5377b4ca72f71b0fe910297a4b2920b1cd85568e136600ee028e7f718979
                                                                                                                                                                                                              • Instruction ID: 4c8c9976b9b00495593ec1a5b1f6a18b4f3f91f93af2ad3f720d123519577c2e
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8f3d5377b4ca72f71b0fe910297a4b2920b1cd85568e136600ee028e7f718979
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1B41B233D2878293E3108B20D5903BD6262FB943A8F108334E79C83AD1DFADA2E08745
                                                                                                                                                                                                              Function 00007FF6E215CC3C Relevance: 4.6, APIs: 3, Instructions: 94COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3251591375-0
                                                                                                                                                                                                              • Opcode ID: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
                                                                                                                                                                                                              • Instruction ID: c146bd5e7abf35718aaa6020d33936ce2044c7f1bb20c4d66abb7160ae859cec
                                                                                                                                                                                                              • Opcode Fuzzy Hash: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9E310823E8814742FA14AB65D4613F91683AF9538CF4454B4DB0EC72E3DEAFA704824B
                                                                                                                                                                                                              Function 00007FF6E2169A30 Relevance: 4.5, APIs: 3, Instructions: 14COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1703294689-0
                                                                                                                                                                                                              • Opcode ID: 148d460979eed4a43ebbf671c65dc2dc638c0d89c9c01e8e00358d5495882c84
                                                                                                                                                                                                              • Instruction ID: 70789bed07e5b05ce9050992da6ebba834131a8f4610f79bd5c3d0b5dfc5e63c
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 148d460979eed4a43ebbf671c65dc2dc638c0d89c9c01e8e00358d5495882c84
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 12D06722F1870643EA142B70A8992FD12976F89719B141438CA0BC6393DEAFAB49424B
                                                                                                                                                                                                              Function 00007FF6E216013C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                              • Opcode ID: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
                                                                                                                                                                                                              • Instruction ID: 30c3763d89886e07d4315b4f6fe4fda6d624e3a475df585e20560161f028a5ef
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4B51A533E29241C6E6249A2594407FE6692BF44BACF184638DF6DC37C5CEFED641860A
                                                                                                                                                                                                              Function 00007FF6E216C134 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ErrorFileLastPointer
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2976181284-0
                                                                                                                                                                                                              • Opcode ID: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
                                                                                                                                                                                                              • Instruction ID: fc239428f3a6f8c1d01bab348f449e7ef3cfe90046669e426bd1b90bc14303dc
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
                                                                                                                                                                                                              • Instruction Fuzzy Hash: BF11D332A18A4181DA208B15E8442AD6262AB51BF8F540331EB7DC77D4CEBDD2508705
                                                                                                                                                                                                              Function 00007FF6E2165924 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6E2165839), ref: 00007FF6E2165957
                                                                                                                                                                                                              • SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6E2165839), ref: 00007FF6E216596D
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Time$System$FileLocalSpecific
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1707611234-0
                                                                                                                                                                                                              • Opcode ID: 497c6f3b45805196ef8f930e068bad9451f3f50de380bc241881b145e929bf5b
                                                                                                                                                                                                              • Instruction ID: 25466b283d67363eb08b3168fbe6daa45e92ea5eae636ce9aec0285396e088d7
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 497c6f3b45805196ef8f930e068bad9451f3f50de380bc241881b145e929bf5b
                                                                                                                                                                                                              • Instruction Fuzzy Hash: D611B232A1C60281EB144F04E4903BFB761EB85779F500235FB9AC1AD4EFADD254CB05
                                                                                                                                                                                                              Function 00007FF6E216A948 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • RtlFreeHeap.NTDLL(?,?,?,00007FF6E2172D22,?,?,?,00007FF6E2172D5F,?,?,00000000,00007FF6E2173225,?,?,?,00007FF6E2173157), ref: 00007FF6E216A95E
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF6E2172D22,?,?,?,00007FF6E2172D5F,?,?,00000000,00007FF6E2173225,?,?,?,00007FF6E2173157), ref: 00007FF6E216A968
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 485612231-0
                                                                                                                                                                                                              • Opcode ID: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
                                                                                                                                                                                                              • Instruction ID: 2b7bb5caf54601de81718cb3568a320cb6d12908abee972b8ace5ab0a43008a3
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7BE08622F2920282FF155BF1D4953FD12536FC5B08F450030CB0EC2291DEAE6B81831A
                                                                                                                                                                                                              Function 00007FF6E216AB58 Relevance: 2.6, APIs: 2, Instructions: 59COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CloseHandle.KERNELBASE(?,?,?,00007FF6E216A9D5,?,?,00000000,00007FF6E216AA8A), ref: 00007FF6E216ABC6
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF6E216A9D5,?,?,00000000,00007FF6E216AA8A), ref: 00007FF6E216ABD0
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CloseErrorHandleLast
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 918212764-0
                                                                                                                                                                                                              • Opcode ID: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
                                                                                                                                                                                                              • Instruction ID: 8af83a48d930e2481a7f8504f8b280fc53c269beb8ca2e5512b1937eac560a3d
                                                                                                                                                                                                              • Opcode Fuzzy Hash: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
                                                                                                                                                                                                              • Instruction Fuzzy Hash: AE218033F2868641EAA0575194D03FD16839F84799F084239DB2EC77D1CEEEE645430A
                                                                                                                                                                                                              Function 00007FF6E216BEAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                              • Opcode ID: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
                                                                                                                                                                                                              • Instruction ID: bc4c7fcf9ad18f5357ab9ef51cba9ed6663c0d754578cc927a6373d5b4e39766
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7D41B333D2824187EA248B19A5903BD77A2EB55748F140131DB8FD36D1CFAEE702CB56
                                                                                                                                                                                                              Function 00007FF6E2157F90 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _fread_nolock
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 840049012-0
                                                                                                                                                                                                              • Opcode ID: 8f4ba5022fc30e0ba7cf4537500ecc8a70287c5e6e532bbcdc4af1ac85e1c2ee
                                                                                                                                                                                                              • Instruction ID: 109f8931e339dbb2203410112c125ae6b6be11d81210b76afb8625317c638c7a
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8f4ba5022fc30e0ba7cf4537500ecc8a70287c5e6e532bbcdc4af1ac85e1c2ee
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 64219322F5865586EB509B2274043FA9642BF45BC8F894570EF0DC7786DEFEE281C20A
                                                                                                                                                                                                              Function 00007FF6E216B93C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                              • Opcode ID: 0fe3e981c7cf3185d146a9a4244026f2f164e791e6f92d2a50fd94940550a020
                                                                                                                                                                                                              • Instruction ID: 194d74d16e6a73733035c7f928ed1f22a79c56efce7a1825664ded22063e102f
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0fe3e981c7cf3185d146a9a4244026f2f164e791e6f92d2a50fd94940550a020
                                                                                                                                                                                                              • Instruction Fuzzy Hash: A0314F73E3860285E6215F5584813FD2692AB80B98F510135EB5ED73D2CEFEE741871B
                                                                                                                                                                                                              Function 00007FF6E2169961 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: HandleModule$AddressFreeLibraryProc
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3947729631-0
                                                                                                                                                                                                              • Opcode ID: 42808d7c08696a35870eb95595f0ae95ff90971c005bfc8769c42bb91e99b0de
                                                                                                                                                                                                              • Instruction ID: 8b86f537d065719becd4bb556afaaf2c0d4318d5edcd1b0ce627b8a4d048b6a3
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 42808d7c08696a35870eb95595f0ae95ff90971c005bfc8769c42bb91e99b0de
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 60214873E24A458AEB248F64C4803EC32A1FB4471CF44463AD76D86A95DFB99688C746
                                                                                                                                                                                                              Function 00007FF6E2165F94 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                              • Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
                                                                                                                                                                                                              • Instruction ID: 76f563a76c1fed680811b9f7e66cad760f45e5995727c7e35f74b097dceb3ff8
                                                                                                                                                                                                              • Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0F119633E3C64285EE609F5194803FDA666BF85B88F544431EB4CD7A96CFBED600874A
                                                                                                                                                                                                              Function 00007FF6E2176354 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                              • Opcode ID: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
                                                                                                                                                                                                              • Instruction ID: f238275630b9d07fa206712b732f1cd0be768266f3d93338a05784b6060caf09
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
                                                                                                                                                                                                              • Instruction Fuzzy Hash: EF219033A18A8186DB608F18D4803AA77A2BBC5B98F144234E75EC66D9DF7ED901CB05
                                                                                                                                                                                                              Function 00007FF6E21603BC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                              • Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
                                                                                                                                                                                                              • Instruction ID: a8e9193938e96db4a6899d2125effc54e388453fb9c83d684b9fe25ccc9e535f
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
                                                                                                                                                                                                              • Instruction Fuzzy Hash: DF01C232E2874180E914DB5299402FDA692BF81FE8F484674EF5CD3BD6CEBED6018305
                                                                                                                                                                                                              Function 00007FF6E216D5FC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,?,?,00007FF6E2160C90,?,?,?,00007FF6E21622FA,?,?,?,?,?,00007FF6E2163AE9), ref: 00007FF6E216D63A
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: AllocHeap
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 4292702814-0
                                                                                                                                                                                                              • Opcode ID: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
                                                                                                                                                                                                              • Instruction ID: 1b729a97783a4f9e648918843534332faf5fb6e452d756187362e842679ca94b
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7EF05E22F2924245FE6417715C813FD11935FC57ACF084730DF2EC52C1DEAEA690825A

                                                                                                                                                                                                              Non-executed Functions

                                                                                                                                                                                                              Function 00007FF6E2155830 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF6E21564CF,?,00007FF6E215336E), ref: 00007FF6E2155840
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00007FF6E21564CF,?,00007FF6E215336E), ref: 00007FF6E2155852
                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF6E21564CF,?,00007FF6E215336E), ref: 00007FF6E2155889
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00007FF6E21564CF,?,00007FF6E215336E), ref: 00007FF6E215589B
                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF6E21564CF,?,00007FF6E215336E), ref: 00007FF6E21558B4
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00007FF6E21564CF,?,00007FF6E215336E), ref: 00007FF6E21558C6
                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF6E21564CF,?,00007FF6E215336E), ref: 00007FF6E21558DF
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00007FF6E21564CF,?,00007FF6E215336E), ref: 00007FF6E21558F1
                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF6E21564CF,?,00007FF6E215336E), ref: 00007FF6E215590D
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00007FF6E21564CF,?,00007FF6E215336E), ref: 00007FF6E215591F
                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF6E21564CF,?,00007FF6E215336E), ref: 00007FF6E215593B
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00007FF6E21564CF,?,00007FF6E215336E), ref: 00007FF6E215594D
                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF6E21564CF,?,00007FF6E215336E), ref: 00007FF6E2155969
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00007FF6E21564CF,?,00007FF6E215336E), ref: 00007FF6E215597B
                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF6E21564CF,?,00007FF6E215336E), ref: 00007FF6E2155997
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00007FF6E21564CF,?,00007FF6E215336E), ref: 00007FF6E21559A9
                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF6E21564CF,?,00007FF6E215336E), ref: 00007FF6E21559C5
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00007FF6E21564CF,?,00007FF6E215336E), ref: 00007FF6E21559D7
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: AddressErrorLastProc
                                                                                                                                                                                                              • String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
                                                                                                                                                                                                              • API String ID: 199729137-653951865
                                                                                                                                                                                                              • Opcode ID: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
                                                                                                                                                                                                              • Instruction ID: 61912f7acd12f7028def84b506919813b99d23d3d85f1c986a977b6d58bc4d6c
                                                                                                                                                                                                              • Opcode Fuzzy Hash: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9922B366D49B07A1FA558B55E8147F422A3BF8674DF541035C61FC22A0FFFEA788830A
                                                                                                                                                                                                              Function 00007FF6E21740AC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
                                                                                                                                                                                                              • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                                                                                                                                                              • API String ID: 808467561-2761157908
                                                                                                                                                                                                              • Opcode ID: 7da0388417e7c773b0aab48e07e342724827a26e5879d16e5decf6c79e081c8c
                                                                                                                                                                                                              • Instruction ID: 4c1e702b34a3e6dede4ea9f6e0f7c4dac6c75aee0c3f92040e6175ee154c66c0
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7da0388417e7c773b0aab48e07e342724827a26e5879d16e5decf6c79e081c8c
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 72B2B173E182928AE7258E64D4407FD36B2FB9638CF505135DB09D7AC4DFBAAA008B45
                                                                                                                                                                                                              Function 00007FF6E215ACAD Relevance: 12.0, Strings: 9, Instructions: 744COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
                                                                                                                                                                                                              • API String ID: 0-2665694366
                                                                                                                                                                                                              • Opcode ID: 14409f6b5173d9f28888b9fb9c68bcc2b54b8e7def706e6c40ef53002486e1ba
                                                                                                                                                                                                              • Instruction ID: 0fcb3ac30640c787e44de0d9dc5d5a4d864d26dfe6978ea2d3d7fa47ba5322ce
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 14409f6b5173d9f28888b9fb9c68bcc2b54b8e7def706e6c40ef53002486e1ba
                                                                                                                                                                                                              • Instruction Fuzzy Hash: FD52C173E546A68BD7A48F14C458BBE3BAAEB44344F014139E74AC3784DFBADA40CB45
                                                                                                                                                                                                              Function 00007FF6E215D12C Relevance: 10.6, APIs: 7, Instructions: 71COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3140674995-0
                                                                                                                                                                                                              • Opcode ID: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
                                                                                                                                                                                                              • Instruction ID: 7edca1d3394ab746c28357a8ee3b33e26f8d548fc3ccf9a36028711439e90a6f
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
                                                                                                                                                                                                              • Instruction Fuzzy Hash: E7315C73A09B8186EB608F60E8843EE3361FB95708F04403ADB4E87B94DF79D648C705
                                                                                                                                                                                                              Function 00007FF6E216A614 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1239891234-0
                                                                                                                                                                                                              • Opcode ID: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
                                                                                                                                                                                                              • Instruction ID: 2dbbba5189a78a9a9ec759c725910a8f6a79c7b8fb61533b103f6baa5aee0b4a
                                                                                                                                                                                                              • Opcode Fuzzy Hash: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 78316B33A18B8186DB208B25E8843EE73A5FB99758F540135EB8EC3B94DF7DD2458B05
                                                                                                                                                                                                              Function 00007FF6E2171874 Relevance: 7.8, APIs: 5, Instructions: 282COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: FileFindFirst_invalid_parameter_noinfo
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2227656907-0
                                                                                                                                                                                                              • Opcode ID: ee5daded1920a45b930385d49f4c9fb7106de6f00b6358014c2482279c1420ad
                                                                                                                                                                                                              • Instruction ID: 6c393394069bc4215b11d833ee78c6cce62ca57a7224454f15f98c1ffa4e4691
                                                                                                                                                                                                              • Opcode Fuzzy Hash: ee5daded1920a45b930385d49f4c9fb7106de6f00b6358014c2482279c1420ad
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 28B1C323F1868241EA609B25D4003F963A2EB86BE8F485131DF4DC7BC5EEBDE641C305
                                                                                                                                                                                                              Function 00007FF6E215D010 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2933794660-0
                                                                                                                                                                                                              • Opcode ID: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
                                                                                                                                                                                                              • Instruction ID: 1ceb0bab9867d38da2ed9b918334c53b4a219aeab7db985b1e650b3fe4a1bcf1
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 25111C22B15B058AEB008B60E8943B933A4FB5A75CF440E31EB6DC67A4DFB8E2548345
                                                                                                                                                                                                              Function 00007FF6E2173C10 Relevance: 4.8, APIs: 3, Instructions: 340COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: memcpy_s
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1502251526-0
                                                                                                                                                                                                              • Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                                                                                                                                                                                              • Instruction ID: a1e03ea2ccd1ac99ea131dbcfb64d2df5407c1bc6e73d4ae00c64246b36bb272
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3BC1C273A1828687E7248F15E0447AAB7A2F785B88F548135DB4A83784DF7EEA018B45
                                                                                                                                                                                                              Function 00007FF6E215A47B Relevance: 4.1, Strings: 3, Instructions: 397COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID: $header crc mismatch$unknown header flags set
                                                                                                                                                                                                              • API String ID: 0-1127688429
                                                                                                                                                                                                              • Opcode ID: e32b299fc273864699ec3bddfbf8fc958dab4a7742ffdf8f0166f3b43fcc42d1
                                                                                                                                                                                                              • Instruction ID: 238af929d3d5f56df4bd90365aab5273e3f4121c36601c7fbd74de87fb8c56b0
                                                                                                                                                                                                              • Opcode Fuzzy Hash: e32b299fc273864699ec3bddfbf8fc958dab4a7742ffdf8f0166f3b43fcc42d1
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 86F19373E982D54AE7A58B14C088B7A3AAAFF44748F054178DB49C7390DFBEE640C785
                                                                                                                                                                                                              Function 00007FF6E2179728 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ExceptionRaise_clrfp
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 15204871-0
                                                                                                                                                                                                              • Opcode ID: a4cc0e8a2f7e024105bf8074fef1866164229a93701b52dcf00f6f20498becf3
                                                                                                                                                                                                              • Instruction ID: a364e19e01bb0b2eb2e3c8ccf8a511d924802f8dfeddb576de29cd2f60dab028
                                                                                                                                                                                                              • Opcode Fuzzy Hash: a4cc0e8a2f7e024105bf8074fef1866164229a93701b52dcf00f6f20498becf3
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1AB16973A00B898AEB19CF29C8463A83BA1F785B4CF148821DB5DC37A4CF7AD555C705
                                                                                                                                                                                                              Function 00007FF6E21639A4 Relevance: 2.8, Strings: 2, Instructions: 350COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID: $
                                                                                                                                                                                                              • API String ID: 0-227171996
                                                                                                                                                                                                              • Opcode ID: e57f1980f4491aea9eb328a1e81193c2bccc9a7e68d1918bb9b7207cf9600634
                                                                                                                                                                                                              • Instruction ID: 93080bee145216c5bd7219e8d4cf938bfbdcc40f531b7b05f0b6cabaa1153682
                                                                                                                                                                                                              • Opcode Fuzzy Hash: e57f1980f4491aea9eb328a1e81193c2bccc9a7e68d1918bb9b7207cf9600634
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1AE1C333E2864641E7688E2980D02BD23A2EF44F4CF144135DB0EC76D4DF6BEA51D38A
                                                                                                                                                                                                              Function 00007FF6E215A2DB Relevance: 2.7, Strings: 2, Instructions: 218COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID: incorrect header check$invalid window size
                                                                                                                                                                                                              • API String ID: 0-900081337
                                                                                                                                                                                                              • Opcode ID: e8ec78490181e4ccec650f854842bb3e08bcfae3bf2db5596c2af0d8e2ff5899
                                                                                                                                                                                                              • Instruction ID: 3afc2104ada945f00a4b104c2bb307a2d0eaf39a016b22c03fdb83fdb9108a72
                                                                                                                                                                                                              • Opcode Fuzzy Hash: e8ec78490181e4ccec650f854842bb3e08bcfae3bf2db5596c2af0d8e2ff5899
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 99919873E582C687E7A48F14C448BBE3AAAFB44358F114179DB4AC6784CF79E640CB46
                                                                                                                                                                                                              Function 00007FF6E216DEF0 Relevance: 2.6, Strings: 2, Instructions: 144COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID: e+000$gfff
                                                                                                                                                                                                              • API String ID: 0-3030954782
                                                                                                                                                                                                              • Opcode ID: c8a24eaff8c968987b4d031b15ae93849e98bcf9eddb8930961e84febef9b5bc
                                                                                                                                                                                                              • Instruction ID: 422e9faffacbdb3fe5438a286be37af845098dd3a7ac4ee4bb5c465478665ef9
                                                                                                                                                                                                              • Opcode Fuzzy Hash: c8a24eaff8c968987b4d031b15ae93849e98bcf9eddb8930961e84febef9b5bc
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0A514773F2C2C146E7258E3598807AD7B92E744B98F488231CB98C7AC5CFBED6458706
                                                                                                                                                                                                              Function 00007FF6E21708C8 Relevance: 2.0, APIs: 1, Instructions: 461COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CurrentFeaturePresentProcessProcessor
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1010374628-0
                                                                                                                                                                                                              • Opcode ID: 237fa8d459c5d11eae1bba494416b753c006fbba9c027a8b8839988129060696
                                                                                                                                                                                                              • Instruction ID: 8f04fcdc2ebd974156d42b00ebfcd179606330be072241aac3c460d6f0b5e06b
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 237fa8d459c5d11eae1bba494416b753c006fbba9c027a8b8839988129060696
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6602BD23E2E75245FA659F11D4403F92682AF82BA8F554638DF5DC63D1DEFFA600830A
                                                                                                                                                                                                              Function 00007FF6E216DA5C Relevance: 1.5, Strings: 1, Instructions: 254COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID: gfffffff
                                                                                                                                                                                                              • API String ID: 0-1523873471
                                                                                                                                                                                                              • Opcode ID: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
                                                                                                                                                                                                              • Instruction ID: a420c57a094133f0ddea8a48229c62689bee480be18aebdacce6b588c25ab5e8
                                                                                                                                                                                                              • Opcode Fuzzy Hash: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 79A14573E1878A46EB21CB25A8807ED7B92AB55B88F058031DF4DC7785DEBED601C706
                                                                                                                                                                                                              Function 00007FF6E2168794 Relevance: 1.4, Strings: 1, Instructions: 177COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                              • String ID: TMP
                                                                                                                                                                                                              • API String ID: 3215553584-3125297090
                                                                                                                                                                                                              • Opcode ID: 09cdd7cf7fc9e7e425d724a32e8c9d3bd5c12dba7606eca5b930980d9b4d1239
                                                                                                                                                                                                              • Instruction ID: c26cbada80029d38dbd9691e29de71c8c78d85d39f4b809241cd2901af3c0b69
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 09cdd7cf7fc9e7e425d724a32e8c9d3bd5c12dba7606eca5b930980d9b4d1239
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 89510923F2860641FA289B2655813FE52976F85BDCF594034DF0DC37D2EEBEE609420A
                                                                                                                                                                                                              Function 00007FF6E2173480 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: HeapProcess
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 54951025-0
                                                                                                                                                                                                              • Opcode ID: 1f9e0516fd534d967cb731c121838b59470578846d262458ea046ba55ab40ebf
                                                                                                                                                                                                              • Instruction ID: 279d64049274333b05f02fb0c8d900d5157538cd9418afc20a404b42c75f16c7
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1f9e0516fd534d967cb731c121838b59470578846d262458ea046ba55ab40ebf
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 19B09221E07A42C2EA092B25AC8635822A6BF98704F980138C20EC0330DF6D36F55706
                                                                                                                                                                                                              Function 00007FF6E21635A0 Relevance: .3, Instructions: 327COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                              • Opcode ID: 5eca4e5ff3e7205525bf20f3b63783aa462e3e7adb0228d62bb7e98ab9f5e9bb
                                                                                                                                                                                                              • Instruction ID: 492094b6d87542d2b3db45de0f73a516f63a1ce01ea5f009c047798a3abed5e3
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5eca4e5ff3e7205525bf20f3b63783aa462e3e7adb0228d62bb7e98ab9f5e9bb
                                                                                                                                                                                                              • Instruction Fuzzy Hash: E6D1A273E2864245EB688E2980903BD26A2AB45F4CF144235CF0DC7795DFBBDA45C7CA
                                                                                                                                                                                                              Function 00007FF6E2159800 Relevance: .3, Instructions: 287COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                              • Opcode ID: e75d751cc15dfd510e55d83c6141b0e8cb11d18cbed01e0c543b372a0114c593
                                                                                                                                                                                                              • Instruction ID: cd5c53c1c5cf6f78542a016948c6e4e4135f40588f0ad700b85eda2e4af0e07e
                                                                                                                                                                                                              • Opcode Fuzzy Hash: e75d751cc15dfd510e55d83c6141b0e8cb11d18cbed01e0c543b372a0114c593
                                                                                                                                                                                                              • Instruction Fuzzy Hash: E5C1DE726181E08BD28AEB29E4794BA33D1F78930DB95406BEF87877C5CB3CA514DB11
                                                                                                                                                                                                              Function 00007FF6E2162C10 Relevance: .2, Instructions: 241COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                              • Opcode ID: aa73bfa000bc8cd66a05f12d530b76a597660d7bda6a6781f52cf2f49ffced0b
                                                                                                                                                                                                              • Instruction ID: ecc9476b3aa320d53ba4c75552c40c18dff4fa5703125449336ad2f87804fca1
                                                                                                                                                                                                              • Opcode Fuzzy Hash: aa73bfa000bc8cd66a05f12d530b76a597660d7bda6a6781f52cf2f49ffced0b
                                                                                                                                                                                                              • Instruction Fuzzy Hash: CFB16C7392868585E7648F29C4902BC3BA2E749B4CF244176CB4EC7395CFABD641C74B
                                                                                                                                                                                                              Function 00007FF6E216E570 Relevance: .2, Instructions: 198COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                              • Opcode ID: 9611c2e0762efa78d7f6da3d8515592aa8d86601c49200b7335873453b670326
                                                                                                                                                                                                              • Instruction ID: 3451be0a63c26f56e5db6dc80595070f3b3857b3251a2929358ec26993e1c4d5
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9611c2e0762efa78d7f6da3d8515592aa8d86601c49200b7335873453b670326
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7B81D373E2C28146D6648F1994807AE6A92FB45798F104335DB8DC3B89DF7EE6008B46
                                                                                                                                                                                                              Function 00007FF6E2176418 Relevance: .2, Instructions: 183COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                              • Opcode ID: 15e29a2b048034b7d11d1b87b7baa88ea743f66ca2db996e50da050e1c2114ce
                                                                                                                                                                                                              • Instruction ID: 2906972e16f2ea3d32900d8574d996fc82ad279ce80ac5f2a31f09ef85c5e2ed
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 15e29a2b048034b7d11d1b87b7baa88ea743f66ca2db996e50da050e1c2114ce
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3661EB33E1C2D246F7648A68D4507BD5782AF827E8F540239E71DC26C5DEEFEA408746
                                                                                                                                                                                                              Function 00007FF6E2162164 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                              • Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
                                                                                                                                                                                                              • Instruction ID: f0ff65c9ca261a7faf162b0fbd8a31795cd8705af060deca8369c0a289fc3f7f
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 08515437E2865281E7248B29C4803AD23A2EB54B5CF244175CB8DD7794CF6BEA43C746
                                                                                                                                                                                                              Function 00007FF6E2161944 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                              • Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
                                                                                                                                                                                                              • Instruction ID: 95abba74e248313da0c078272a3e63d875fd88de3dcba1d8e7e0d8a4712bf19e
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9A515F37E2865286E7248F29C0803AC27A2EB44B5CF285131CB8DD7794CFBBE942C745
                                                                                                                                                                                                              Function 00007FF6E2161D54 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                              • Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
                                                                                                                                                                                                              • Instruction ID: a0c9d68ea5ce957ce4d193111dcfb7a4a635332c4948d67de6c0081736ef3f24
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 70516D77E2865186E7258B29C0843AC33A2EB55B6CF284131CB4DC7794CFBBEA52C745
                                                                                                                                                                                                              Function 00007FF6E2161B50 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                              • Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
                                                                                                                                                                                                              • Instruction ID: ec546edc733175108c34ab8b979a6e2a2689c1ccafb3f8201fcba96b3202f8a1
                                                                                                                                                                                                              • Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
                                                                                                                                                                                                              • Instruction Fuzzy Hash: A9518E37E2865286E7348B29C0843AC27A2EB45B5CF285131CB4CD7794DFBBEA42D745
                                                                                                                                                                                                              Function 00007FF6E2161F60 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                              • Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
                                                                                                                                                                                                              • Instruction ID: ee4460225faa15c24418c95c5780cf25ef7805b066574836cc27a352f127724c
                                                                                                                                                                                                              • Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
                                                                                                                                                                                                              • Instruction Fuzzy Hash: D8514E37E2865586E7248B2980843AD37A2EB44B5CF284171CB4CD7799CF6BE942C746
                                                                                                                                                                                                              Function 00007FF6E2161740 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                              • Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
                                                                                                                                                                                                              • Instruction ID: b37049c33942cd7f3e1cd4f7075d2582449b0bc6fb45ca0a3bbf64f2c02a9beb
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
                                                                                                                                                                                                              • Instruction Fuzzy Hash: CB515137E2865585E7248B29C0803AC27A6EB45B5CF284131CF4DD7794CF7BEA42C785
                                                                                                                                                                                                              Function 00007FF6E2165D30 Relevance: .1, Instructions: 138COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                              • Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
                                                                                                                                                                                                              • Instruction ID: 2956fee043aff786c92236de4335aa6e10fb63f3df7f9da31d2e4bc1b884ca32
                                                                                                                                                                                                              • Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4B41E373C2D74A15EDA9895C05887FC66829F12BA8D6812B4CFADD73C3CD4F6786C206
                                                                                                                                                                                                              Function 00007FF6E2169EA0 Relevance: .1, Instructions: 126COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 485612231-0
                                                                                                                                                                                                              • Opcode ID: 1c7003d4bfacf113f63307708dabd17e5ede6cda44dccf6aa27d02a6b9ea0481
                                                                                                                                                                                                              • Instruction ID: ce9ff97821c856b70982a03b61bebebc3d8b4a9dfbd2680d741340b55a0ba736
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1c7003d4bfacf113f63307708dabd17e5ede6cda44dccf6aa27d02a6b9ea0481
                                                                                                                                                                                                              • Instruction Fuzzy Hash: C141E633B24A5582EF08CF2AD9942A9B392B748FD8B199432EF0DD7B54DE7EC1418305
                                                                                                                                                                                                              Function 00007FF6E21680E4 Relevance: .1, Instructions: 98COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                              • Opcode ID: 12404f4f4f1323fea4d4e583727f71dd7b5a0d93f2e51056eadc76cf5c92dd81
                                                                                                                                                                                                              • Instruction ID: f40c4abe43fbc326ab00cef4489e8f1c0878792bf16bccc0b06e6938d34a7ef9
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 12404f4f4f1323fea4d4e583727f71dd7b5a0d93f2e51056eadc76cf5c92dd81
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 22312433F28B4241E7649F21A4802BD66D6AB85BD4F144238EB8DD3BD5CFBDD2028309
                                                                                                                                                                                                              Function 00007FF6E2179570 Relevance: .0, Instructions: 32COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                              • Opcode ID: 5d3ac10822f6242d2b374fc0e1218152d8e80c351f0dfcd4fab21387456caa74
                                                                                                                                                                                                              • Instruction ID: 81343a0ce76fad54714960c5df2990d1060ebb5dba8ce14c9b2038bfb673850e
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5d3ac10822f6242d2b374fc0e1218152d8e80c351f0dfcd4fab21387456caa74
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 99F04472F182958ADB988F6DA44266A77D1F748384F408039D689C3A04DE7D91618F09
                                                                                                                                                                                                              Function 00007FF6E215D30C Relevance: .0, Instructions: 2COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                              • Opcode ID: 3c3909751b2697c6481bc0460501d6177e5cf72f77169ad8285d6e0cd944102a
                                                                                                                                                                                                              • Instruction ID: 85e300a71177dd4d6ec3d650d6daef627b434b34f3c3408e9cf03b3ba8dca411
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3c3909751b2697c6481bc0460501d6177e5cf72f77169ad8285d6e0cd944102a
                                                                                                                                                                                                              • Instruction Fuzzy Hash: B7A00162D4D80AD0E6848B00E8902A62222BBA5308B8000B1E20ED14A09FAEA644D30A
                                                                                                                                                                                                              Function 00007FF6E21576C0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: AddressErrorLastProc
                                                                                                                                                                                                              • String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                                                                                                                                                              • API String ID: 199729137-3427451314
                                                                                                                                                                                                              • Opcode ID: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
                                                                                                                                                                                                              • Instruction ID: d4fcec3a5ca4f9591e8bb36d8304c89a6795169d3bb1fb21de402dbcca68c2b9
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
                                                                                                                                                                                                              • Instruction Fuzzy Hash: D702BD22D4DB0B81FA159B55E8157F422B3BF8675CF440071D62EC22A4EFBEB349824A
                                                                                                                                                                                                              Function 00007FF6E21581D0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 00007FF6E2159390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6E21545F4,00000000,00007FF6E2151985), ref: 00007FF6E21593C9
                                                                                                                                                                                                              • ExpandEnvironmentStringsW.KERNEL32(?,00007FF6E21586B7,?,?,00000000,00007FF6E2153CBB), ref: 00007FF6E215822C
                                                                                                                                                                                                                • Part of subcall function 00007FF6E2152810: MessageBoxW.USER32 ref: 00007FF6E21528EA
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
                                                                                                                                                                                                              • String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
                                                                                                                                                                                                              • API String ID: 1662231829-930877121
                                                                                                                                                                                                              • Opcode ID: 9187bed43bf71c5340eadf58a1920dd2feb36a2730cc38c17813087cef3183ed
                                                                                                                                                                                                              • Instruction ID: 742266539339f380f7d01bb8cc031d0b1cb4cf8df55caaf7343e42ed436f9aba
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9187bed43bf71c5340eadf58a1920dd2feb36a2730cc38c17813087cef3183ed
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0B51C613E6C64641FA509B24E8513FA2292AF9478CF444431DB0EC26D5EFBEE744C34A
                                                                                                                                                                                                              Function 00007FF6E2152180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: MoveWindow$ObjectSelect$DrawReleaseText
                                                                                                                                                                                                              • String ID: P%
                                                                                                                                                                                                              • API String ID: 2147705588-2959514604
                                                                                                                                                                                                              • Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
                                                                                                                                                                                                              • Instruction ID: 88934d0cb49f134a6707a2c70a978a97294f9114fbb6d15c30608fcc9f30caa8
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 36511627A04BA186D6249F22E4182BAB7A2FB98B65F004131EFDFC3694DF7CD145CB14
                                                                                                                                                                                                              Function 00007FF6E21580C0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: LongWindow$BlockCreateErrorLastReasonShutdown
                                                                                                                                                                                                              • String ID: Needs to remove its temporary files.
                                                                                                                                                                                                              • API String ID: 3975851968-2863640275
                                                                                                                                                                                                              • Opcode ID: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
                                                                                                                                                                                                              • Instruction ID: 05de7c8ada41b03055de0bd0b14ba55dc046350cd25bbd3725ebefc9006d3b17
                                                                                                                                                                                                              • Opcode Fuzzy Hash: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0D217322F48A4681E6418B7AF8443A96252BF89B98F594130DB1EC33D4DEADD7808306
                                                                                                                                                                                                              Function 00007FF6E2166290 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                              • String ID: -$:$f$p$p
                                                                                                                                                                                                              • API String ID: 3215553584-2013873522
                                                                                                                                                                                                              • Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
                                                                                                                                                                                                              • Instruction ID: e5618eb1ce352b458c9695171c1a42a65443f160b02f216b9756641bcd42cc2d
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4B1291B3E2928386FB245A14A1843FD7757EB40798F844135D789C66C4DFBEE6808B4A
                                                                                                                                                                                                              Function 00007FF6E2160FC8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                              • String ID: f$f$p$p$f
                                                                                                                                                                                                              • API String ID: 3215553584-1325933183
                                                                                                                                                                                                              • Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
                                                                                                                                                                                                              • Instruction ID: 012b4fa190d1dc8efa997cde36dcfe31ac972b722b789b4e8db7d436b7d9d1fa
                                                                                                                                                                                                              • Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9F126173E2814385FB209A1590943FE66A3FB40758F8C4135D79AC6BC4DFBEE6408B4A
                                                                                                                                                                                                              Function 00007FF6E2151050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CurrentProcess
                                                                                                                                                                                                              • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                              • API String ID: 2050909247-3659356012
                                                                                                                                                                                                              • Opcode ID: 2d021f7da401aec23eb7dc7f0c87ec7fcf667bd8f2e6924468e7d329bd391e80
                                                                                                                                                                                                              • Instruction ID: 1b4945884bc05787d5cbd5d763a2a2da40c4ec091888413efe6f6bcb72c90348
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2d021f7da401aec23eb7dc7f0c87ec7fcf667bd8f2e6924468e7d329bd391e80
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 84418E23E1825285EA11DB21D8407F96393BF45B88F5844B1EF0DC7785DEBEE301874A
                                                                                                                                                                                                              Function 00007FF6E2151470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CurrentProcess
                                                                                                                                                                                                              • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                              • API String ID: 2050909247-3659356012
                                                                                                                                                                                                              • Opcode ID: a184642825e07b86810f2b9adbdb1e51f013e7a0f6b30c6d92528709c5dff695
                                                                                                                                                                                                              • Instruction ID: 0421359e718f6e84f89c9facb3e81dca3f8a7bc1ab9e6887216f13bd17e84262
                                                                                                                                                                                                              • Opcode Fuzzy Hash: a184642825e07b86810f2b9adbdb1e51f013e7a0f6b30c6d92528709c5dff695
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0E418D23E5864285EA11DB21D4403F96393BF85788F484872EF0EC7B95DEBEE701870A
                                                                                                                                                                                                              Function 00007FF6E215EA08 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                                                                                                                                                              • String ID: csm$csm$csm
                                                                                                                                                                                                              • API String ID: 849930591-393685449
                                                                                                                                                                                                              • Opcode ID: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
                                                                                                                                                                                                              • Instruction ID: e873157a30fdeca8cc168d8440ee694608d8766e394dd7dd1580fce55440d0fc
                                                                                                                                                                                                              • Opcode Fuzzy Hash: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 22D15A23E48B418AEB209B6594403ED77A2FB4578CF100175EB4DD7B96DFBAE680C706
                                                                                                                                                                                                              Function 00007FF6E2152C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF6E2153706,?,00007FF6E2153804), ref: 00007FF6E2152C9E
                                                                                                                                                                                                              • FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6E2153706,?,00007FF6E2153804), ref: 00007FF6E2152D63
                                                                                                                                                                                                              • MessageBoxW.USER32 ref: 00007FF6E2152D99
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Message$CurrentFormatProcess
                                                                                                                                                                                                              • String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
                                                                                                                                                                                                              • API String ID: 3940978338-251083826
                                                                                                                                                                                                              • Opcode ID: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
                                                                                                                                                                                                              • Instruction ID: 408ea30f5687263fdc0cccce5ffd321b9b69d55d8b90508c40bea3a33e5b9d72
                                                                                                                                                                                                              • Opcode Fuzzy Hash: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7531B423F08A4142E6209B65E8543EA6692BF8879CF414136EF4ED3799DF7ED706C305
                                                                                                                                                                                                              Function 00007FF6E215DCC8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • LoadLibraryExW.KERNEL32(?,?,?,00007FF6E215DF7A,?,?,?,00007FF6E215DC6C,?,?,?,00007FF6E215D869), ref: 00007FF6E215DD4D
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF6E215DF7A,?,?,?,00007FF6E215DC6C,?,?,?,00007FF6E215D869), ref: 00007FF6E215DD5B
                                                                                                                                                                                                              • LoadLibraryExW.KERNEL32(?,?,?,00007FF6E215DF7A,?,?,?,00007FF6E215DC6C,?,?,?,00007FF6E215D869), ref: 00007FF6E215DD85
                                                                                                                                                                                                              • FreeLibrary.KERNEL32(?,?,?,00007FF6E215DF7A,?,?,?,00007FF6E215DC6C,?,?,?,00007FF6E215D869), ref: 00007FF6E215DDF3
                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,?,?,00007FF6E215DF7A,?,?,?,00007FF6E215DC6C,?,?,?,00007FF6E215D869), ref: 00007FF6E215DDFF
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                                                                                                                              • String ID: api-ms-
                                                                                                                                                                                                              • API String ID: 2559590344-2084034818
                                                                                                                                                                                                              • Opcode ID: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
                                                                                                                                                                                                              • Instruction ID: 95c771cabec28a3c76d36ac7e20500f862dbc6daecf9879bc77e05ec1bd34e95
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1F31A323F5A64291EE119B0298007F52396FF49BA8F594575DF1EC63C0EFBEE6448309
                                                                                                                                                                                                              Function 00007FF6E2156360 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CurrentProcess
                                                                                                                                                                                                              • String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
                                                                                                                                                                                                              • API String ID: 2050909247-2434346643
                                                                                                                                                                                                              • Opcode ID: 2df6df0904ecf2e68063807813f252f2c523520ae69ca8fe89000ee1ae80a761
                                                                                                                                                                                                              • Instruction ID: 84dfabfa2e4160157d9ad71bf816a0cd209270ee4612bdaf5a531836c02179d0
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2df6df0904ecf2e68063807813f252f2c523520ae69ca8fe89000ee1ae80a761
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 24419223E5868691EA21DB20E4143E96352FF94388F900172EB5DC32D9EFBDE705C786
                                                                                                                                                                                                              Function 00007FF6E2152A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF6E215351A,?,00000000,00007FF6E2153F1B), ref: 00007FF6E2152AA0
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CurrentProcess
                                                                                                                                                                                                              • String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
                                                                                                                                                                                                              • API String ID: 2050909247-2900015858
                                                                                                                                                                                                              • Opcode ID: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
                                                                                                                                                                                                              • Instruction ID: d410375d5844b05b3e0a0b63bbb84c81e7df705f1da650f82dbebd82308e0af6
                                                                                                                                                                                                              • Opcode Fuzzy Hash: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2B219C33A18B8192E6209B50F8807EA6395FB88388F400136FF8DC3699DFBDD345C645
                                                                                                                                                                                                              Function 00007FF6E216B150 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Value$ErrorLast
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2506987500-0
                                                                                                                                                                                                              • Opcode ID: 12f476f87c8743e70c8b210e20a22f1b01636e2fed05d2f1e0a082253e023e8e
                                                                                                                                                                                                              • Instruction ID: e1f3f71c3256f02eeca3c5fe9d79638161f450e54d9cd9ed07e66eaafeb849b9
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 12f476f87c8743e70c8b210e20a22f1b01636e2fed05d2f1e0a082253e023e8e
                                                                                                                                                                                                              • Instruction Fuzzy Hash: ED216032F2C24241F9586325A5D13BD61835F547A8F104634EB2FD66C6DEAEE700430A
                                                                                                                                                                                                              Function 00007FF6E2177D6C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                                                                                                              • String ID: CONOUT$
                                                                                                                                                                                                              • API String ID: 3230265001-3130406586
                                                                                                                                                                                                              • Opcode ID: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
                                                                                                                                                                                                              • Instruction ID: dcd3743cc3b5115fc1c7fa79a171efcc07351f497d9f4dd2a899ab9b274a87fd
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
                                                                                                                                                                                                              • Instruction Fuzzy Hash: C911B422E18B4586E3508B12F8443A962A1FB89BE8F000234EB5EC77E4CFBDD6408709
                                                                                                                                                                                                              Function 00007FF6E2158ED0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetCurrentProcess.KERNEL32(?,FFFFFFFF,00000000,00007FF6E2153FA9), ref: 00007FF6E2158EFD
                                                                                                                                                                                                              • K32EnumProcessModules.KERNEL32(?,FFFFFFFF,00000000,00007FF6E2153FA9), ref: 00007FF6E2158F5A
                                                                                                                                                                                                                • Part of subcall function 00007FF6E2159390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6E21545F4,00000000,00007FF6E2151985), ref: 00007FF6E21593C9
                                                                                                                                                                                                              • K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF6E2153FA9), ref: 00007FF6E2158FE5
                                                                                                                                                                                                              • K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF6E2153FA9), ref: 00007FF6E2159044
                                                                                                                                                                                                              • FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF6E2153FA9), ref: 00007FF6E2159055
                                                                                                                                                                                                              • FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF6E2153FA9), ref: 00007FF6E215906A
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3462794448-0
                                                                                                                                                                                                              • Opcode ID: 0184f5a771bb2c28f933eba3e4018dda16e38d059dd6d010c17659477659ba58
                                                                                                                                                                                                              • Instruction ID: 3bbcc77cdc3df311cdc1a10fd410afcfe26ab2058134a3a5b6f53534ec5cbeba
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0184f5a771bb2c28f933eba3e4018dda16e38d059dd6d010c17659477659ba58
                                                                                                                                                                                                              • Instruction Fuzzy Hash: E541BF63E1968281EA309B12A4403EA7396FF85B88F040535DF4DD7789DFBEE600C74A
                                                                                                                                                                                                              Function 00007FF6E216B2C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF6E2164F11,?,?,?,?,00007FF6E216A48A,?,?,?,?,00007FF6E216718F), ref: 00007FF6E216B2D7
                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF6E2164F11,?,?,?,?,00007FF6E216A48A,?,?,?,?,00007FF6E216718F), ref: 00007FF6E216B30D
                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF6E2164F11,?,?,?,?,00007FF6E216A48A,?,?,?,?,00007FF6E216718F), ref: 00007FF6E216B33A
                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF6E2164F11,?,?,?,?,00007FF6E216A48A,?,?,?,?,00007FF6E216718F), ref: 00007FF6E216B34B
                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF6E2164F11,?,?,?,?,00007FF6E216A48A,?,?,?,?,00007FF6E216718F), ref: 00007FF6E216B35C
                                                                                                                                                                                                              • SetLastError.KERNEL32(?,?,?,00007FF6E2164F11,?,?,?,?,00007FF6E216A48A,?,?,?,?,00007FF6E216718F), ref: 00007FF6E216B377
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Value$ErrorLast
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2506987500-0
                                                                                                                                                                                                              • Opcode ID: 341ed06667cf8b6c5416a7ef0c6dfdccbf195f5bc763a811adde1679d5f4f530
                                                                                                                                                                                                              • Instruction ID: 16a10d63207adc22c3bb300239f9f2e70efcc1cf03d7c7063759c06853195491
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 341ed06667cf8b6c5416a7ef0c6dfdccbf195f5bc763a811adde1679d5f4f530
                                                                                                                                                                                                              • Instruction Fuzzy Hash: BE119F32F1D24282FA58672196C03BE61439F447B8F184334EB2FD66D6DEAEE700430A
                                                                                                                                                                                                              Function 00007FF6E2152910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF6E2151B6A), ref: 00007FF6E215295E
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CurrentProcess
                                                                                                                                                                                                              • String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
                                                                                                                                                                                                              • API String ID: 2050909247-2962405886
                                                                                                                                                                                                              • Opcode ID: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
                                                                                                                                                                                                              • Instruction ID: 71cb21cc6a58a64456ed1b702b27e08c55f404536c1603049c3abeaa767209fa
                                                                                                                                                                                                              • Opcode Fuzzy Hash: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6831CF23F1868552E7209B61E8403EA6296BF887DCF400132EF8DC3789EFBDD6468205
                                                                                                                                                                                                              Function 00007FF6E2152390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
                                                                                                                                                                                                              • String ID: Unhandled exception in script
                                                                                                                                                                                                              • API String ID: 3081866767-2699770090
                                                                                                                                                                                                              • Opcode ID: 851ce5d4a208b56cb63585478e484d0f9d6918564d04618497f061aba15d8534
                                                                                                                                                                                                              • Instruction ID: 849c3f58384829ff7cfeba30aa173ef21e552655eba930a71104ec1a1cf440d6
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 851ce5d4a208b56cb63585478e484d0f9d6918564d04618497f061aba15d8534
                                                                                                                                                                                                              • Instruction Fuzzy Hash: C1314E33A1968189EB209B61E8553FA6361FB89788F440135EB4EC7B89DF7DD201C706
                                                                                                                                                                                                              Function 00007FF6E2152B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF6E215918F,?,00007FF6E2153C55), ref: 00007FF6E2152BA0
                                                                                                                                                                                                              • MessageBoxW.USER32 ref: 00007FF6E2152C2A
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CurrentMessageProcess
                                                                                                                                                                                                              • String ID: WARNING$Warning$[PYI-%d:%ls]
                                                                                                                                                                                                              • API String ID: 1672936522-3797743490
                                                                                                                                                                                                              • Opcode ID: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
                                                                                                                                                                                                              • Instruction ID: f80ca236a00fec59ac5b0ce53c18fdd0d264ef7476104678795712c2a9738008
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
                                                                                                                                                                                                              • Instruction Fuzzy Hash: B121AB23B18B4192E6209B64F8847EA63A6EB88788F400136EF8ED3659DF7DD305C745
                                                                                                                                                                                                              Function 00007FF6E2152710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF6E2151B99), ref: 00007FF6E2152760
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CurrentProcess
                                                                                                                                                                                                              • String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
                                                                                                                                                                                                              • API String ID: 2050909247-1591803126
                                                                                                                                                                                                              • Opcode ID: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
                                                                                                                                                                                                              • Instruction ID: 766b3b422a524bfc67e2a999ddb9f607e2575c0cc339977c4a5fddfe44dda2e4
                                                                                                                                                                                                              • Opcode Fuzzy Hash: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
                                                                                                                                                                                                              • Instruction Fuzzy Hash: B2217C33A19B8192E6209B50F8817EA6295AB88388F400135EF8DD3699DFBDD3458645
                                                                                                                                                                                                              Function 00007FF6E2169A88 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                              • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                              • API String ID: 4061214504-1276376045
                                                                                                                                                                                                              • Opcode ID: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
                                                                                                                                                                                                              • Instruction ID: 01cce14c2c4b0621e023387194d399c0e3c1086a117c2fb0d50a5dce569538c3
                                                                                                                                                                                                              • Opcode Fuzzy Hash: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 78F0C822F1870682EA148B14E4843BA23A1BF85768F540235C76FC55E4CFAED344C306
                                                                                                                                                                                                              Function 00007FF6E2179368 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _set_statfp
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1156100317-0
                                                                                                                                                                                                              • Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                                                                                                                                                              • Instruction ID: c026bc5a2a3f4ae08c8ee3aa24de6eef47dc0fd13eb4f178172b6a374bbe1b69
                                                                                                                                                                                                              • Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                                                                                                                                                              • Instruction Fuzzy Hash: F8116333D58A0201F6545179E4913FA1053BFDB37CE040634EB6ED72D68EEEAA49410A
                                                                                                                                                                                                              Function 00007FF6E216B390 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • FlsGetValue.KERNEL32(?,?,?,00007FF6E216A5A3,?,?,00000000,00007FF6E216A83E,?,?,?,?,?,00007FF6E216A7CA), ref: 00007FF6E216B3AF
                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF6E216A5A3,?,?,00000000,00007FF6E216A83E,?,?,?,?,?,00007FF6E216A7CA), ref: 00007FF6E216B3CE
                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF6E216A5A3,?,?,00000000,00007FF6E216A83E,?,?,?,?,?,00007FF6E216A7CA), ref: 00007FF6E216B3F6
                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF6E216A5A3,?,?,00000000,00007FF6E216A83E,?,?,?,?,?,00007FF6E216A7CA), ref: 00007FF6E216B407
                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF6E216A5A3,?,?,00000000,00007FF6E216A83E,?,?,?,?,?,00007FF6E216A7CA), ref: 00007FF6E216B418
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Value
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3702945584-0
                                                                                                                                                                                                              • Opcode ID: 076d9937837767d8c0599fb7139188ad361754fd070b51876ae2b58645e7f25c
                                                                                                                                                                                                              • Instruction ID: 8ad0cee34a8d24f256edbac3a4dbb1f7fc0c2a3141d8ce5c8b8b907849f8254e
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 076d9937837767d8c0599fb7139188ad361754fd070b51876ae2b58645e7f25c
                                                                                                                                                                                                              • Instruction Fuzzy Hash: A3119032F2D64241FA58A72655C13FD61435F507B8F584334EB2FD6AC6DEAEE701820A
                                                                                                                                                                                                              Function 00007FF6E216B224 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Value
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3702945584-0
                                                                                                                                                                                                              • Opcode ID: 84df6eade7ca2759e64539926e88efdc2e23a1e9973d593929f07b0eae7a4c09
                                                                                                                                                                                                              • Instruction ID: 3ccb892974351504738bdd24b510cd5146f760cc96a3bc38564a85b7cfc46b85
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 84df6eade7ca2759e64539926e88efdc2e23a1e9973d593929f07b0eae7a4c09
                                                                                                                                                                                                              • Instruction Fuzzy Hash: C811E332E2920641FAAC626144D13FD22834F55328F244738EB2EDA6C2DEAEB740420B
                                                                                                                                                                                                              Function 00007FF6E2165FA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                              • String ID: verbose
                                                                                                                                                                                                              • API String ID: 3215553584-579935070
                                                                                                                                                                                                              • Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
                                                                                                                                                                                                              • Instruction ID: e008a95b5d0d7ed475e2a57b24264cd6f9c3aa1ab4598e7231fb76c8958d64f6
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9B91D3B3E2868681E7208F25D4903BD3796AB80BD8F444135DB5DC33D5DEBEEA45834A
                                                                                                                                                                                                              Function 00007FF6E216FBC8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                              • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                                                                                                                                                              • API String ID: 3215553584-1196891531
                                                                                                                                                                                                              • Opcode ID: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
                                                                                                                                                                                                              • Instruction ID: f0d3d4a52674556a3bb5aae63bb9259a4ffa8e39b0082663cf6499bffe95ce4f
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 23816373E2828285E7655E6981903FD2AA3AB1174CF564035CB0FD7295DFAFBB01930B
                                                                                                                                                                                                              Function 00007FF6E215D648 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                                                                                                                                                              • String ID: csm
                                                                                                                                                                                                              • API String ID: 2395640692-1018135373
                                                                                                                                                                                                              • Opcode ID: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
                                                                                                                                                                                                              • Instruction ID: 63c4f080357b1a9d103e07b3e2e307199cad46dd6cfad11a8d959fda5c04af88
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
                                                                                                                                                                                                              • Instruction Fuzzy Hash: F3519F33E596428ADB148B15D844BB87792EB44B9CF108170DB4EC7788DFBEEA41C709
                                                                                                                                                                                                              Function 00007FF6E215F288 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                                                                                                                                                              • String ID: csm$csm
                                                                                                                                                                                                              • API String ID: 3896166516-3733052814
                                                                                                                                                                                                              • Opcode ID: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
                                                                                                                                                                                                              • Instruction ID: eec930d1136ebb91342eb5bfcc1d53efb720780e1e3c28c0e7848242e4802c0c
                                                                                                                                                                                                              • Opcode Fuzzy Hash: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 98518033E4828287EB648B2191443AD37A2FB56B88F144176DB4DC3B85CFBDE650C70A
                                                                                                                                                                                                              Function 00007FF6E215EED8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CallEncodePointerTranslator
                                                                                                                                                                                                              • String ID: MOC$RCC
                                                                                                                                                                                                              • API String ID: 3544855599-2084237596
                                                                                                                                                                                                              • Opcode ID: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
                                                                                                                                                                                                              • Instruction ID: d2cf063541a908a11f5ca8cbd599513202484c824939f447f782989e2afa10e1
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
                                                                                                                                                                                                              • Instruction Fuzzy Hash: EE618F33D08BC586DB608B15E4403EAB7A1FB95788F044265EB9C83B95DFBDD290CB05
                                                                                                                                                                                                              Function 00007FF6E2152810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Message
                                                                                                                                                                                                              • String ID: ERROR$Error$[PYI-%d:%ls]
                                                                                                                                                                                                              • API String ID: 2030045667-255084403
                                                                                                                                                                                                              • Opcode ID: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
                                                                                                                                                                                                              • Instruction ID: dc9d9df2251a628d8ecec9d312ee7ba80c21f6006fb120efe300474988b1499b
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6121AB73B18B4192E6209B54F8847EA63A2EB88788F400136EB8ED3659DFBDD345C745
                                                                                                                                                                                                              Function 00007FF6E216C5A0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: FileWrite$ConsoleErrorLastOutput
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2718003287-0
                                                                                                                                                                                                              • Opcode ID: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
                                                                                                                                                                                                              • Instruction ID: d9d50ac113835312aafef29a6e5749ddffcec5b11d4081138b5272c28c4cad41
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 43D1CB73F28A818AE710CF65C4843EC37A2EB55798B444226DF4ED7B89DE79D206C709
                                                                                                                                                                                                              Function 00007FF6E21520C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: LongWindow$DialogInvalidateRect
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1956198572-0
                                                                                                                                                                                                              • Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
                                                                                                                                                                                                              • Instruction ID: 5ac8ec086ec563cf95fd09c58e6f37d37bd655789ee524321a1183154f45fe64
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
                                                                                                                                                                                                              • Instruction Fuzzy Hash: C911E923F4C14242F65487A9E5883FA5253EF95788F484030DB4BC7B89CEAED781820A
                                                                                                                                                                                                              Function 00007FF6E2175B1C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _get_daylight$_invalid_parameter_noinfo
                                                                                                                                                                                                              • String ID: ?
                                                                                                                                                                                                              • API String ID: 1286766494-1684325040
                                                                                                                                                                                                              • Opcode ID: 21862b7f5a6063227688de7d7fc5fbfc7fa1fb1d7946118fe9e576ba790fa6aa
                                                                                                                                                                                                              • Instruction ID: 55b1d896a359b231ccce3b844c81e3eaa8fc5ec7f4bf883aa64f2aca00537481
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 21862b7f5a6063227688de7d7fc5fbfc7fa1fb1d7946118fe9e576ba790fa6aa
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 05414723E0828666F7308B25D4413F96662EBC2BA8F144235EF4CC7AD5DFBED6418705
                                                                                                                                                                                                              Function 00007FF6E2169014 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E2169046
                                                                                                                                                                                                                • Part of subcall function 00007FF6E216A948: RtlFreeHeap.NTDLL(?,?,?,00007FF6E2172D22,?,?,?,00007FF6E2172D5F,?,?,00000000,00007FF6E2173225,?,?,?,00007FF6E2173157), ref: 00007FF6E216A95E
                                                                                                                                                                                                                • Part of subcall function 00007FF6E216A948: GetLastError.KERNEL32(?,?,?,00007FF6E2172D22,?,?,?,00007FF6E2172D5F,?,?,00000000,00007FF6E2173225,?,?,?,00007FF6E2173157), ref: 00007FF6E216A968
                                                                                                                                                                                                              • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF6E215CBA5), ref: 00007FF6E2169064
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              • C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe, xrefs: 00007FF6E2169052
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
                                                                                                                                                                                                              • String ID: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                              • API String ID: 3580290477-524912626
                                                                                                                                                                                                              • Opcode ID: 136b352ca89953b7aac46d199a587659114d0cf60bae53edf27061cb20026a80
                                                                                                                                                                                                              • Instruction ID: 13436bc04cc25523bfec1375aef358c20cd37be23c79a1b8c2fdb6199f7126f3
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 136b352ca89953b7aac46d199a587659114d0cf60bae53edf27061cb20026a80
                                                                                                                                                                                                              • Instruction Fuzzy Hash: B841AF33E1860286EB189F25D4802FC33A6FB447D8B554035EB4EC7B85CE7EE6918346
                                                                                                                                                                                                              Function 00007FF6E216CC38 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ErrorFileLastWrite
                                                                                                                                                                                                              • String ID: U
                                                                                                                                                                                                              • API String ID: 442123175-4171548499
                                                                                                                                                                                                              • Opcode ID: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
                                                                                                                                                                                                              • Instruction ID: 8de3ff0bfd1ec27e8f3fb1a014825065259b794b46ffdc4fcef58b3d4545c0d4
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9E419133A28A8581DB208F25E4483EA6762FB98788F504135EF4DC7798EFBDD641C745
                                                                                                                                                                                                              Function 00007FF6E216F5B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CurrentDirectory
                                                                                                                                                                                                              • String ID: :
                                                                                                                                                                                                              • API String ID: 1611563598-336475711
                                                                                                                                                                                                              • Opcode ID: d7e4ed55f29cf6b5985c16ba7c582ed18ee62b51760ed1b5a20f115a32bf7e2e
                                                                                                                                                                                                              • Instruction ID: 73bdf6b5c8d397ab12b8f9baea60b14021068cab88be22108e2ca33e00d0ac76
                                                                                                                                                                                                              • Opcode Fuzzy Hash: d7e4ed55f29cf6b5985c16ba7c582ed18ee62b51760ed1b5a20f115a32bf7e2e
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5021C373F2828181EB209B15D0843BD63A2FB84B4CF464035DB4EC3694DFBED6448796
                                                                                                                                                                                                              Function 00007FF6E215FD48 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ExceptionFileHeaderRaise
                                                                                                                                                                                                              • String ID: csm
                                                                                                                                                                                                              • API String ID: 2573137834-1018135373
                                                                                                                                                                                                              • Opcode ID: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
                                                                                                                                                                                                              • Instruction ID: 4fceea49c924b85948d436fd7796e58857944604fcee20e5e6187d762360a03c
                                                                                                                                                                                                              • Opcode Fuzzy Hash: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 23115E33A08B8582EB218F15E4003A977E5FB89B88F184230DB8D87758DF7ED6518B04
                                                                                                                                                                                                              Function 00007FF6E217073C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.2198516869.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198488116.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198556948.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198587750.00007FF6E2192000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.2198658536.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: DriveType_invalid_parameter_noinfo
                                                                                                                                                                                                              • String ID: :
                                                                                                                                                                                                              • API String ID: 2595371189-336475711
                                                                                                                                                                                                              • Opcode ID: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
                                                                                                                                                                                                              • Instruction ID: 2c5d642c827ed9e5cec17397393d8e3b197b59bc065beb7d0e54c3ac61d6f117
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
                                                                                                                                                                                                              • Instruction Fuzzy Hash: B0017123E2820285E7309F60D4613BE63A1EF8574CF901439D78DC26C1DEBED6048A1A

                                                                                                                                                                                                              Execution Graph

                                                                                                                                                                                                              Execution Coverage:2.5%
                                                                                                                                                                                                              Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                              Signature Coverage:1.2%
                                                                                                                                                                                                              Total number of Nodes:688
                                                                                                                                                                                                              Total number of Limit Nodes:12
                                                                                                                                                                                                              execution_graph 63704 7ff6e215cc3c 63725 7ff6e215ce0c 63704->63725 63707 7ff6e215cd88 63876 7ff6e215d12c 7 API calls 2 library calls 63707->63876 63708 7ff6e215cc58 __scrt_acquire_startup_lock 63710 7ff6e215cd92 63708->63710 63712 7ff6e215cc76 __scrt_release_startup_lock 63708->63712 63877 7ff6e215d12c 7 API calls 2 library calls 63710->63877 63714 7ff6e215cc9b 63712->63714 63715 7ff6e215cd21 63712->63715 63873 7ff6e2169b2c 45 API calls 63712->63873 63713 7ff6e215cd9d __GetCurrentState 63731 7ff6e215d274 63715->63731 63717 7ff6e215cd26 63734 7ff6e2151000 63717->63734 63722 7ff6e215cd49 63722->63713 63875 7ff6e215cf90 7 API calls 63722->63875 63724 7ff6e215cd60 63724->63714 63726 7ff6e215ce14 63725->63726 63727 7ff6e215ce20 __scrt_dllmain_crt_thread_attach 63726->63727 63728 7ff6e215ce2d 63727->63728 63729 7ff6e215cc50 63727->63729 63728->63729 63878 7ff6e215d888 7 API calls 2 library calls 63728->63878 63729->63707 63729->63708 63879 7ff6e217a4d0 63731->63879 63733 7ff6e215d28b GetStartupInfoW 63733->63717 63735 7ff6e2151009 63734->63735 63881 7ff6e2165484 63735->63881 63737 7ff6e21537fb 63888 7ff6e21536b0 63737->63888 63743 7ff6e215391b 63996 7ff6e21545c0 63743->63996 63744 7ff6e215383c 63991 7ff6e2151c80 63744->63991 63748 7ff6e215385b 63960 7ff6e2158830 63748->63960 63751 7ff6e215396a 64019 7ff6e2152710 54 API calls _log10_special 63751->64019 63753 7ff6e215388e 63763 7ff6e21538bb __std_exception_copy 63753->63763 63995 7ff6e21589a0 40 API calls __std_exception_copy 63753->63995 63755 7ff6e215395d 63756 7ff6e2153962 63755->63756 63757 7ff6e2153984 63755->63757 64015 7ff6e216004c 63756->64015 63759 7ff6e2151c80 49 API calls 63757->63759 63761 7ff6e21539a3 63759->63761 63768 7ff6e2151950 115 API calls 63761->63768 63762 7ff6e21538de __std_exception_copy 63776 7ff6e215390e __std_exception_copy 63762->63776 64021 7ff6e2158940 40 API calls __std_exception_copy 63762->64021 63763->63762 63764 7ff6e2158830 14 API calls 63763->63764 63764->63762 63766 7ff6e2153a0b 64022 7ff6e21589a0 40 API calls __std_exception_copy 63766->64022 63770 7ff6e21539ce 63768->63770 63769 7ff6e2153a17 64023 7ff6e21589a0 40 API calls __std_exception_copy 63769->64023 63770->63748 63772 7ff6e21539de 63770->63772 64020 7ff6e2152710 54 API calls _log10_special 63772->64020 63773 7ff6e2153a23 64024 7ff6e21589a0 40 API calls __std_exception_copy 63773->64024 63777 7ff6e2158830 14 API calls 63776->63777 63778 7ff6e2153a3b 63777->63778 63779 7ff6e2153a60 __std_exception_copy 63778->63779 63780 7ff6e2153b2f 63778->63780 63794 7ff6e2153aab 63779->63794 64025 7ff6e2158940 40 API calls __std_exception_copy 63779->64025 64026 7ff6e2152710 54 API calls _log10_special 63780->64026 63782 7ff6e2153808 __std_exception_copy 64029 7ff6e215c550 63782->64029 63784 7ff6e2158830 14 API calls 63785 7ff6e2153bf4 __std_exception_copy 63784->63785 63786 7ff6e2153c46 63785->63786 63787 7ff6e2153d41 63785->63787 63788 7ff6e2153cd4 63786->63788 63789 7ff6e2153c50 63786->63789 64040 7ff6e21544e0 49 API calls 63787->64040 63792 7ff6e2158830 14 API calls 63788->63792 64027 7ff6e21590e0 59 API calls _log10_special 63789->64027 63796 7ff6e2153ce0 63792->63796 63793 7ff6e2153d4f 63797 7ff6e2153d65 63793->63797 63798 7ff6e2153d71 63793->63798 63794->63784 63795 7ff6e2153c55 63799 7ff6e2153cb3 63795->63799 63800 7ff6e2153c61 63795->63800 63796->63800 63803 7ff6e2153ced 63796->63803 64041 7ff6e2154630 63797->64041 63802 7ff6e2151c80 49 API calls 63798->63802 64038 7ff6e2158660 86 API calls 2 library calls 63799->64038 64028 7ff6e2152710 54 API calls _log10_special 63800->64028 63813 7ff6e2153d2b __std_exception_copy 63802->63813 63806 7ff6e2151c80 49 API calls 63803->63806 63809 7ff6e2153d0b 63806->63809 63807 7ff6e2153dbc 63973 7ff6e2159390 63807->63973 63808 7ff6e2153cbb 63811 7ff6e2153cc8 63808->63811 63812 7ff6e2153cbf 63808->63812 63809->63813 63814 7ff6e2153d12 63809->63814 63811->63813 63812->63800 63813->63807 63815 7ff6e2153da7 LoadLibraryExW 63813->63815 64039 7ff6e2152710 54 API calls _log10_special 63814->64039 63815->63807 63816 7ff6e2153dcf SetDllDirectoryW 63819 7ff6e2153e02 63816->63819 63863 7ff6e2153e52 63816->63863 63820 7ff6e2158830 14 API calls 63819->63820 63829 7ff6e2153e0e __std_exception_copy 63820->63829 63821 7ff6e2154000 63822 7ff6e215400a PostMessageW GetMessageW 63821->63822 63823 7ff6e215402d 63821->63823 63822->63823 63978 7ff6e2153360 63823->63978 63824 7ff6e2153f13 64052 7ff6e21533c0 121 API calls 2 library calls 63824->64052 63826 7ff6e2153f1b 63826->63782 63827 7ff6e2153f23 63826->63827 64053 7ff6e21590c0 LocalFree 63827->64053 63832 7ff6e2153eea 63829->63832 63836 7ff6e2153e46 63829->63836 64051 7ff6e2158940 40 API calls __std_exception_copy 63832->64051 63836->63863 64044 7ff6e2156dc0 54 API calls _get_daylight 63836->64044 63844 7ff6e2154053 63845 7ff6e2153e64 64045 7ff6e2157340 117 API calls 2 library calls 63845->64045 63849 7ff6e2153e79 63852 7ff6e2153e9a 63849->63852 63865 7ff6e2153e7d 63849->63865 64046 7ff6e2156e00 120 API calls _log10_special 63849->64046 63852->63865 64047 7ff6e21571b0 125 API calls 63852->64047 63856 7ff6e2153ed8 64050 7ff6e2156fc0 FreeLibrary 63856->64050 63857 7ff6e2153eaf 63857->63865 64048 7ff6e21574f0 55 API calls 63857->64048 63863->63821 63863->63824 63865->63863 64049 7ff6e2152a50 54 API calls _log10_special 63865->64049 63873->63715 63874 7ff6e215d2b8 GetModuleHandleW 63874->63722 63875->63724 63876->63710 63877->63713 63878->63729 63880 7ff6e217a4c0 63879->63880 63880->63733 63880->63880 63884 7ff6e216f480 63881->63884 63882 7ff6e216f4d3 64055 7ff6e216a814 37 API calls 2 library calls 63882->64055 63884->63882 63885 7ff6e216f526 63884->63885 64056 7ff6e216f358 71 API calls _fread_nolock 63885->64056 63887 7ff6e216f4fc 63887->63737 64057 7ff6e215c850 63888->64057 63891 7ff6e21536eb GetLastError 64064 7ff6e2152c50 51 API calls _log10_special 63891->64064 63892 7ff6e2153710 64059 7ff6e2159280 FindFirstFileExW 63892->64059 63896 7ff6e215377d 64067 7ff6e2159440 WideCharToMultiByte WideCharToMultiByte __std_exception_copy 63896->64067 63897 7ff6e2153723 64065 7ff6e2159300 CreateFileW GetFinalPathNameByHandleW CloseHandle 63897->64065 63898 7ff6e215c550 _log10_special 8 API calls 63901 7ff6e21537b5 63898->63901 63901->63782 63910 7ff6e2151950 63901->63910 63902 7ff6e2153730 63903 7ff6e2153734 63902->63903 63907 7ff6e215374c __vcrt_FlsAlloc 63902->63907 64066 7ff6e2152810 49 API calls _log10_special 63903->64066 63904 7ff6e2153706 63904->63898 63905 7ff6e215378b 63905->63904 64068 7ff6e2152810 49 API calls _log10_special 63905->64068 63907->63896 63909 7ff6e2153745 63909->63904 63911 7ff6e21545c0 108 API calls 63910->63911 63912 7ff6e2151985 63911->63912 63913 7ff6e2151c43 63912->63913 63915 7ff6e2157f90 83 API calls 63912->63915 63914 7ff6e215c550 _log10_special 8 API calls 63913->63914 63916 7ff6e2151c5e 63914->63916 63917 7ff6e21519cb 63915->63917 63916->63743 63916->63744 63959 7ff6e2151a03 63917->63959 64069 7ff6e21606d4 63917->64069 63919 7ff6e216004c 74 API calls 63919->63913 63920 7ff6e21519e5 63921 7ff6e2151a08 63920->63921 63922 7ff6e21519e9 63920->63922 64073 7ff6e216039c 63921->64073 64076 7ff6e2164f08 11 API calls _get_daylight 63922->64076 63925 7ff6e21519ee 64077 7ff6e2152910 54 API calls _log10_special 63925->64077 63928 7ff6e2151a26 64078 7ff6e2164f08 11 API calls _get_daylight 63928->64078 63929 7ff6e2151a45 63933 7ff6e2151a7b 63929->63933 63934 7ff6e2151a5c 63929->63934 63931 7ff6e2151a2b 64079 7ff6e2152910 54 API calls _log10_special 63931->64079 63936 7ff6e2151c80 49 API calls 63933->63936 64080 7ff6e2164f08 11 API calls _get_daylight 63934->64080 63938 7ff6e2151a92 63936->63938 63937 7ff6e2151a61 64081 7ff6e2152910 54 API calls _log10_special 63937->64081 63940 7ff6e2151c80 49 API calls 63938->63940 63941 7ff6e2151add 63940->63941 63942 7ff6e21606d4 73 API calls 63941->63942 63943 7ff6e2151b01 63942->63943 63944 7ff6e2151b16 63943->63944 63945 7ff6e2151b35 63943->63945 64082 7ff6e2164f08 11 API calls _get_daylight 63944->64082 63946 7ff6e216039c _fread_nolock 53 API calls 63945->63946 63948 7ff6e2151b4a 63946->63948 63951 7ff6e2151b6f 63948->63951 63952 7ff6e2151b50 63948->63952 63949 7ff6e2151b1b 64083 7ff6e2152910 54 API calls _log10_special 63949->64083 64086 7ff6e2160110 37 API calls 2 library calls 63951->64086 64084 7ff6e2164f08 11 API calls _get_daylight 63952->64084 63955 7ff6e2151b55 64085 7ff6e2152910 54 API calls _log10_special 63955->64085 63956 7ff6e2151b89 63956->63959 64087 7ff6e2152710 54 API calls _log10_special 63956->64087 63959->63919 63961 7ff6e215883a 63960->63961 63962 7ff6e2159390 2 API calls 63961->63962 63963 7ff6e2158859 GetEnvironmentVariableW 63962->63963 63964 7ff6e2158876 ExpandEnvironmentStringsW 63963->63964 63965 7ff6e21588c2 63963->63965 63964->63965 63966 7ff6e2158898 63964->63966 63967 7ff6e215c550 _log10_special 8 API calls 63965->63967 64117 7ff6e2159440 WideCharToMultiByte WideCharToMultiByte __std_exception_copy 63966->64117 63969 7ff6e21588d4 63967->63969 63969->63753 63970 7ff6e21588aa 63971 7ff6e215c550 _log10_special 8 API calls 63970->63971 63972 7ff6e21588ba 63971->63972 63972->63753 63974 7ff6e21593b2 MultiByteToWideChar 63973->63974 63976 7ff6e21593d6 63973->63976 63975 7ff6e21593ec __std_exception_copy 63974->63975 63974->63976 63975->63816 63976->63975 63977 7ff6e21593f3 MultiByteToWideChar 63976->63977 63977->63975 64118 7ff6e2156360 63978->64118 63982 7ff6e2153381 63986 7ff6e2153399 63982->63986 64186 7ff6e2156050 63982->64186 63984 7ff6e215338d 63984->63986 64195 7ff6e21561e0 54 API calls 63984->64195 63987 7ff6e2153670 63986->63987 63988 7ff6e215367e 63987->63988 63989 7ff6e215368f 63988->63989 64334 7ff6e2158e60 FreeLibrary 63988->64334 64054 7ff6e2156fc0 FreeLibrary 63989->64054 63992 7ff6e2151ca5 63991->63992 64335 7ff6e2164984 63992->64335 63995->63763 63997 7ff6e21545cc 63996->63997 63998 7ff6e2159390 2 API calls 63997->63998 63999 7ff6e21545f4 63998->63999 64000 7ff6e2159390 2 API calls 63999->64000 64001 7ff6e2154607 64000->64001 64362 7ff6e2165f94 64001->64362 64004 7ff6e215c550 _log10_special 8 API calls 64005 7ff6e215392b 64004->64005 64005->63751 64006 7ff6e2157f90 64005->64006 64007 7ff6e2157fb4 64006->64007 64008 7ff6e21606d4 73 API calls 64007->64008 64011 7ff6e215808b __std_exception_copy 64007->64011 64009 7ff6e2157fd0 64008->64009 64009->64011 64530 7ff6e21678c8 64009->64530 64011->63755 64012 7ff6e21606d4 73 API calls 64014 7ff6e2157fe5 64012->64014 64013 7ff6e216039c _fread_nolock 53 API calls 64013->64014 64014->64011 64014->64012 64014->64013 64016 7ff6e216007c 64015->64016 64546 7ff6e215fe28 64016->64546 64018 7ff6e2160095 64018->63751 64019->63782 64020->63782 64021->63766 64022->63769 64023->63773 64024->63776 64025->63794 64026->63782 64027->63795 64028->63782 64031 7ff6e215c559 64029->64031 64030 7ff6e215c8e0 IsProcessorFeaturePresent 64033 7ff6e215c8f8 64030->64033 64031->64030 64032 7ff6e2153ca7 64031->64032 64032->63874 64558 7ff6e215cad8 RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 64033->64558 64035 7ff6e215c90b 64559 7ff6e215c8a0 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 64035->64559 64038->63808 64039->63782 64040->63793 64042 7ff6e2151c80 49 API calls 64041->64042 64043 7ff6e2154660 64042->64043 64043->63813 64044->63845 64045->63849 64046->63852 64047->63857 64048->63865 64049->63856 64050->63863 64051->63863 64052->63826 64054->63844 64055->63887 64056->63887 64058 7ff6e21536bc GetModuleFileNameW 64057->64058 64058->63891 64058->63892 64060 7ff6e21592bf FindClose 64059->64060 64061 7ff6e21592d2 64059->64061 64060->64061 64062 7ff6e215c550 _log10_special 8 API calls 64061->64062 64063 7ff6e215371a 64062->64063 64063->63896 64063->63897 64064->63904 64065->63902 64066->63909 64067->63905 64068->63904 64070 7ff6e2160704 64069->64070 64088 7ff6e2160464 64070->64088 64072 7ff6e216071d 64072->63920 64101 7ff6e21603bc 64073->64101 64076->63925 64077->63959 64078->63931 64079->63959 64080->63937 64081->63959 64082->63949 64083->63959 64084->63955 64085->63959 64086->63956 64087->63959 64089 7ff6e21604ce 64088->64089 64090 7ff6e216048e 64088->64090 64089->64090 64091 7ff6e21604da 64089->64091 64100 7ff6e216a814 37 API calls 2 library calls 64090->64100 64099 7ff6e216546c EnterCriticalSection 64091->64099 64094 7ff6e21604b5 64094->64072 64095 7ff6e21604df 64096 7ff6e21605e8 71 API calls 64095->64096 64097 7ff6e21604f1 64096->64097 64098 7ff6e2165478 _fread_nolock LeaveCriticalSection 64097->64098 64098->64094 64100->64094 64102 7ff6e21603e6 64101->64102 64103 7ff6e2151a20 64101->64103 64102->64103 64104 7ff6e2160432 64102->64104 64105 7ff6e21603f5 __scrt_get_show_window_mode 64102->64105 64103->63928 64103->63929 64114 7ff6e216546c EnterCriticalSection 64104->64114 64115 7ff6e2164f08 11 API calls _get_daylight 64105->64115 64108 7ff6e216043a 64110 7ff6e216013c _fread_nolock 51 API calls 64108->64110 64109 7ff6e216040a 64116 7ff6e216a8e0 37 API calls _invalid_parameter_noinfo 64109->64116 64112 7ff6e2160451 64110->64112 64113 7ff6e2165478 _fread_nolock LeaveCriticalSection 64112->64113 64113->64103 64115->64109 64116->64103 64117->63970 64119 7ff6e2156375 64118->64119 64120 7ff6e2151c80 49 API calls 64119->64120 64121 7ff6e21563b1 64120->64121 64122 7ff6e21563ba 64121->64122 64123 7ff6e21563dd 64121->64123 64206 7ff6e2152710 54 API calls _log10_special 64122->64206 64125 7ff6e2154630 49 API calls 64123->64125 64126 7ff6e21563f5 64125->64126 64127 7ff6e2156413 64126->64127 64207 7ff6e2152710 54 API calls _log10_special 64126->64207 64196 7ff6e2154560 64127->64196 64130 7ff6e215c550 _log10_special 8 API calls 64131 7ff6e215336e 64130->64131 64131->63986 64149 7ff6e2156500 64131->64149 64133 7ff6e215642b 64135 7ff6e2154630 49 API calls 64133->64135 64134 7ff6e2158e80 3 API calls 64134->64133 64136 7ff6e2156444 64135->64136 64137 7ff6e2156469 64136->64137 64138 7ff6e2156449 64136->64138 64202 7ff6e2158e80 64137->64202 64208 7ff6e2152710 54 API calls _log10_special 64138->64208 64141 7ff6e21563d3 64141->64130 64142 7ff6e2156476 64143 7ff6e2156482 64142->64143 64144 7ff6e21564c1 64142->64144 64145 7ff6e2159390 2 API calls 64143->64145 64210 7ff6e2155830 137 API calls 64144->64210 64147 7ff6e215649a GetLastError 64145->64147 64209 7ff6e2152c50 51 API calls _log10_special 64147->64209 64211 7ff6e2155400 64149->64211 64151 7ff6e2156526 64152 7ff6e215652e 64151->64152 64153 7ff6e215653f 64151->64153 64236 7ff6e2152710 54 API calls _log10_special 64152->64236 64218 7ff6e2154c90 64153->64218 64157 7ff6e215654b 64237 7ff6e2152710 54 API calls _log10_special 64157->64237 64159 7ff6e215655c 64160 7ff6e215656c 64159->64160 64162 7ff6e215657d 64159->64162 64238 7ff6e2152710 54 API calls _log10_special 64160->64238 64163 7ff6e215659c 64162->64163 64164 7ff6e21565ad 64162->64164 64239 7ff6e2152710 54 API calls _log10_special 64163->64239 64166 7ff6e21565bc 64164->64166 64167 7ff6e21565cd 64164->64167 64240 7ff6e2152710 54 API calls _log10_special 64166->64240 64222 7ff6e2154d50 64167->64222 64171 7ff6e21565dc 64241 7ff6e2152710 54 API calls _log10_special 64171->64241 64172 7ff6e21565ed 64174 7ff6e21565fc 64172->64174 64175 7ff6e215660d 64172->64175 64242 7ff6e2152710 54 API calls _log10_special 64174->64242 64177 7ff6e215661f 64175->64177 64179 7ff6e2156630 64175->64179 64243 7ff6e2152710 54 API calls _log10_special 64177->64243 64182 7ff6e215665a 64179->64182 64244 7ff6e21672b0 73 API calls 64179->64244 64181 7ff6e2156648 64245 7ff6e21672b0 73 API calls 64181->64245 64184 7ff6e215653a 64182->64184 64246 7ff6e2152710 54 API calls _log10_special 64182->64246 64184->63982 64187 7ff6e2156070 64186->64187 64187->64187 64188 7ff6e2156099 64187->64188 64194 7ff6e21560b0 __std_exception_copy 64187->64194 64278 7ff6e2152710 54 API calls _log10_special 64188->64278 64190 7ff6e21560a5 64190->63984 64191 7ff6e21561bb 64191->63984 64193 7ff6e2152710 54 API calls 64193->64194 64194->64191 64194->64193 64248 7ff6e2151470 64194->64248 64195->63986 64197 7ff6e215456a 64196->64197 64198 7ff6e2159390 2 API calls 64197->64198 64199 7ff6e215458f 64198->64199 64200 7ff6e215c550 _log10_special 8 API calls 64199->64200 64201 7ff6e21545b7 64200->64201 64201->64133 64201->64134 64203 7ff6e2159390 2 API calls 64202->64203 64204 7ff6e2158e94 LoadLibraryExW 64203->64204 64205 7ff6e2158eb3 __std_exception_copy 64204->64205 64205->64142 64206->64141 64207->64127 64208->64141 64209->64141 64210->64141 64212 7ff6e215542c 64211->64212 64213 7ff6e2155434 64212->64213 64216 7ff6e21555d4 64212->64216 64247 7ff6e2166aa4 48 API calls 64212->64247 64213->64151 64214 7ff6e2155797 __std_exception_copy 64214->64151 64215 7ff6e21547d0 47 API calls 64215->64216 64216->64214 64216->64215 64219 7ff6e2154cc0 64218->64219 64220 7ff6e215c550 _log10_special 8 API calls 64219->64220 64221 7ff6e2154d2a 64220->64221 64221->64157 64221->64159 64223 7ff6e2154d65 64222->64223 64224 7ff6e2151c80 49 API calls 64223->64224 64225 7ff6e2154db1 64224->64225 64226 7ff6e2151c80 49 API calls 64225->64226 64235 7ff6e2154e33 __std_exception_copy 64225->64235 64227 7ff6e2154df0 64226->64227 64230 7ff6e2159390 2 API calls 64227->64230 64227->64235 64228 7ff6e215c550 _log10_special 8 API calls 64229 7ff6e2154e7e 64228->64229 64229->64171 64229->64172 64231 7ff6e2154e06 64230->64231 64232 7ff6e2159390 2 API calls 64231->64232 64233 7ff6e2154e1d 64232->64233 64234 7ff6e2159390 2 API calls 64233->64234 64234->64235 64235->64228 64236->64184 64237->64184 64238->64184 64239->64184 64240->64184 64241->64184 64242->64184 64243->64184 64244->64181 64245->64182 64246->64184 64247->64212 64249 7ff6e21545c0 108 API calls 64248->64249 64250 7ff6e2151493 64249->64250 64251 7ff6e215149b 64250->64251 64252 7ff6e21514bc 64250->64252 64301 7ff6e2152710 54 API calls _log10_special 64251->64301 64254 7ff6e21606d4 73 API calls 64252->64254 64256 7ff6e21514d1 64254->64256 64255 7ff6e21514ab 64255->64194 64257 7ff6e21514d5 64256->64257 64258 7ff6e21514f8 64256->64258 64302 7ff6e2164f08 11 API calls _get_daylight 64257->64302 64262 7ff6e2151508 64258->64262 64263 7ff6e2151532 64258->64263 64260 7ff6e21514da 64303 7ff6e2152910 54 API calls _log10_special 64260->64303 64304 7ff6e2164f08 11 API calls _get_daylight 64262->64304 64265 7ff6e2151538 64263->64265 64273 7ff6e215154b 64263->64273 64279 7ff6e2151210 64265->64279 64266 7ff6e2151510 64305 7ff6e2152910 54 API calls _log10_special 64266->64305 64269 7ff6e216004c 74 API calls 64272 7ff6e21515c4 64269->64272 64270 7ff6e21514f3 __std_exception_copy 64270->64269 64271 7ff6e216039c _fread_nolock 53 API calls 64271->64273 64272->64194 64273->64270 64273->64271 64274 7ff6e21515d6 64273->64274 64306 7ff6e2164f08 11 API calls _get_daylight 64274->64306 64276 7ff6e21515db 64307 7ff6e2152910 54 API calls _log10_special 64276->64307 64278->64190 64280 7ff6e2151268 64279->64280 64281 7ff6e2151297 64280->64281 64282 7ff6e215126f 64280->64282 64285 7ff6e21512d4 64281->64285 64286 7ff6e21512b1 64281->64286 64312 7ff6e2152710 54 API calls _log10_special 64282->64312 64284 7ff6e2151282 64284->64270 64290 7ff6e21512e6 64285->64290 64300 7ff6e2151309 memcpy_s 64285->64300 64313 7ff6e2164f08 11 API calls _get_daylight 64286->64313 64288 7ff6e21512b6 64314 7ff6e2152910 54 API calls _log10_special 64288->64314 64315 7ff6e2164f08 11 API calls _get_daylight 64290->64315 64292 7ff6e216039c _fread_nolock 53 API calls 64292->64300 64293 7ff6e21512eb 64316 7ff6e2152910 54 API calls _log10_special 64293->64316 64295 7ff6e2160110 37 API calls 64295->64300 64296 7ff6e21512cf __std_exception_copy 64296->64270 64297 7ff6e21513cf 64317 7ff6e2152710 54 API calls _log10_special 64297->64317 64300->64292 64300->64295 64300->64296 64300->64297 64308 7ff6e2160adc 64300->64308 64301->64255 64302->64260 64303->64270 64304->64266 64305->64270 64306->64276 64307->64270 64309 7ff6e2160b0c 64308->64309 64318 7ff6e216082c 64309->64318 64311 7ff6e2160b2a 64311->64300 64312->64284 64313->64288 64314->64296 64315->64293 64316->64296 64317->64296 64319 7ff6e216084c 64318->64319 64320 7ff6e2160879 64318->64320 64319->64320 64321 7ff6e2160856 64319->64321 64322 7ff6e2160881 64319->64322 64320->64311 64332 7ff6e216a814 37 API calls 2 library calls 64321->64332 64325 7ff6e216076c 64322->64325 64333 7ff6e216546c EnterCriticalSection 64325->64333 64327 7ff6e2160789 64328 7ff6e21607ac 74 API calls 64327->64328 64329 7ff6e2160792 64328->64329 64330 7ff6e2165478 _fread_nolock LeaveCriticalSection 64329->64330 64331 7ff6e216079d 64330->64331 64331->64320 64332->64320 64334->63989 64338 7ff6e21649de 64335->64338 64336 7ff6e2164a03 64353 7ff6e216a814 37 API calls 2 library calls 64336->64353 64338->64336 64339 7ff6e2164a3f 64338->64339 64354 7ff6e2162c10 49 API calls _invalid_parameter_noinfo 64339->64354 64341 7ff6e2164b1c 64344 7ff6e216a948 __free_lconv_num 11 API calls 64341->64344 64342 7ff6e2164ad6 64342->64341 64346 7ff6e2164af1 64342->64346 64347 7ff6e2164b40 64342->64347 64350 7ff6e2164ae8 64342->64350 64343 7ff6e215c550 _log10_special 8 API calls 64345 7ff6e2151cc8 64343->64345 64352 7ff6e2164a2d 64344->64352 64345->63748 64355 7ff6e216a948 64346->64355 64347->64341 64348 7ff6e2164b4a 64347->64348 64351 7ff6e216a948 __free_lconv_num 11 API calls 64348->64351 64350->64341 64350->64346 64351->64352 64352->64343 64353->64352 64354->64342 64356 7ff6e216a94d RtlFreeHeap 64355->64356 64360 7ff6e216a97c 64355->64360 64357 7ff6e216a968 GetLastError 64356->64357 64356->64360 64358 7ff6e216a975 __free_lconv_num 64357->64358 64361 7ff6e2164f08 11 API calls _get_daylight 64358->64361 64360->64352 64361->64360 64363 7ff6e2165ec8 64362->64363 64364 7ff6e2165eee 64363->64364 64367 7ff6e2165f21 64363->64367 64393 7ff6e2164f08 11 API calls _get_daylight 64364->64393 64366 7ff6e2165ef3 64394 7ff6e216a8e0 37 API calls _invalid_parameter_noinfo 64366->64394 64369 7ff6e2165f27 64367->64369 64370 7ff6e2165f34 64367->64370 64395 7ff6e2164f08 11 API calls _get_daylight 64369->64395 64381 7ff6e216ac28 64370->64381 64371 7ff6e2154616 64371->64004 64375 7ff6e2165f48 64396 7ff6e2164f08 11 API calls _get_daylight 64375->64396 64376 7ff6e2165f55 64388 7ff6e216fecc 64376->64388 64379 7ff6e2165f68 64397 7ff6e2165478 LeaveCriticalSection 64379->64397 64398 7ff6e21702d8 EnterCriticalSection 64381->64398 64383 7ff6e216ac3f 64384 7ff6e216ac9c 19 API calls 64383->64384 64385 7ff6e216ac4a 64384->64385 64386 7ff6e2170338 _isindst LeaveCriticalSection 64385->64386 64387 7ff6e2165f3e 64386->64387 64387->64375 64387->64376 64399 7ff6e216fbc8 64388->64399 64391 7ff6e216ff26 64391->64379 64393->64366 64394->64371 64395->64371 64396->64371 64404 7ff6e216fc03 __vcrt_FlsAlloc 64399->64404 64401 7ff6e216fea1 64418 7ff6e216a8e0 37 API calls _invalid_parameter_noinfo 64401->64418 64403 7ff6e216fdd3 64403->64391 64411 7ff6e2176d54 64403->64411 64409 7ff6e216fdca 64404->64409 64414 7ff6e2167a3c 51 API calls 3 library calls 64404->64414 64406 7ff6e216fe35 64406->64409 64415 7ff6e2167a3c 51 API calls 3 library calls 64406->64415 64408 7ff6e216fe54 64408->64409 64416 7ff6e2167a3c 51 API calls 3 library calls 64408->64416 64409->64403 64417 7ff6e2164f08 11 API calls _get_daylight 64409->64417 64419 7ff6e2176354 64411->64419 64414->64406 64415->64408 64416->64409 64417->64401 64418->64403 64420 7ff6e217636b 64419->64420 64421 7ff6e2176389 64419->64421 64473 7ff6e2164f08 11 API calls _get_daylight 64420->64473 64421->64420 64423 7ff6e21763a5 64421->64423 64430 7ff6e2176964 64423->64430 64424 7ff6e2176370 64474 7ff6e216a8e0 37 API calls _invalid_parameter_noinfo 64424->64474 64428 7ff6e217637c 64428->64391 64476 7ff6e2176698 64430->64476 64433 7ff6e21769d9 64508 7ff6e2164ee8 11 API calls _get_daylight 64433->64508 64434 7ff6e21769f1 64496 7ff6e2168520 64434->64496 64438 7ff6e21769de 64509 7ff6e2164f08 11 API calls _get_daylight 64438->64509 64449 7ff6e21763d0 64449->64428 64475 7ff6e21684f8 LeaveCriticalSection 64449->64475 64473->64424 64474->64428 64477 7ff6e21766c4 64476->64477 64479 7ff6e21766de 64476->64479 64477->64479 64521 7ff6e2164f08 11 API calls _get_daylight 64477->64521 64482 7ff6e217675c 64479->64482 64523 7ff6e2164f08 11 API calls _get_daylight 64479->64523 64480 7ff6e21766d3 64522 7ff6e216a8e0 37 API calls _invalid_parameter_noinfo 64480->64522 64483 7ff6e21767ad 64482->64483 64525 7ff6e2164f08 11 API calls _get_daylight 64482->64525 64494 7ff6e217680a 64483->64494 64527 7ff6e2169b78 37 API calls 2 library calls 64483->64527 64486 7ff6e21767a2 64526 7ff6e216a8e0 37 API calls _invalid_parameter_noinfo 64486->64526 64488 7ff6e2176806 64489 7ff6e2176888 64488->64489 64488->64494 64528 7ff6e216a900 17 API calls _isindst 64489->64528 64491 7ff6e2176751 64524 7ff6e216a8e0 37 API calls _invalid_parameter_noinfo 64491->64524 64494->64433 64494->64434 64529 7ff6e21702d8 EnterCriticalSection 64496->64529 64508->64438 64509->64449 64521->64480 64522->64479 64523->64491 64524->64482 64525->64486 64526->64483 64527->64488 64531 7ff6e21678f8 64530->64531 64534 7ff6e21673d4 64531->64534 64533 7ff6e2167911 64533->64014 64535 7ff6e21673ef 64534->64535 64536 7ff6e216741e 64534->64536 64545 7ff6e216a814 37 API calls 2 library calls 64535->64545 64544 7ff6e216546c EnterCriticalSection 64536->64544 64539 7ff6e2167423 64540 7ff6e2167440 38 API calls 64539->64540 64542 7ff6e216742f 64540->64542 64541 7ff6e216740f 64541->64533 64543 7ff6e2165478 _fread_nolock LeaveCriticalSection 64542->64543 64543->64541 64545->64541 64547 7ff6e215fe43 64546->64547 64548 7ff6e215fe71 64546->64548 64557 7ff6e216a814 37 API calls 2 library calls 64547->64557 64549 7ff6e215fe63 64548->64549 64556 7ff6e216546c EnterCriticalSection 64548->64556 64549->64018 64552 7ff6e215fe88 64553 7ff6e215fea4 72 API calls 64552->64553 64554 7ff6e215fe94 64553->64554 64555 7ff6e2165478 _fread_nolock LeaveCriticalSection 64554->64555 64555->64549 64557->64549 64558->64035 64560 7ff8a92effe0 64561 7ff8a92efff0 64560->64561 64562 7ff8a92f0000 64561->64562 64566 7ff8a92d1e01 64561->64566 64570 7ff8a92d14bf 64561->64570 64574 7ff8a932ec4c 64561->64574 64566->64562 64567 7ff8a932e680 64566->64567 64568 7ff8a932ed9f SetLastError 64567->64568 64569 7ff8a932edb3 64567->64569 64568->64569 64569->64562 64570->64562 64571 7ff8a932e560 64570->64571 64572 7ff8a932ed9f SetLastError 64571->64572 64573 7ff8a932edb3 64571->64573 64572->64573 64573->64562 64575 7ff8a932ed60 64574->64575 64576 7ff8a932ed9f SetLastError 64575->64576 64577 7ff8a932edb3 64575->64577 64576->64577 64577->64562 64578 7ff6e2165628 64579 7ff6e2165642 64578->64579 64580 7ff6e216565f 64578->64580 64603 7ff6e2164ee8 11 API calls _get_daylight 64579->64603 64580->64579 64581 7ff6e2165672 CreateFileW 64580->64581 64583 7ff6e21656dc 64581->64583 64584 7ff6e21656a6 64581->64584 64607 7ff6e2165c04 46 API calls 3 library calls 64583->64607 64606 7ff6e216577c 59 API calls 3 library calls 64584->64606 64585 7ff6e2165647 64604 7ff6e2164f08 11 API calls _get_daylight 64585->64604 64589 7ff6e216564f 64605 7ff6e216a8e0 37 API calls _invalid_parameter_noinfo 64589->64605 64590 7ff6e21656b4 64593 7ff6e21656bb CloseHandle 64590->64593 64594 7ff6e21656d1 CloseHandle 64590->64594 64591 7ff6e21656e1 64595 7ff6e21656e5 64591->64595 64596 7ff6e2165710 64591->64596 64598 7ff6e216565a 64593->64598 64594->64598 64608 7ff6e2164e7c 11 API calls 2 library calls 64595->64608 64609 7ff6e21659c4 51 API calls 64596->64609 64600 7ff6e216571d 64610 7ff6e2165b00 21 API calls _fread_nolock 64600->64610 64602 7ff6e21656ef 64602->64598 64603->64585 64604->64589 64605->64598 64606->64590 64607->64591 64608->64602 64609->64600 64610->64602 64620 7ff8a8837b30 64621 7ff8a88386d1 64620->64621 64628 7ff8a8837b48 64620->64628 64622 7ff8a88385de LoadLibraryA 64623 7ff8a88385f8 64622->64623 64626 7ff8a8838617 GetProcAddress 64623->64626 64623->64628 64625 7ff8a8838639 VirtualProtect VirtualProtect 64625->64621 64626->64623 64627 7ff8a883862e 64626->64627 64628->64622 64628->64625 64629 7ff8a9341360 64630 7ff8a9341378 64629->64630 64631 7ff8a9341486 64630->64631 64633 7ff8a92d1c1c 64630->64633 64633->64630 64634 7ff8a9316fb0 64633->64634 64636 7ff8a9317079 64634->64636 64637 7ff8a92d1a0f 64634->64637 64636->64630 64637->64634 64640 7ff8a931aaa0 64637->64640 64638 7ff8a92d14ec SetLastError 64638->64640 64639 7ff8a931b87f 64641 7ff8a931b8aa 00007FF8C6126570 64639->64641 64646 7ff8a931ac23 64639->64646 64640->64638 64640->64639 64640->64646 64642 7ff8a931b8cb 00007FF8C6126570 64641->64642 64641->64646 64643 7ff8a931b8eb 00007FF8C6126570 64642->64643 64642->64646 64644 7ff8a931b902 00007FF8C6126570 64643->64644 64643->64646 64645 7ff8a931b91a 00007FF8C6126570 64644->64645 64644->64646 64645->64646 64646->64634 64647 7ff6e2169961 64659 7ff6e216a3d8 64647->64659 64649 7ff6e2169966 64650 7ff6e216998d GetModuleHandleW 64649->64650 64651 7ff6e21699d7 64649->64651 64650->64651 64657 7ff6e216999a 64650->64657 64652 7ff6e2169864 11 API calls 64651->64652 64653 7ff6e2169a13 64652->64653 64654 7ff6e2169a1a 64653->64654 64655 7ff6e2169a30 11 API calls 64653->64655 64656 7ff6e2169a2c 64655->64656 64657->64651 64658 7ff6e2169a88 GetModuleHandleExW GetProcAddress FreeLibrary 64657->64658 64658->64651 64664 7ff6e216b150 45 API calls 3 library calls 64659->64664 64661 7ff6e216a3e1 64665 7ff6e216a504 45 API calls 2 library calls 64661->64665 64664->64661 64666 7ff6e2152fe0 64667 7ff6e2152ff0 64666->64667 64668 7ff6e215302b 64667->64668 64669 7ff6e2153041 64667->64669 64694 7ff6e2152710 54 API calls _log10_special 64668->64694 64671 7ff6e2153061 64669->64671 64681 7ff6e2153077 __std_exception_copy 64669->64681 64695 7ff6e2152710 54 API calls _log10_special 64671->64695 64673 7ff6e215c550 _log10_special 8 API calls 64674 7ff6e21531fa 64673->64674 64675 7ff6e2151470 116 API calls 64675->64681 64676 7ff6e2153349 64702 7ff6e2152710 54 API calls _log10_special 64676->64702 64677 7ff6e2151c80 49 API calls 64677->64681 64679 7ff6e2153333 64701 7ff6e2152710 54 API calls _log10_special 64679->64701 64681->64675 64681->64676 64681->64677 64681->64679 64682 7ff6e215330d 64681->64682 64684 7ff6e2153207 64681->64684 64693 7ff6e2153037 __std_exception_copy 64681->64693 64700 7ff6e2152710 54 API calls _log10_special 64682->64700 64685 7ff6e2153273 64684->64685 64696 7ff6e216a404 37 API calls 2 library calls 64684->64696 64687 7ff6e215329e 64685->64687 64688 7ff6e2153290 64685->64688 64698 7ff6e2152dd0 37 API calls 64687->64698 64697 7ff6e216a404 37 API calls 2 library calls 64688->64697 64691 7ff6e215329c 64699 7ff6e2152500 54 API calls __std_exception_copy 64691->64699 64693->64673 64694->64693 64695->64693 64696->64685 64697->64691 64698->64691 64699->64693 64700->64693 64701->64693 64702->64693

                                                                                                                                                                                                              Executed Functions

                                                                                                                                                                                                              Function 00007FF6E2151000 Relevance: 60.0, APIs: 6, Strings: 28, Instructions: 509COMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 0 7ff6e2151000-7ff6e2153806 call 7ff6e215fe18 call 7ff6e215fe20 call 7ff6e215c850 call 7ff6e21653f0 call 7ff6e2165484 call 7ff6e21536b0 14 7ff6e2153808-7ff6e215380f 0->14 15 7ff6e2153814-7ff6e2153836 call 7ff6e2151950 0->15 17 7ff6e2153c97-7ff6e2153cb2 call 7ff6e215c550 14->17 20 7ff6e215391b-7ff6e2153931 call 7ff6e21545c0 15->20 21 7ff6e215383c-7ff6e2153856 call 7ff6e2151c80 15->21 28 7ff6e215396a-7ff6e215397f call 7ff6e2152710 20->28 29 7ff6e2153933-7ff6e2153960 call 7ff6e2157f90 20->29 25 7ff6e215385b-7ff6e215389b call 7ff6e2158830 21->25 34 7ff6e215389d-7ff6e21538a3 25->34 35 7ff6e21538c1-7ff6e21538cc call 7ff6e2164f30 25->35 37 7ff6e2153c8f 28->37 41 7ff6e2153962-7ff6e2153965 call 7ff6e216004c 29->41 42 7ff6e2153984-7ff6e21539a6 call 7ff6e2151c80 29->42 38 7ff6e21538a5-7ff6e21538ad 34->38 39 7ff6e21538af-7ff6e21538bd call 7ff6e21589a0 34->39 49 7ff6e21539fc-7ff6e2153a2a call 7ff6e2158940 call 7ff6e21589a0 * 3 35->49 50 7ff6e21538d2-7ff6e21538e1 call 7ff6e2158830 35->50 37->17 38->39 39->35 41->28 53 7ff6e21539b0-7ff6e21539b9 42->53 76 7ff6e2153a2f-7ff6e2153a3e call 7ff6e2158830 49->76 57 7ff6e21538e7-7ff6e21538ed 50->57 58 7ff6e21539f4-7ff6e21539f7 call 7ff6e2164f30 50->58 53->53 56 7ff6e21539bb-7ff6e21539d8 call 7ff6e2151950 53->56 56->25 68 7ff6e21539de-7ff6e21539ef call 7ff6e2152710 56->68 61 7ff6e21538f0-7ff6e21538fc 57->61 58->49 65 7ff6e2153905-7ff6e2153908 61->65 66 7ff6e21538fe-7ff6e2153903 61->66 65->58 69 7ff6e215390e-7ff6e2153916 call 7ff6e2164f30 65->69 66->61 66->65 68->37 69->76 79 7ff6e2153a44-7ff6e2153a47 76->79 80 7ff6e2153b45-7ff6e2153b53 76->80 79->80 83 7ff6e2153a4d-7ff6e2153a50 79->83 81 7ff6e2153a67 80->81 82 7ff6e2153b59-7ff6e2153b5d 80->82 84 7ff6e2153a6b-7ff6e2153a90 call 7ff6e2164f30 81->84 82->84 85 7ff6e2153a56-7ff6e2153a5a 83->85 86 7ff6e2153b14-7ff6e2153b17 83->86 94 7ff6e2153aab-7ff6e2153ac0 84->94 95 7ff6e2153a92-7ff6e2153aa6 call 7ff6e2158940 84->95 85->86 88 7ff6e2153a60 85->88 89 7ff6e2153b19-7ff6e2153b1d 86->89 90 7ff6e2153b2f-7ff6e2153b40 call 7ff6e2152710 86->90 88->81 89->90 91 7ff6e2153b1f-7ff6e2153b2a 89->91 98 7ff6e2153c7f-7ff6e2153c87 90->98 91->84 99 7ff6e2153ac6-7ff6e2153aca 94->99 100 7ff6e2153be8-7ff6e2153bfa call 7ff6e2158830 94->100 95->94 98->37 102 7ff6e2153bcd-7ff6e2153be2 call 7ff6e2151940 99->102 103 7ff6e2153ad0-7ff6e2153ae8 call 7ff6e2165250 99->103 108 7ff6e2153bfc-7ff6e2153c02 100->108 109 7ff6e2153c2e 100->109 102->99 102->100 113 7ff6e2153aea-7ff6e2153b02 call 7ff6e2165250 103->113 114 7ff6e2153b62-7ff6e2153b7a call 7ff6e2165250 103->114 111 7ff6e2153c04-7ff6e2153c1c 108->111 112 7ff6e2153c1e-7ff6e2153c2c 108->112 115 7ff6e2153c31-7ff6e2153c40 call 7ff6e2164f30 109->115 111->115 112->115 113->102 124 7ff6e2153b08-7ff6e2153b0f 113->124 122 7ff6e2153b7c-7ff6e2153b80 114->122 123 7ff6e2153b87-7ff6e2153b9f call 7ff6e2165250 114->123 125 7ff6e2153c46-7ff6e2153c4a 115->125 126 7ff6e2153d41-7ff6e2153d63 call 7ff6e21544e0 115->126 122->123 139 7ff6e2153bac-7ff6e2153bc4 call 7ff6e2165250 123->139 140 7ff6e2153ba1-7ff6e2153ba5 123->140 124->102 127 7ff6e2153cd4-7ff6e2153ce6 call 7ff6e2158830 125->127 128 7ff6e2153c50-7ff6e2153c5f call 7ff6e21590e0 125->128 137 7ff6e2153d65-7ff6e2153d6f call 7ff6e2154630 126->137 138 7ff6e2153d71-7ff6e2153d82 call 7ff6e2151c80 126->138 143 7ff6e2153ce8-7ff6e2153ceb 127->143 144 7ff6e2153d35-7ff6e2153d3c 127->144 141 7ff6e2153cb3-7ff6e2153cbd call 7ff6e2158660 128->141 142 7ff6e2153c61 128->142 152 7ff6e2153d87-7ff6e2153d96 137->152 138->152 139->102 154 7ff6e2153bc6 139->154 140->139 164 7ff6e2153cc8-7ff6e2153ccf 141->164 165 7ff6e2153cbf-7ff6e2153cc6 141->165 149 7ff6e2153c68 call 7ff6e2152710 142->149 143->144 150 7ff6e2153ced-7ff6e2153d10 call 7ff6e2151c80 143->150 144->149 160 7ff6e2153c6d-7ff6e2153c77 149->160 166 7ff6e2153d2b-7ff6e2153d33 call 7ff6e2164f30 150->166 167 7ff6e2153d12-7ff6e2153d26 call 7ff6e2152710 call 7ff6e2164f30 150->167 157 7ff6e2153dbc-7ff6e2153dd2 call 7ff6e2159390 152->157 158 7ff6e2153d98-7ff6e2153d9f 152->158 154->102 170 7ff6e2153dd4 157->170 171 7ff6e2153de0-7ff6e2153dfc SetDllDirectoryW 157->171 158->157 162 7ff6e2153da1-7ff6e2153da5 158->162 160->98 162->157 168 7ff6e2153da7-7ff6e2153db6 LoadLibraryExW 162->168 164->152 165->149 166->152 167->160 168->157 170->171 174 7ff6e2153ef9-7ff6e2153f00 171->174 175 7ff6e2153e02-7ff6e2153e11 call 7ff6e2158830 171->175 180 7ff6e2153f06-7ff6e2153f0d 174->180 181 7ff6e2154000-7ff6e2154008 174->181 189 7ff6e2153e2a-7ff6e2153e34 call 7ff6e2164f30 175->189 190 7ff6e2153e13-7ff6e2153e19 175->190 180->181 186 7ff6e2153f13-7ff6e2153f1d call 7ff6e21533c0 180->186 182 7ff6e215400a-7ff6e2154027 PostMessageW GetMessageW 181->182 183 7ff6e215402d-7ff6e2154042 call 7ff6e21536a0 call 7ff6e2153360 call 7ff6e2153670 181->183 182->183 209 7ff6e2154047-7ff6e215405f call 7ff6e2156fc0 call 7ff6e2156d70 183->209 186->160 196 7ff6e2153f23-7ff6e2153f37 call 7ff6e21590c0 186->196 201 7ff6e2153eea-7ff6e2153ef4 call 7ff6e2158940 189->201 202 7ff6e2153e3a-7ff6e2153e40 189->202 193 7ff6e2153e1b-7ff6e2153e23 190->193 194 7ff6e2153e25-7ff6e2153e27 190->194 193->194 194->189 207 7ff6e2153f5c-7ff6e2153f9f call 7ff6e2158940 call 7ff6e21589e0 call 7ff6e2156fc0 call 7ff6e2156d70 call 7ff6e21588e0 196->207 208 7ff6e2153f39-7ff6e2153f56 PostMessageW GetMessageW 196->208 201->174 202->201 206 7ff6e2153e46-7ff6e2153e4c 202->206 210 7ff6e2153e57-7ff6e2153e59 206->210 211 7ff6e2153e4e-7ff6e2153e50 206->211 247 7ff6e2153fed-7ff6e2153ffb call 7ff6e2151900 207->247 248 7ff6e2153fa1-7ff6e2153fb7 call 7ff6e2158ed0 call 7ff6e21588e0 207->248 208->207 210->174 212 7ff6e2153e5f-7ff6e2153e7b call 7ff6e2156dc0 call 7ff6e2157340 210->212 211->212 215 7ff6e2153e52 211->215 227 7ff6e2153e7d-7ff6e2153e84 212->227 228 7ff6e2153e86-7ff6e2153e8d 212->228 215->174 230 7ff6e2153ed3-7ff6e2153ee8 call 7ff6e2152a50 call 7ff6e2156fc0 call 7ff6e2156d70 227->230 231 7ff6e2153ea7-7ff6e2153eb1 call 7ff6e21571b0 228->231 232 7ff6e2153e8f-7ff6e2153e9c call 7ff6e2156e00 228->232 230->174 245 7ff6e2153ebc-7ff6e2153eca call 7ff6e21574f0 231->245 246 7ff6e2153eb3-7ff6e2153eba 231->246 232->231 244 7ff6e2153e9e-7ff6e2153ea5 232->244 244->230 245->174 257 7ff6e2153ecc 245->257 246->230 247->160 248->247 261 7ff6e2153fb9-7ff6e2153fce 248->261 257->230 262 7ff6e2153fe8 call 7ff6e2152a50 261->262 263 7ff6e2153fd0-7ff6e2153fe3 call 7ff6e2152710 call 7ff6e2151900 261->263 262->247 263->160
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ErrorFileLastModuleName
                                                                                                                                                                                                              • String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
                                                                                                                                                                                                              • API String ID: 2776309574-4232158417
                                                                                                                                                                                                              • Opcode ID: 4651f0dbc160d0404dcf25292df1705b0130bb44d3f559e05366d82f1582b67c
                                                                                                                                                                                                              • Instruction ID: fad8cc674aa4c5e35a163e9aed1c6309e523e12c0ecdb3f728acf6881d5253ff
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4651f0dbc160d0404dcf25292df1705b0130bb44d3f559e05366d82f1582b67c
                                                                                                                                                                                                              • Instruction Fuzzy Hash: AA329E23E4C68691FA15DB24D4543F92293AF85788F8440B2DB4DC32D6EFAEE754C30A
                                                                                                                                                                                                              Function 00007FF8A92D1A0F Relevance: 23.6, APIs: 5, Strings: 8, Instructions: 891COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2186211945.00007FF8A92D1000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FF8A92D0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186182358.00007FF8A92D0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9353000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9355000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A937D000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9388000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9393000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186542599.00007FF8A9397000.00000080.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186571704.00007FF8A9398000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff8a92d0000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID: $..\s\ssl\record\ssl3_record.c$CONNE$GET $HEAD $POST $PUT $ssl3_get_record
                                                                                                                                                                                                              • API String ID: 0-2781224710
                                                                                                                                                                                                              • Opcode ID: 25f844a4e8796925b69264503ec11036386ca2ea61b3c4c8a6cc07d935ef8136
                                                                                                                                                                                                              • Instruction ID: 2372bb6755848d43a13fe5aa2de846d273a179b1a52b5056316a6f0daf35ee50
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 25f844a4e8796925b69264503ec11036386ca2ea61b3c4c8a6cc07d935ef8136
                                                                                                                                                                                                              • Instruction Fuzzy Hash: CF927C31A0EEC2A2FB609F21D8447B967B1EF85BC4F646035DA4DC66A9EF3DE4418710
                                                                                                                                                                                                              Function 00007FF6E2176964 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 855 7ff6e2176964-7ff6e21769d7 call 7ff6e2176698 858 7ff6e21769d9-7ff6e21769e2 call 7ff6e2164ee8 855->858 859 7ff6e21769f1-7ff6e21769fb call 7ff6e2168520 855->859 866 7ff6e21769e5-7ff6e21769ec call 7ff6e2164f08 858->866 864 7ff6e21769fd-7ff6e2176a14 call 7ff6e2164ee8 call 7ff6e2164f08 859->864 865 7ff6e2176a16-7ff6e2176a7f CreateFileW 859->865 864->866 868 7ff6e2176afc-7ff6e2176b07 GetFileType 865->868 869 7ff6e2176a81-7ff6e2176a87 865->869 877 7ff6e2176d32-7ff6e2176d52 866->877 871 7ff6e2176b5a-7ff6e2176b61 868->871 872 7ff6e2176b09-7ff6e2176b44 GetLastError call 7ff6e2164e7c CloseHandle 868->872 874 7ff6e2176ac9-7ff6e2176af7 GetLastError call 7ff6e2164e7c 869->874 875 7ff6e2176a89-7ff6e2176a8d 869->875 880 7ff6e2176b69-7ff6e2176b6c 871->880 881 7ff6e2176b63-7ff6e2176b67 871->881 872->866 889 7ff6e2176b4a-7ff6e2176b55 call 7ff6e2164f08 872->889 874->866 875->874 882 7ff6e2176a8f-7ff6e2176ac7 CreateFileW 875->882 886 7ff6e2176b72-7ff6e2176bc7 call 7ff6e2168438 880->886 887 7ff6e2176b6e 880->887 881->886 882->868 882->874 894 7ff6e2176bc9-7ff6e2176bd5 call 7ff6e21768a0 886->894 895 7ff6e2176be6-7ff6e2176c17 call 7ff6e2176418 886->895 887->886 889->866 894->895 900 7ff6e2176bd7 894->900 901 7ff6e2176c1d-7ff6e2176c5f 895->901 902 7ff6e2176c19-7ff6e2176c1b 895->902 903 7ff6e2176bd9-7ff6e2176be1 call 7ff6e216aac0 900->903 904 7ff6e2176c81-7ff6e2176c8c 901->904 905 7ff6e2176c61-7ff6e2176c65 901->905 902->903 903->877 908 7ff6e2176c92-7ff6e2176c96 904->908 909 7ff6e2176d30 904->909 905->904 907 7ff6e2176c67-7ff6e2176c7c 905->907 907->904 908->909 911 7ff6e2176c9c-7ff6e2176ce1 CloseHandle CreateFileW 908->911 909->877 912 7ff6e2176d16-7ff6e2176d2b 911->912 913 7ff6e2176ce3-7ff6e2176d11 GetLastError call 7ff6e2164e7c call 7ff6e2168660 911->913 912->909 913->912
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1617910340-0
                                                                                                                                                                                                              • Opcode ID: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
                                                                                                                                                                                                              • Instruction ID: 0d847bccb3289a34f2cba70938e7d9977cbf713cc589450f8c2d6dc6fccd3c3e
                                                                                                                                                                                                              • Opcode Fuzzy Hash: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2EC1AD33F28A8585EB10CFA9C4902AC3762EB8AB98B010225DB1ED77D4CF7AD651C305
                                                                                                                                                                                                              Function 00007FF8A9397200 Relevance: 9.6, APIs: 4, Strings: 1, Instructions: 885librarymemoryloaderCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2186542599.00007FF8A9397000.00000080.00000001.01000000.00000012.sdmp, Offset: 00007FF8A92D0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186182358.00007FF8A92D0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A92D1000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9353000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9355000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A937D000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9388000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9393000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186571704.00007FF8A9398000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff8a92d0000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ProtectVirtual$AddressLibraryLoadProc
                                                                                                                                                                                                              • String ID: TLS 1.1
                                                                                                                                                                                                              • API String ID: 3300690313-2459780185
                                                                                                                                                                                                              • Opcode ID: e9bd674313fd626e8b10bb5bd9aba1fc995f4c064e3db001b0372bd032c2116d
                                                                                                                                                                                                              • Instruction ID: 7ce4dbba1a7237a56f1517093acc247e09f3303972ee91f2848105e12ae02878
                                                                                                                                                                                                              • Opcode Fuzzy Hash: e9bd674313fd626e8b10bb5bd9aba1fc995f4c064e3db001b0372bd032c2116d
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6F62F36262D9D296E7298E38D4503BD66E0F7487C5F046532EA9FC37C4EA7CEA45CB00
                                                                                                                                                                                                              Function 00007FF8A8F31000 Relevance: 6.9, APIs: 4, Instructions: 900librarymemoryloaderCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2186095548.00007FF8A8F31000.00000080.00000001.01000000.00000004.sdmp, Offset: 00007FF8A8870000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2184977608.00007FF8A8870000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2185017528.00007FF8A8871000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2185017528.00007FF8A8B1F000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2185017528.00007FF8A8B2C000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2185017528.00007FF8A8BA2000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2185017528.00007FF8A8C6D000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2185017528.00007FF8A8C74000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2185017528.00007FF8A8D6E000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2185017528.00007FF8A8D72000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2185017528.00007FF8A8E6B000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2185017528.00007FF8A8E76000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2185017528.00007FF8A8EF0000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2185017528.00007FF8A8F0B000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2185017528.00007FF8A8F24000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186150546.00007FF8A8F32000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff8a8870000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ProtectVirtual$AddressLibraryLoadProc
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3300690313-0
                                                                                                                                                                                                              • Opcode ID: bf3875d787bfcc14ef9ed9645fa2fd386f6a2c0859c7a2bae9dc7dced8cafdbb
                                                                                                                                                                                                              • Instruction ID: fd7d2c4aad8f3458a25fc64a4505116a0b2c27d7b67cf59aa9f9267cad30fcb8
                                                                                                                                                                                                              • Opcode Fuzzy Hash: bf3875d787bfcc14ef9ed9645fa2fd386f6a2c0859c7a2bae9dc7dced8cafdbb
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0F62147262919696EB198F38D4002BD76A0F7487C6F045532FAEEC3784EB7CEA85C714
                                                                                                                                                                                                              Function 00007FF8A8837B30 Relevance: 6.8, APIs: 4, Instructions: 850librarymemoryloaderCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2184903956.00007FF8A8837000.00000080.00000001.01000000.0000000C.sdmp, Offset: 00007FF8A8340000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182802526.00007FF8A8340000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182879352.00007FF8A8341000.00000040.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182879352.00007FF8A8352000.00000040.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182879352.00007FF8A8362000.00000040.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182879352.00007FF8A8368000.00000040.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182879352.00007FF8A83B2000.00000040.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182879352.00007FF8A83C7000.00000040.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182879352.00007FF8A83D7000.00000040.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182879352.00007FF8A83DE000.00000040.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182879352.00007FF8A83EC000.00000040.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182879352.00007FF8A86A9000.00000040.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182879352.00007FF8A86AB000.00000040.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182879352.00007FF8A86E2000.00000040.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182879352.00007FF8A8722000.00000040.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182879352.00007FF8A877A000.00000040.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182879352.00007FF8A87EA000.00000040.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182879352.00007FF8A881F000.00000040.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182879352.00007FF8A8831000.00000040.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2184936820.00007FF8A8839000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff8a8340000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ProtectVirtual$AddressLibraryLoadProc
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3300690313-0
                                                                                                                                                                                                              • Opcode ID: fd6e17aede7dd1a07b4ecde7e4701136c40a3ad312db3d6b815d4e7960ab785a
                                                                                                                                                                                                              • Instruction ID: b57d21b1c7e1b776f713c4ef7de442f4721c31e302bcc657c327f3dff7a6f72e
                                                                                                                                                                                                              • Opcode Fuzzy Hash: fd6e17aede7dd1a07b4ecde7e4701136c40a3ad312db3d6b815d4e7960ab785a
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 886211266295929BE7198F38D80027D77A0F7487C5F045532EAAAC3784EB7CEA54CB14
                                                                                                                                                                                                              Function 00007FF6E2159280 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Find$CloseFileFirst
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2295610775-0
                                                                                                                                                                                                              • Opcode ID: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
                                                                                                                                                                                                              • Instruction ID: dafe307e0607b00f08d51c152ec2e7c48ee04cff9de743b5296253bb86369ae2
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
                                                                                                                                                                                                              • Instruction Fuzzy Hash: DBF0A423E1864186F7608B60F4887B67351BB8432CF040235DB6EC2AD4DF7DD248CA09
                                                                                                                                                                                                              Function 00007FF6E2151950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184COMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 657 7ff6e2151950-7ff6e215198b call 7ff6e21545c0 660 7ff6e2151c4e-7ff6e2151c72 call 7ff6e215c550 657->660 661 7ff6e2151991-7ff6e21519d1 call 7ff6e2157f90 657->661 666 7ff6e2151c3b-7ff6e2151c3e call 7ff6e216004c 661->666 667 7ff6e21519d7-7ff6e21519e7 call 7ff6e21606d4 661->667 670 7ff6e2151c43-7ff6e2151c4b 666->670 672 7ff6e2151a08-7ff6e2151a24 call 7ff6e216039c 667->672 673 7ff6e21519e9-7ff6e2151a03 call 7ff6e2164f08 call 7ff6e2152910 667->673 670->660 679 7ff6e2151a26-7ff6e2151a40 call 7ff6e2164f08 call 7ff6e2152910 672->679 680 7ff6e2151a45-7ff6e2151a5a call 7ff6e2164f28 672->680 673->666 679->666 687 7ff6e2151a7b-7ff6e2151b05 call 7ff6e2151c80 * 2 call 7ff6e21606d4 call 7ff6e2164f44 680->687 688 7ff6e2151a5c-7ff6e2151a76 call 7ff6e2164f08 call 7ff6e2152910 680->688 701 7ff6e2151b0a-7ff6e2151b14 687->701 688->666 702 7ff6e2151b16-7ff6e2151b30 call 7ff6e2164f08 call 7ff6e2152910 701->702 703 7ff6e2151b35-7ff6e2151b4e call 7ff6e216039c 701->703 702->666 709 7ff6e2151b6f-7ff6e2151b8b call 7ff6e2160110 703->709 710 7ff6e2151b50-7ff6e2151b6a call 7ff6e2164f08 call 7ff6e2152910 703->710 717 7ff6e2151b8d-7ff6e2151b99 call 7ff6e2152710 709->717 718 7ff6e2151b9e-7ff6e2151bac 709->718 710->666 717->666 718->666 719 7ff6e2151bb2-7ff6e2151bb9 718->719 722 7ff6e2151bc1-7ff6e2151bc7 719->722 724 7ff6e2151bc9-7ff6e2151bd6 722->724 725 7ff6e2151be0-7ff6e2151bef 722->725 726 7ff6e2151bf1-7ff6e2151bfa 724->726 725->725 725->726 727 7ff6e2151bfc-7ff6e2151bff 726->727 728 7ff6e2151c0f 726->728 727->728 729 7ff6e2151c01-7ff6e2151c04 727->729 730 7ff6e2151c11-7ff6e2151c24 728->730 729->728 731 7ff6e2151c06-7ff6e2151c09 729->731 732 7ff6e2151c2d-7ff6e2151c39 730->732 733 7ff6e2151c26 730->733 731->728 734 7ff6e2151c0b-7ff6e2151c0d 731->734 732->666 732->722 733->732 734->730
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 00007FF6E2157F90: _fread_nolock.LIBCMT ref: 00007FF6E215803A
                                                                                                                                                                                                              • _fread_nolock.LIBCMT ref: 00007FF6E2151A1B
                                                                                                                                                                                                                • Part of subcall function 00007FF6E2152910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF6E2151B6A), ref: 00007FF6E215295E
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _fread_nolock$CurrentProcess
                                                                                                                                                                                                              • String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
                                                                                                                                                                                                              • API String ID: 2397952137-3497178890
                                                                                                                                                                                                              • Opcode ID: 27547418d9ab5e62463e202343d91a8db4d430f9fb0a7f3bbb020ab973e08554
                                                                                                                                                                                                              • Instruction ID: e280768a830f528bfaf53595ea54fdf141a7295d116ef14f411f5e8142ff26dd
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 27547418d9ab5e62463e202343d91a8db4d430f9fb0a7f3bbb020ab973e08554
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 96818273E0868686EB21DB14D0803F923A3AF85748F444475EB4EC7785DEBEE745874A
                                                                                                                                                                                                              Function 00007FF6E2151470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CurrentProcess
                                                                                                                                                                                                              • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                              • API String ID: 2050909247-3659356012
                                                                                                                                                                                                              • Opcode ID: 89ccecf573411ed4716394efc1ec480fa9932aea8d62f2b8012777f73556fdbd
                                                                                                                                                                                                              • Instruction ID: 0421359e718f6e84f89c9facb3e81dca3f8a7bc1ab9e6887216f13bd17e84262
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 89ccecf573411ed4716394efc1ec480fa9932aea8d62f2b8012777f73556fdbd
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0E418D23E5864285EA11DB21D4403F96393BF85788F484872EF0EC7B95DEBEE701870A
                                                                                                                                                                                                              Function 00007FF6E2151210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158COMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 918 7ff6e2151210-7ff6e215126d call 7ff6e215bd80 921 7ff6e2151297-7ff6e21512af call 7ff6e2164f44 918->921 922 7ff6e215126f-7ff6e2151296 call 7ff6e2152710 918->922 927 7ff6e21512d4-7ff6e21512e4 call 7ff6e2164f44 921->927 928 7ff6e21512b1-7ff6e21512cf call 7ff6e2164f08 call 7ff6e2152910 921->928 934 7ff6e21512e6-7ff6e2151304 call 7ff6e2164f08 call 7ff6e2152910 927->934 935 7ff6e2151309-7ff6e215131b 927->935 940 7ff6e2151439-7ff6e215146d call 7ff6e215ba60 call 7ff6e2164f30 * 2 928->940 934->940 936 7ff6e2151320-7ff6e2151345 call 7ff6e216039c 935->936 947 7ff6e215134b-7ff6e2151355 call 7ff6e2160110 936->947 948 7ff6e2151431 936->948 947->948 954 7ff6e215135b-7ff6e2151367 947->954 948->940 956 7ff6e2151370-7ff6e2151398 call 7ff6e215a1c0 954->956 959 7ff6e215139a-7ff6e215139d 956->959 960 7ff6e2151416-7ff6e215142c call 7ff6e2152710 956->960 962 7ff6e215139f-7ff6e21513a9 959->962 963 7ff6e2151411 959->963 960->948 964 7ff6e21513ab-7ff6e21513b9 call 7ff6e2160adc 962->964 965 7ff6e21513d4-7ff6e21513d7 962->965 963->960 969 7ff6e21513be-7ff6e21513c1 964->969 967 7ff6e21513ea-7ff6e21513ef 965->967 968 7ff6e21513d9-7ff6e21513e7 call 7ff6e2179e30 965->968 967->956 971 7ff6e21513f5-7ff6e21513f8 967->971 968->967 972 7ff6e21513c3-7ff6e21513cd call 7ff6e2160110 969->972 973 7ff6e21513cf-7ff6e21513d2 969->973 975 7ff6e21513fa-7ff6e21513fd 971->975 976 7ff6e215140c-7ff6e215140f 971->976 972->967 972->973 973->960 975->960 978 7ff6e21513ff-7ff6e2151407 975->978 976->948 978->936
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CurrentProcess
                                                                                                                                                                                                              • String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                                                                                                                                                              • API String ID: 2050909247-2813020118
                                                                                                                                                                                                              • Opcode ID: c49957f071027ddab990f7db31e9cb9fde1fe3b1b3a00d6674342581536df05e
                                                                                                                                                                                                              • Instruction ID: 8c5a92bd6e53f7045fc4d07042ef86adc34abfbca8375d64d92e7f31b9c8af18
                                                                                                                                                                                                              • Opcode Fuzzy Hash: c49957f071027ddab990f7db31e9cb9fde1fe3b1b3a00d6674342581536df05e
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5451DF23E4864285EA61AB11E4503FA6293BF81798F480175EF0DC77C5EFBEE641C70A
                                                                                                                                                                                                              Function 00007FF6E216ED10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • FreeLibrary.KERNEL32(?,?,?,00007FF6E216F0AA,?,?,-00000018,00007FF6E216AD53,?,?,?,00007FF6E216AC4A,?,?,?,00007FF6E2165F3E), ref: 00007FF6E216EE8C
                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,?,?,00007FF6E216F0AA,?,?,-00000018,00007FF6E216AD53,?,?,?,00007FF6E216AC4A,?,?,?,00007FF6E2165F3E), ref: 00007FF6E216EE98
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: AddressFreeLibraryProc
                                                                                                                                                                                                              • String ID: api-ms-$ext-ms-
                                                                                                                                                                                                              • API String ID: 3013587201-537541572
                                                                                                                                                                                                              • Opcode ID: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
                                                                                                                                                                                                              • Instruction ID: 02a5e0b0d5784069128e0ac7d93baa69024115d0f734a7f67243c0751cba561d
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8A41F933F2D60141EA15CB56D8407F92293BF49B98F984639DE1DC7384EFBEE6058209
                                                                                                                                                                                                              Function 00007FF6E21536B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61COMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetModuleFileNameW.KERNEL32(?,00007FF6E2153804), ref: 00007FF6E21536E1
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00007FF6E2153804), ref: 00007FF6E21536EB
                                                                                                                                                                                                                • Part of subcall function 00007FF6E2152C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF6E2153706,?,00007FF6E2153804), ref: 00007FF6E2152C9E
                                                                                                                                                                                                                • Part of subcall function 00007FF6E2152C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6E2153706,?,00007FF6E2153804), ref: 00007FF6E2152D63
                                                                                                                                                                                                                • Part of subcall function 00007FF6E2152C50: MessageBoxW.USER32 ref: 00007FF6E2152D99
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
                                                                                                                                                                                                              • String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
                                                                                                                                                                                                              • API String ID: 3187769757-2863816727
                                                                                                                                                                                                              • Opcode ID: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
                                                                                                                                                                                                              • Instruction ID: 2bd2243f81b6cd83946e9cb5a380921d6839b4a9877ad4fb7bbf521e3f0b8684
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
                                                                                                                                                                                                              • Instruction Fuzzy Hash: E1219F63F5864281FA209B20E8443FA2252BF8834CF800172E75EC75D5EEAEE705C34A
                                                                                                                                                                                                              Function 00007FF6E216BA5C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 1105 7ff6e216ba5c-7ff6e216ba82 1106 7ff6e216ba9d-7ff6e216baa1 1105->1106 1107 7ff6e216ba84-7ff6e216ba98 call 7ff6e2164ee8 call 7ff6e2164f08 1105->1107 1109 7ff6e216be77-7ff6e216be83 call 7ff6e2164ee8 call 7ff6e2164f08 1106->1109 1110 7ff6e216baa7-7ff6e216baae 1106->1110 1125 7ff6e216be8e 1107->1125 1127 7ff6e216be89 call 7ff6e216a8e0 1109->1127 1110->1109 1113 7ff6e216bab4-7ff6e216bae2 1110->1113 1113->1109 1114 7ff6e216bae8-7ff6e216baef 1113->1114 1117 7ff6e216bb08-7ff6e216bb0b 1114->1117 1118 7ff6e216baf1-7ff6e216bb03 call 7ff6e2164ee8 call 7ff6e2164f08 1114->1118 1123 7ff6e216be73-7ff6e216be75 1117->1123 1124 7ff6e216bb11-7ff6e216bb17 1117->1124 1118->1127 1128 7ff6e216be91-7ff6e216bea8 1123->1128 1124->1123 1129 7ff6e216bb1d-7ff6e216bb20 1124->1129 1125->1128 1127->1125 1129->1118 1132 7ff6e216bb22-7ff6e216bb47 1129->1132 1134 7ff6e216bb7a-7ff6e216bb81 1132->1134 1135 7ff6e216bb49-7ff6e216bb4b 1132->1135 1136 7ff6e216bb56-7ff6e216bb6d call 7ff6e2164ee8 call 7ff6e2164f08 call 7ff6e216a8e0 1134->1136 1137 7ff6e216bb83-7ff6e216bb8f call 7ff6e216d5fc 1134->1137 1138 7ff6e216bb4d-7ff6e216bb54 1135->1138 1139 7ff6e216bb72-7ff6e216bb78 1135->1139 1166 7ff6e216bd00 1136->1166 1145 7ff6e216bb94-7ff6e216bbab call 7ff6e216a948 * 2 1137->1145 1138->1136 1138->1139 1140 7ff6e216bbf8-7ff6e216bc0f 1139->1140 1143 7ff6e216bc8a-7ff6e216bc94 call 7ff6e217391c 1140->1143 1144 7ff6e216bc11-7ff6e216bc19 1140->1144 1155 7ff6e216bc9a-7ff6e216bcaf 1143->1155 1156 7ff6e216bd1e 1143->1156 1144->1143 1147 7ff6e216bc1b-7ff6e216bc1d 1144->1147 1168 7ff6e216bbad-7ff6e216bbc3 call 7ff6e2164f08 call 7ff6e2164ee8 1145->1168 1169 7ff6e216bbc8-7ff6e216bbf3 call 7ff6e216c284 1145->1169 1147->1143 1153 7ff6e216bc1f-7ff6e216bc35 1147->1153 1153->1143 1158 7ff6e216bc37-7ff6e216bc43 1153->1158 1155->1156 1160 7ff6e216bcb1-7ff6e216bcc3 GetConsoleMode 1155->1160 1164 7ff6e216bd23-7ff6e216bd43 ReadFile 1156->1164 1158->1143 1162 7ff6e216bc45-7ff6e216bc47 1158->1162 1160->1156 1165 7ff6e216bcc5-7ff6e216bccd 1160->1165 1162->1143 1167 7ff6e216bc49-7ff6e216bc61 1162->1167 1170 7ff6e216be3d-7ff6e216be46 GetLastError 1164->1170 1171 7ff6e216bd49-7ff6e216bd51 1164->1171 1165->1164 1174 7ff6e216bccf-7ff6e216bcf1 ReadConsoleW 1165->1174 1177 7ff6e216bd03-7ff6e216bd0d call 7ff6e216a948 1166->1177 1167->1143 1178 7ff6e216bc63-7ff6e216bc6f 1167->1178 1168->1166 1169->1140 1175 7ff6e216be48-7ff6e216be5e call 7ff6e2164f08 call 7ff6e2164ee8 1170->1175 1176 7ff6e216be63-7ff6e216be66 1170->1176 1171->1170 1172 7ff6e216bd57 1171->1172 1180 7ff6e216bd5e-7ff6e216bd73 1172->1180 1182 7ff6e216bd12-7ff6e216bd1c 1174->1182 1183 7ff6e216bcf3 GetLastError 1174->1183 1175->1166 1187 7ff6e216be6c-7ff6e216be6e 1176->1187 1188 7ff6e216bcf9-7ff6e216bcfb call 7ff6e2164e7c 1176->1188 1177->1128 1178->1143 1186 7ff6e216bc71-7ff6e216bc73 1178->1186 1180->1177 1190 7ff6e216bd75-7ff6e216bd80 1180->1190 1182->1180 1183->1188 1186->1143 1194 7ff6e216bc75-7ff6e216bc85 1186->1194 1187->1177 1188->1166 1197 7ff6e216bda7-7ff6e216bdaf 1190->1197 1198 7ff6e216bd82-7ff6e216bd9b call 7ff6e216b674 1190->1198 1194->1143 1201 7ff6e216be2b-7ff6e216be38 call 7ff6e216b4b4 1197->1201 1202 7ff6e216bdb1-7ff6e216bdc3 1197->1202 1205 7ff6e216bda0-7ff6e216bda2 1198->1205 1201->1205 1206 7ff6e216bdc5 1202->1206 1207 7ff6e216be1e-7ff6e216be26 1202->1207 1205->1177 1209 7ff6e216bdca-7ff6e216bdd1 1206->1209 1207->1177 1210 7ff6e216be0d-7ff6e216be18 1209->1210 1211 7ff6e216bdd3-7ff6e216bdd7 1209->1211 1210->1207 1212 7ff6e216bdd9-7ff6e216bde0 1211->1212 1213 7ff6e216bdf3 1211->1213 1212->1213 1214 7ff6e216bde2-7ff6e216bde6 1212->1214 1215 7ff6e216bdf9-7ff6e216be09 1213->1215 1214->1213 1217 7ff6e216bde8-7ff6e216bdf1 1214->1217 1215->1209 1216 7ff6e216be0b 1215->1216 1216->1207 1217->1215
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                              • Opcode ID: fe76644ed600cf537c3c6f178a4f6dddc7bb94aee2e0e4a7e52e493d4ee37ba5
                                                                                                                                                                                                              • Instruction ID: 492d430053e0d7cf1c2dbfa9cb2693a0f9569cbe61735da1678834133986f1ef
                                                                                                                                                                                                              • Opcode Fuzzy Hash: fe76644ed600cf537c3c6f178a4f6dddc7bb94aee2e0e4a7e52e493d4ee37ba5
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8AC1F033D2868681E6608B1590803FD6B52EB81B98F550131EB4ED7791CEFFE745870A
                                                                                                                                                                                                              Function 00007FF6E2156360 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CurrentProcess
                                                                                                                                                                                                              • String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
                                                                                                                                                                                                              • API String ID: 2050909247-2434346643
                                                                                                                                                                                                              • Opcode ID: 111e0a7e53993944da2df5d9c96cd3a7cea32e86f931b773c4ccd6a62d35c348
                                                                                                                                                                                                              • Instruction ID: 84dfabfa2e4160157d9ad71bf816a0cd209270ee4612bdaf5a531836c02179d0
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 111e0a7e53993944da2df5d9c96cd3a7cea32e86f931b773c4ccd6a62d35c348
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 24419223E5868691EA21DB20E4143E96352FF94388F900172EB5DC32D9EFBDE705C786
                                                                                                                                                                                                              Function 00007FF6E2165628 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1279662727-0
                                                                                                                                                                                                              • Opcode ID: b1746a8a916bbf96797ffba89da9809a683c49b2a7b1d8f7dd6efe5c63c8eb6a
                                                                                                                                                                                                              • Instruction ID: 4c8c9976b9b00495593ec1a5b1f6a18b4f3f91f93af2ad3f720d123519577c2e
                                                                                                                                                                                                              • Opcode Fuzzy Hash: b1746a8a916bbf96797ffba89da9809a683c49b2a7b1d8f7dd6efe5c63c8eb6a
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1B41B233D2878293E3108B20D5903BD6262FB943A8F108334E79C83AD1DFADA2E08745
                                                                                                                                                                                                              Function 00007FF8A92D14BF Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 243COMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 1771 7ff8a92d14bf-7ff8a932ed94 call 7ff8a92d132a * 2 1778 7ff8a932f0ea-7ff8a932f104 1771->1778 1779 7ff8a932ed9a-7ff8a932edb1 call 7ff8a934ce5b SetLastError 1771->1779 1782 7ff8a932edb3-7ff8a932edba 1779->1782 1783 7ff8a932edc1-7ff8a932edc8 1779->1783 1782->1783 1784 7ff8a932edca-7ff8a932edce 1783->1784 1785 7ff8a932edd6-7ff8a932ede0 1783->1785 1786 7ff8a932edf2-7ff8a932edf7 1784->1786 1787 7ff8a932edd0-7ff8a932edd4 1784->1787 1785->1786 1788 7ff8a932ede2-7ff8a932edec call 7ff8a92d192e 1785->1788 1789 7ff8a932edf9-7ff8a932edfc 1786->1789 1790 7ff8a932ee03 1786->1790 1787->1785 1787->1786 1788->1778 1788->1786 1792 7ff8a932edfe 1789->1792 1793 7ff8a932ee07-7ff8a932ee0e 1789->1793 1790->1793 1795 7ff8a932eff3 1792->1795 1796 7ff8a932ee10-7ff8a932ee17 1793->1796 1797 7ff8a932ee51-7ff8a932ee66 1793->1797 1798 7ff8a932eff7-7ff8a932effa 1795->1798 1799 7ff8a932ee19-7ff8a932ee20 1796->1799 1800 7ff8a932ee43-7ff8a932ee4b 1796->1800 1801 7ff8a932ee68-7ff8a932ee72 1797->1801 1802 7ff8a932eeb5-7ff8a932eebf 1797->1802 1803 7ff8a932f019-7ff8a932f01c 1798->1803 1804 7ff8a932effc-7ff8a932efff call 7ff8a932e8a0 1798->1804 1799->1800 1805 7ff8a932ee22-7ff8a932ee31 1799->1805 1800->1797 1806 7ff8a932eecd-7ff8a932eee3 call 7ff8a92d20d6 1801->1806 1808 7ff8a932ee74-7ff8a932ee77 1801->1808 1802->1806 1807 7ff8a932eec1-7ff8a932eecb call 7ff8a934cd9b 1802->1807 1812 7ff8a932f01e-7ff8a932f021 call 7ff8a932f2d0 1803->1812 1813 7ff8a932f055-7ff8a932f059 1803->1813 1820 7ff8a932f004-7ff8a932f007 1804->1820 1805->1800 1810 7ff8a932ee33-7ff8a932ee3a 1805->1810 1832 7ff8a932eef1-7ff8a932eef8 1806->1832 1833 7ff8a932eee5-7ff8a932eeef call 7ff8a934cd9b 1806->1833 1830 7ff8a932ee8a-7ff8a932eeb0 call 7ff8a934cda1 call 7ff8a92d1d93 1807->1830 1815 7ff8a932ee79-7ff8a932ee7e 1808->1815 1816 7ff8a932ee80-7ff8a932ee85 call 7ff8a934cd9b 1808->1816 1810->1800 1821 7ff8a932ee3c-7ff8a932ee41 1810->1821 1831 7ff8a932f026-7ff8a932f029 1812->1831 1818 7ff8a932f05b-7ff8a932f05e 1813->1818 1819 7ff8a932f060-7ff8a932f08d call 7ff8a934cd9b call 7ff8a934cda1 call 7ff8a92d1d93 1813->1819 1815->1806 1815->1816 1816->1830 1818->1819 1826 7ff8a932f092-7ff8a932f0b7 call 7ff8a934cd9b call 7ff8a934cda1 1818->1826 1819->1826 1828 7ff8a932f00d-7ff8a932f017 1820->1828 1829 7ff8a932f0c0 1820->1829 1821->1797 1821->1800 1826->1829 1871 7ff8a932f0bb call 7ff8a934cda7 1826->1871 1839 7ff8a932f048-7ff8a932f04e 1828->1839 1841 7ff8a932f0c3-7ff8a932f0d1 call 7ff8a934d2c3 1829->1841 1830->1841 1842 7ff8a932f02b-7ff8a932f036 1831->1842 1843 7ff8a932f038-7ff8a932f03b 1831->1843 1835 7ff8a932eefa-7ff8a932ef05 call 7ff8a934d85d 1832->1835 1836 7ff8a932ef3e-7ff8a932ef48 call 7ff8a92d2086 1832->1836 1833->1830 1861 7ff8a932ef16-7ff8a932ef26 call 7ff8a934cd95 1835->1861 1862 7ff8a932ef07-7ff8a932ef11 call 7ff8a934cd9b 1835->1862 1859 7ff8a932ef4a-7ff8a932ef4f call 7ff8a934cd9b 1836->1859 1860 7ff8a932ef7f-7ff8a932ef97 call 7ff8a92d1fff 1836->1860 1839->1798 1850 7ff8a932f050-7ff8a932f053 1839->1850 1841->1778 1866 7ff8a932f0d3-7ff8a932f0e1 1841->1866 1842->1839 1843->1829 1846 7ff8a932f041 1843->1846 1846->1839 1850->1829 1878 7ff8a932ef54-7ff8a932ef7a call 7ff8a934cda1 call 7ff8a92d1d93 1859->1878 1881 7ff8a932ef99-7ff8a932efa3 call 7ff8a934cd9b 1860->1881 1882 7ff8a932efa5-7ff8a932efa9 1860->1882 1879 7ff8a932ef28-7ff8a932ef32 call 7ff8a934cd9b 1861->1879 1880 7ff8a932ef37 1861->1880 1862->1830 1872 7ff8a932f0e8 1866->1872 1873 7ff8a932f0e3 1866->1873 1871->1829 1872->1778 1873->1872 1878->1829 1879->1830 1880->1836 1881->1878 1883 7ff8a932efab-7ff8a932efaf 1882->1883 1884 7ff8a932efb1-7ff8a932efb8 1882->1884 1883->1884 1889 7ff8a932efba-7ff8a932efc7 call 7ff8a92d186b 1883->1889 1884->1889 1890 7ff8a932efe6-7ff8a932efee 1884->1890 1889->1841 1897 7ff8a932efcd-7ff8a932efd4 1889->1897 1890->1795 1898 7ff8a932efdf 1897->1898 1899 7ff8a932efd6-7ff8a932efdd 1897->1899 1898->1890 1899->1890 1899->1898
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2186211945.00007FF8A92D1000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FF8A92D0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186182358.00007FF8A92D0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9353000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9355000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A937D000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9388000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9393000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186542599.00007FF8A9397000.00000080.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186571704.00007FF8A9398000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff8a92d0000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ErrorLast
                                                                                                                                                                                                              • String ID: ..\s\ssl\statem\statem.c$state_machine
                                                                                                                                                                                                              • API String ID: 1452528299-1722249466
                                                                                                                                                                                                              • Opcode ID: fa1af6e95ef90c32761611ab3741ed222fae2e63033c217ccf4e575d4f6d4e5b
                                                                                                                                                                                                              • Instruction ID: d123407b77e0adf5bd8a256a9fc4e54f465dc355e93162094eb7ebf8c679b6a4
                                                                                                                                                                                                              • Opcode Fuzzy Hash: fa1af6e95ef90c32761611ab3741ed222fae2e63033c217ccf4e575d4f6d4e5b
                                                                                                                                                                                                              • Instruction Fuzzy Hash: A6A18F32A0EAC2A5FBB49E2594417BD32B9EF61BC4F146431DA0DC6689CF7DE8818741
                                                                                                                                                                                                              Function 00007FF8A92D14EC Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 206COMMON
                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 1900 7ff8a92d14ec-7ff8a9317d64 call 7ff8a92d132a 1904 7ff8a9317d6a-7ff8a9317d72 1900->1904 1905 7ff8a9317e24 1900->1905 1906 7ff8a9317d81-7ff8a9317da1 1904->1906 1907 7ff8a9317d74-7ff8a9317d7b call 7ff8a92d1852 1904->1907 1908 7ff8a9317e26-7ff8a9317e42 1905->1908 1910 7ff8a9317dcb-7ff8a9317de0 1906->1910 1911 7ff8a9317da3-7ff8a9317da6 1906->1911 1907->1906 1919 7ff8a9317ebe-7ff8a9317ec3 1907->1919 1915 7ff8a9317de2-7ff8a9317de7 1910->1915 1916 7ff8a9317e07-7ff8a9317e18 1910->1916 1913 7ff8a9317da8 1911->1913 1914 7ff8a9317daf-7ff8a9317dc4 1911->1914 1913->1914 1914->1910 1915->1916 1920 7ff8a9317de9-7ff8a9317e00 call 7ff8a934f30c 1915->1920 1917 7ff8a9317e1a-7ff8a9317e1d 1916->1917 1918 7ff8a9317e4d-7ff8a9317e50 1916->1918 1921 7ff8a9317e1f-7ff8a9317e22 1917->1921 1922 7ff8a9317e43-7ff8a9317e46 1917->1922 1923 7ff8a9317e79-7ff8a9317e8a 1918->1923 1924 7ff8a9317e52-7ff8a9317e77 1918->1924 1919->1908 1920->1916 1921->1905 1921->1918 1922->1924 1926 7ff8a9317e48-7ff8a9317e4b 1922->1926 1927 7ff8a9317ec8-7ff8a9317ecf 1923->1927 1928 7ff8a9317e8c-7ff8a9317eb9 call 7ff8a934cd9b call 7ff8a934cda1 call 7ff8a92d1d93 1923->1928 1924->1908 1926->1924 1930 7ff8a9317eda-7ff8a9317edd 1927->1930 1931 7ff8a9317ed1-7ff8a9317ed3 1927->1931 1928->1919 1934 7ff8a9317edf-7ff8a9317ee2 1930->1934 1935 7ff8a9317ee4-7ff8a9317eeb 1930->1935 1931->1930 1933 7ff8a9317ed5-7ff8a9317ed8 1931->1933 1937 7ff8a9317ef0-7ff8a9317f02 SetLastError 1933->1937 1934->1937 1935->1937 1939 7ff8a9317f08-7ff8a9317f1c call 7ff8a934ce43 1937->1939 1940 7ff8a9318007-7ff8a9318039 call 7ff8a934cd9b call 7ff8a934cda1 call 7ff8a92d1d93 1937->1940 1946 7ff8a9317f21-7ff8a9317f26 1939->1946 1962 7ff8a931803e-7ff8a931804c 1940->1962 1948 7ff8a9317f28 1946->1948 1949 7ff8a9317f2b 1946->1949 1948->1949 1951 7ff8a9317f2d-7ff8a9317f3f 1949->1951 1952 7ff8a9317f81-7ff8a9317f91 call 7ff8a934ce3d 1949->1952 1955 7ff8a9317f41-7ff8a9317f44 1951->1955 1956 7ff8a9317f46-7ff8a9317f49 1951->1956 1952->1962 1963 7ff8a9317f97-7ff8a9317fab call 7ff8a934cdfb 1952->1963 1955->1956 1959 7ff8a9317f4d 1955->1959 1956->1937 1960 7ff8a9317f4b 1956->1960 1961 7ff8a9317f50-7ff8a9317f7c 1959->1961 1960->1961 1961->1908 1965 7ff8a931804e-7ff8a931805d 1962->1965 1966 7ff8a9318070-7ff8a9318072 1962->1966 1963->1962 1969 7ff8a9317fb1-7ff8a9317fb8 1963->1969 1965->1966 1968 7ff8a931805f-7ff8a9318066 1965->1968 1966->1908 1968->1966 1970 7ff8a9318068-7ff8a931806b call 7ff8a92d1988 1968->1970 1971 7ff8a9317fba-7ff8a9317fd1 call 7ff8a92d1c49 1969->1971 1972 7ff8a9317fd3-7ff8a9318005 call 7ff8a934cd9b call 7ff8a934cda1 call 7ff8a92d1d93 1969->1972 1970->1966 1971->1962 1972->1962
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2186211945.00007FF8A92D1000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FF8A92D0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186182358.00007FF8A92D0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9353000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9355000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A937D000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9388000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9393000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186542599.00007FF8A9397000.00000080.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186571704.00007FF8A9398000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff8a92d0000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ErrorLast
                                                                                                                                                                                                              • String ID: ..\s\ssl\record\rec_layer_s3.c$ssl3_read_n
                                                                                                                                                                                                              • API String ID: 1452528299-4226281315
                                                                                                                                                                                                              • Opcode ID: d94d605e0c3c7615078f9d1603b74134fba96d51f0d75133064dff5826735a27
                                                                                                                                                                                                              • Instruction ID: b788c8311bf5e94cf6bc29961f3b7605b0f0a5b93bd8906fb20a6767b7047b27
                                                                                                                                                                                                              • Opcode Fuzzy Hash: d94d605e0c3c7615078f9d1603b74134fba96d51f0d75133064dff5826735a27
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 72919231A0EAC6A6FB509F25D4407B966B0EF44BC4F686131DE4D8BAA9EF78D8458310
                                                                                                                                                                                                              Function 00007FF6E215CC3C Relevance: 4.6, APIs: 3, Instructions: 94COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3251591375-0
                                                                                                                                                                                                              • Opcode ID: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
                                                                                                                                                                                                              • Instruction ID: c146bd5e7abf35718aaa6020d33936ce2044c7f1bb20c4d66abb7160ae859cec
                                                                                                                                                                                                              • Opcode Fuzzy Hash: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9E310823E8814742FA14AB65D4613F91683AF9538CF4454B4DB0EC72E3DEAFA704824B
                                                                                                                                                                                                              Function 00007FF6E2169A30 Relevance: 4.5, APIs: 3, Instructions: 14COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1703294689-0
                                                                                                                                                                                                              • Opcode ID: 148d460979eed4a43ebbf671c65dc2dc638c0d89c9c01e8e00358d5495882c84
                                                                                                                                                                                                              • Instruction ID: 70789bed07e5b05ce9050992da6ebba834131a8f4610f79bd5c3d0b5dfc5e63c
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 148d460979eed4a43ebbf671c65dc2dc638c0d89c9c01e8e00358d5495882c84
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 12D06722F1870643EA142B70A8992FD12976F89719B141438CA0BC6393DEAFAB49424B
                                                                                                                                                                                                              Function 00007FF6E216013C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                              • Opcode ID: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
                                                                                                                                                                                                              • Instruction ID: 30c3763d89886e07d4315b4f6fe4fda6d624e3a475df585e20560161f028a5ef
                                                                                                                                                                                                              • Opcode Fuzzy Hash: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4B51A533E29241C6E6249A2594407FE6692BF44BACF184638DF6DC37C5CEFED641860A
                                                                                                                                                                                                              Function 00007FF6E216C134 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ErrorFileLastPointer
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2976181284-0
                                                                                                                                                                                                              • Opcode ID: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
                                                                                                                                                                                                              • Instruction ID: fc239428f3a6f8c1d01bab348f449e7ef3cfe90046669e426bd1b90bc14303dc
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
                                                                                                                                                                                                              • Instruction Fuzzy Hash: BF11D332A18A4181DA208B15E8442AD6262AB51BF8F540331EB7DC77D4CEBDD2508705
                                                                                                                                                                                                              Function 00007FF6E216A948 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • RtlFreeHeap.NTDLL(?,?,?,00007FF6E2172D22,?,?,?,00007FF6E2172D5F,?,?,00000000,00007FF6E2173225,?,?,?,00007FF6E2173157), ref: 00007FF6E216A95E
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF6E2172D22,?,?,?,00007FF6E2172D5F,?,?,00000000,00007FF6E2173225,?,?,?,00007FF6E2173157), ref: 00007FF6E216A968
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 485612231-0
                                                                                                                                                                                                              • Opcode ID: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
                                                                                                                                                                                                              • Instruction ID: 2b7bb5caf54601de81718cb3568a320cb6d12908abee972b8ace5ab0a43008a3
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7BE08622F2920282FF155BF1D4953FD12536FC5B08F450030CB0EC2291DEAE6B81831A
                                                                                                                                                                                                              Function 00007FF6E216AB58 Relevance: 2.6, APIs: 2, Instructions: 59COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?,?,?,00007FF6E216A9D5,?,?,00000000,00007FF6E216AA8A), ref: 00007FF6E216ABC6
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF6E216A9D5,?,?,00000000,00007FF6E216AA8A), ref: 00007FF6E216ABD0
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CloseErrorHandleLast
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 918212764-0
                                                                                                                                                                                                              • Opcode ID: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
                                                                                                                                                                                                              • Instruction ID: 8af83a48d930e2481a7f8504f8b280fc53c269beb8ca2e5512b1937eac560a3d
                                                                                                                                                                                                              • Opcode Fuzzy Hash: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
                                                                                                                                                                                                              • Instruction Fuzzy Hash: AE218033F2868641EAA0575194D03FD16839F84799F084239DB2EC77D1CEEEE645430A
                                                                                                                                                                                                              Function 00007FF6E216BEAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                              • Opcode ID: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
                                                                                                                                                                                                              • Instruction ID: bc4c7fcf9ad18f5357ab9ef51cba9ed6663c0d754578cc927a6373d5b4e39766
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7D41B333D2824187EA248B19A5903BD77A2EB55748F140131DB8FD36D1CFAEE702CB56
                                                                                                                                                                                                              Function 00007FF8A932EC4C Relevance: 1.6, APIs: 1, Instructions: 337COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2186211945.00007FF8A92D1000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FF8A92D0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186182358.00007FF8A92D0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9353000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9355000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A937D000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9388000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9393000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186542599.00007FF8A9397000.00000080.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186571704.00007FF8A9398000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff8a92d0000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ErrorLast
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1452528299-0
                                                                                                                                                                                                              • Opcode ID: aea56f64fe44ad7b0340a1766d39962d55ffaa5f78c982329402f1f7499899da
                                                                                                                                                                                                              • Instruction ID: f0eea199c81feaa4f10038f3e24fb7ebd0eb46651664c6a123000a19f44e4c09
                                                                                                                                                                                                              • Opcode Fuzzy Hash: aea56f64fe44ad7b0340a1766d39962d55ffaa5f78c982329402f1f7499899da
                                                                                                                                                                                                              • Instruction Fuzzy Hash: FF31E532A0EB91AAE7649E25945127D33B5EF64FC4F589435DE08C7685CF3DE842C740
                                                                                                                                                                                                              Function 00007FF6E2157F90 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _fread_nolock
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 840049012-0
                                                                                                                                                                                                              • Opcode ID: 6c0febe66f3eebf5cf339e545fce04fb5f711a7807da0d6a964a5ed0356a8643
                                                                                                                                                                                                              • Instruction ID: 109f8931e339dbb2203410112c125ae6b6be11d81210b76afb8625317c638c7a
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6c0febe66f3eebf5cf339e545fce04fb5f711a7807da0d6a964a5ed0356a8643
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 64219322F5865586EB509B2274043FA9642BF45BC8F894570EF0DC7786DEFEE281C20A
                                                                                                                                                                                                              Function 00007FF6E216B93C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                              • Opcode ID: c2d01373d3233558d420055387ebca2c39d1ce99b2c1a08127fa32cb0ba5fec2
                                                                                                                                                                                                              • Instruction ID: 194d74d16e6a73733035c7f928ed1f22a79c56efce7a1825664ded22063e102f
                                                                                                                                                                                                              • Opcode Fuzzy Hash: c2d01373d3233558d420055387ebca2c39d1ce99b2c1a08127fa32cb0ba5fec2
                                                                                                                                                                                                              • Instruction Fuzzy Hash: A0314F73E3860285E6215F5584813FD2692AB80B98F510135EB5ED73D2CEFEE741871B
                                                                                                                                                                                                              Function 00007FF6E2169961 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: HandleModule$AddressFreeLibraryProc
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3947729631-0
                                                                                                                                                                                                              • Opcode ID: 42808d7c08696a35870eb95595f0ae95ff90971c005bfc8769c42bb91e99b0de
                                                                                                                                                                                                              • Instruction ID: 8b86f537d065719becd4bb556afaaf2c0d4318d5edcd1b0ce627b8a4d048b6a3
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 42808d7c08696a35870eb95595f0ae95ff90971c005bfc8769c42bb91e99b0de
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 60214873E24A458AEB248F64C4803EC32A1FB4471CF44463AD76D86A95DFB99688C746
                                                                                                                                                                                                              Function 00007FF6E2165F94 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                              • Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
                                                                                                                                                                                                              • Instruction ID: 76f563a76c1fed680811b9f7e66cad760f45e5995727c7e35f74b097dceb3ff8
                                                                                                                                                                                                              • Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0F119633E3C64285EE609F5194803FDA666BF85B88F544431EB4CD7A96CFBED600874A
                                                                                                                                                                                                              Function 00007FF6E2176354 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                              • Opcode ID: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
                                                                                                                                                                                                              • Instruction ID: f238275630b9d07fa206712b732f1cd0be768266f3d93338a05784b6060caf09
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
                                                                                                                                                                                                              • Instruction Fuzzy Hash: EF219033A18A8186DB608F18D4803AA77A2BBC5B98F144234E75EC66D9DF7ED901CB05
                                                                                                                                                                                                              Function 00007FF6E21603BC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                              • Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
                                                                                                                                                                                                              • Instruction ID: a8e9193938e96db4a6899d2125effc54e388453fb9c83d684b9fe25ccc9e535f
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
                                                                                                                                                                                                              • Instruction Fuzzy Hash: DF01C232E2874180E914DB5299402FDA692BF81FE8F484674EF5CD3BD6CEBED6018305
                                                                                                                                                                                                              Function 00007FF6E2158E80 Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 00007FF6E2159390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6E21545F4,00000000,00007FF6E2151985), ref: 00007FF6E21593C9
                                                                                                                                                                                                              • LoadLibraryExW.KERNEL32(?,00007FF6E2156476,?,00007FF6E215336E), ref: 00007FF6E2158EA2
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ByteCharLibraryLoadMultiWide
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2592636585-0
                                                                                                                                                                                                              • Opcode ID: 11a4aaaef8a7a10f6e0ce37232ac144c9e9b59754371ad75d1a790c2d21c933d
                                                                                                                                                                                                              • Instruction ID: 04f7785f0fad2aabdadc091da7c1a1fe39b4eaa8173f30ab995ec4bbd10ad322
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 11a4aaaef8a7a10f6e0ce37232ac144c9e9b59754371ad75d1a790c2d21c933d
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 54D08C12F3424542EA94A76BBA467AA5252AB8ABC4F888075EF0D83B8ADD3DC1414B04
                                                                                                                                                                                                              Function 00007FF8A92D1E01 Relevance: 1.3, APIs: 1, Instructions: 87COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2186211945.00007FF8A92D1000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FF8A92D0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186182358.00007FF8A92D0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9353000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9355000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A937D000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9388000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9393000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186542599.00007FF8A9397000.00000080.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186571704.00007FF8A9398000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff8a92d0000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ErrorLast
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1452528299-0
                                                                                                                                                                                                              • Opcode ID: 7996a06857c3f91e8426b2d630f3f6f22c05bb801b80ee25fc1232160325fa23
                                                                                                                                                                                                              • Instruction ID: d4ed2cc819a7e6d8b088ebd5ad0942470a0e97e548115825b46c034ed7f3a786
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7996a06857c3f91e8426b2d630f3f6f22c05bb801b80ee25fc1232160325fa23
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 68319232A0EA92AAF7749E25944127D72B5EF64BC4F149431DE0DC7685CF3DE882CB80
                                                                                                                                                                                                              Function 00007FF6E216D5FC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,?,?,00007FF6E2160C90,?,?,?,00007FF6E21622FA,?,?,?,?,?,00007FF6E2163AE9), ref: 00007FF6E216D63A
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: AllocHeap
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 4292702814-0
                                                                                                                                                                                                              • Opcode ID: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
                                                                                                                                                                                                              • Instruction ID: 1b729a97783a4f9e648918843534332faf5fb6e452d756187362e842679ca94b
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7EF05E22F2924245FE6417715C813FD11935FC57ACF084730DF2EC52C1DEAEA690825A

                                                                                                                                                                                                              Non-executed Functions

                                                                                                                                                                                                              Function 00007FF6E21589E0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257synchronizationwindowregistryCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
                                                                                                                                                                                                              • String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
                                                                                                                                                                                                              • API String ID: 3832162212-3165540532
                                                                                                                                                                                                              • Opcode ID: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
                                                                                                                                                                                                              • Instruction ID: d34f318321396c6ef3bccb8f269c3551d5259abaa500b26c299c64c913794145
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9FD13E32E08A8686E7109F34E8543EA2766FF8575CF400235DB5EC2AA4DFBDD7858705
                                                                                                                                                                                                              Function 00007FF8A82AFF00 Relevance: 20.0, APIs: 13, Instructions: 493COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2180285327.00007FF8A8261000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8260000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180246315.00007FF8A8260000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180285327.00007FF8A82B6000.00000040.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180285327.00007FF8A832D000.00000040.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182691075.00007FF8A832E000.00000080.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182728543.00007FF8A8330000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff8a8260000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: 00007$C6138$A2419
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2638009314-0
                                                                                                                                                                                                              • Opcode ID: 6aed54118feec531af873d9543ed006788bdddb699dcf0f01bbf85fdea2b84b3
                                                                                                                                                                                                              • Instruction ID: 912cbaaa8a104bdda652cea5361477d5fe0ffba889b82376cca36df9c99e48f3
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6aed54118feec531af873d9543ed006788bdddb699dcf0f01bbf85fdea2b84b3
                                                                                                                                                                                                              • Instruction Fuzzy Hash: CC22B032E16F859ADA1A8B2591443FAA365FF997C4F15C332DB8E27758DF3CE0428214
                                                                                                                                                                                                              Function 00007FF8A82AF450 Relevance: 20.0, APIs: 13, Instructions: 493COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2180285327.00007FF8A8261000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8260000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180246315.00007FF8A8260000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180285327.00007FF8A82B6000.00000040.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180285327.00007FF8A832D000.00000040.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182691075.00007FF8A832E000.00000080.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182728543.00007FF8A8330000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff8a8260000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: 00007$C6138$A2419
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2638009314-0
                                                                                                                                                                                                              • Opcode ID: 4ad74d6352975525fef7d118f1126785598b34d2acfb356d2fdbc403612dc115
                                                                                                                                                                                                              • Instruction ID: 4925fadc5e4f20c03fe978a2ecc2c17a0e18425246bb12840672b56e32ded2f5
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4ad74d6352975525fef7d118f1126785598b34d2acfb356d2fdbc403612dc115
                                                                                                                                                                                                              • Instruction Fuzzy Hash: CF22DF32A16F8596EA168B24D4503BAF369FF55BC4F158332DA8F27658DF3DE082C214
                                                                                                                                                                                                              Function 00007FF8A82A7010 Relevance: 18.4, APIs: 12, Instructions: 450COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • 00007FF8C6138E00.API-MS-WIN-CRT-MATH-L1-1-0(?,00007FF8A82ABE1A), ref: 00007FF8A82A7144
                                                                                                                                                                                                              • 00007FF8C6138E00.API-MS-WIN-CRT-MATH-L1-1-0(?,00007FF8A82ABE1A), ref: 00007FF8A82A71B0
                                                                                                                                                                                                              • 00007FF8C6138E00.API-MS-WIN-CRT-MATH-L1-1-0(?,00007FF8A82ABE1A), ref: 00007FF8A82A7209
                                                                                                                                                                                                              • 00007FF8C6138E00.API-MS-WIN-CRT-MATH-L1-1-0(?,00007FF8A82ABE1A), ref: 00007FF8A82A7274
                                                                                                                                                                                                              • 00007FF8C6138E00.API-MS-WIN-CRT-MATH-L1-1-0(?,00007FF8A82ABE1A), ref: 00007FF8A82A72DC
                                                                                                                                                                                                              • 00007FF8C6138E00.API-MS-WIN-CRT-MATH-L1-1-0(?,00007FF8A82ABE1A), ref: 00007FF8A82A7332
                                                                                                                                                                                                              • 00007FF8C6138E00.API-MS-WIN-CRT-MATH-L1-1-0(?,00007FF8A82ABE1A), ref: 00007FF8A82A73A4
                                                                                                                                                                                                              • 00007FF8C6138E00.API-MS-WIN-CRT-MATH-L1-1-0(?,00007FF8A82ABE1A), ref: 00007FF8A82A740E
                                                                                                                                                                                                              • 00007FF8C6138E00.API-MS-WIN-CRT-MATH-L1-1-0(?,00007FF8A82ABE1A), ref: 00007FF8A82A7465
                                                                                                                                                                                                              • 00007FF8C6138E00.API-MS-WIN-CRT-MATH-L1-1-0(?,00007FF8A82ABE1A), ref: 00007FF8A82A74E4
                                                                                                                                                                                                              • 00007FF8C6138E00.API-MS-WIN-CRT-MATH-L1-1-0(?,00007FF8A82ABE1A), ref: 00007FF8A82A754C
                                                                                                                                                                                                              • 00007FF8C6138E00.API-MS-WIN-CRT-MATH-L1-1-0(?,00007FF8A82ABE1A), ref: 00007FF8A82A75A2
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2180285327.00007FF8A8261000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8260000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180246315.00007FF8A8260000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180285327.00007FF8A82B6000.00000040.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180285327.00007FF8A832D000.00000040.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182691075.00007FF8A832E000.00000080.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182728543.00007FF8A8330000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff8a8260000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: 00007C6138
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2722774091-0
                                                                                                                                                                                                              • Opcode ID: 9849245b78ca4eb92c5d8d99ab215348344db1bea5ddf0a16522947d471a4013
                                                                                                                                                                                                              • Instruction ID: 3704e1ce48dcb127562c688967ca5ca4769059bfa45b5f8819c700ec5b490d73
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9849245b78ca4eb92c5d8d99ab215348344db1bea5ddf0a16522947d471a4013
                                                                                                                                                                                                              • Instruction Fuzzy Hash: AC02D132F5AE019EE607877481413BAE366EF257D4F46C332E94F37658EB386492C218
                                                                                                                                                                                                              Function 00007FF8A8143068 Relevance: 13.6, APIs: 9, Instructions: 72COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177832756.00007FF8A8141000.00000040.00000001.01000000.00000017.sdmp, Offset: 00007FF8A8140000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177799498.00007FF8A8140000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177832756.00007FF8A81A2000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177832756.00007FF8A81EE000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177832756.00007FF8A81F2000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177832756.00007FF8A81F7000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177832756.00007FF8A824F000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177832756.00007FF8A8254000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177832756.00007FF8A8257000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180094427.00007FF8A8258000.00000080.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180136487.00007FF8A825A000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff8a8140000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: 00007A2419ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3856421733-0
                                                                                                                                                                                                              • Opcode ID: 14da1239b2aff37f2225a2b2eb9612ff8327347efab586c9ed8106aec9f5eecf
                                                                                                                                                                                                              • Instruction ID: c5f89335ab15de04bbef502fad40ec2add565887463b7a0ee2362c5308048a00
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 14da1239b2aff37f2225a2b2eb9612ff8327347efab586c9ed8106aec9f5eecf
                                                                                                                                                                                                              • Instruction Fuzzy Hash: B431A2B661AB81D6EB619F60E8507ED3360FB84788F44443ADA4E47B99DF3CC548C724
                                                                                                                                                                                                              Function 00007FF6E21583C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • FindFirstFileW.KERNEL32(?,00007FF6E2158919,00007FF6E2153F9D), ref: 00007FF6E215842B
                                                                                                                                                                                                              • RemoveDirectoryW.KERNEL32(?,00007FF6E2158919,00007FF6E2153F9D), ref: 00007FF6E21584AE
                                                                                                                                                                                                              • DeleteFileW.KERNEL32(?,00007FF6E2158919,00007FF6E2153F9D), ref: 00007FF6E21584CD
                                                                                                                                                                                                              • FindNextFileW.KERNEL32(?,00007FF6E2158919,00007FF6E2153F9D), ref: 00007FF6E21584DB
                                                                                                                                                                                                              • FindClose.KERNEL32(?,00007FF6E2158919,00007FF6E2153F9D), ref: 00007FF6E21584EC
                                                                                                                                                                                                              • RemoveDirectoryW.KERNEL32(?,00007FF6E2158919,00007FF6E2153F9D), ref: 00007FF6E21584F5
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
                                                                                                                                                                                                              • String ID: %s\*
                                                                                                                                                                                                              • API String ID: 1057558799-766152087
                                                                                                                                                                                                              • Opcode ID: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
                                                                                                                                                                                                              • Instruction ID: 9cecd306de45bf0d5a2691eabb3e9b2d1649b7ecf0d442e53a0356671f710a82
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
                                                                                                                                                                                                              • Instruction Fuzzy Hash: E5418F23E4C54681EA209F20F4483FA63A2FB95758F410272DB9EC26C4DFAED785C706
                                                                                                                                                                                                              Function 00007FF8A82A76B0 Relevance: 10.8, APIs: 7, Instructions: 267COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2180285327.00007FF8A8261000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8260000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180246315.00007FF8A8260000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180285327.00007FF8A82B6000.00000040.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180285327.00007FF8A832D000.00000040.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182691075.00007FF8A832E000.00000080.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182728543.00007FF8A8330000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff8a8260000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: 00007$C6138$A2419
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2638009314-0
                                                                                                                                                                                                              • Opcode ID: 2280084202c957317e2ddb1ec18dc6dfdd8b4049e1094c236acac9da9a2d9437
                                                                                                                                                                                                              • Instruction ID: 734187f3474326e0e5a7d1e26e61d478e2c08a7f1b9bf1f768664a86f8b0fe89
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2280084202c957317e2ddb1ec18dc6dfdd8b4049e1094c236acac9da9a2d9437
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 02B11621E1AE555DE607873481003BAE21AFF557D5F16C332E98F37788EB7CA582C218
                                                                                                                                                                                                              Function 00007FF8A8296F90 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 265COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2180285327.00007FF8A8261000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8260000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180246315.00007FF8A8260000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180285327.00007FF8A82B6000.00000040.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180285327.00007FF8A832D000.00000040.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182691075.00007FF8A832E000.00000080.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182728543.00007FF8A8330000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff8a8260000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: 00007$A2419C61203
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3549137889-2920267241
                                                                                                                                                                                                              • Opcode ID: 18535fbcc1c3291b499e8e54c5bbcc61516be26d48224b1c5d4ab9802cf573ba
                                                                                                                                                                                                              • Instruction ID: f88d9ad0dae37501b07e52020b3c4baf64e49924310dec37adfeee410230582a
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 18535fbcc1c3291b499e8e54c5bbcc61516be26d48224b1c5d4ab9802cf573ba
                                                                                                                                                                                                              • Instruction Fuzzy Hash: C5C10372619BC496D660CB16F8807AAB7A8FB89BC4F544126EB8C43B59DF38C155CB04
                                                                                                                                                                                                              Function 00007FF8A92D2135 Relevance: 10.6, APIs: 7, Instructions: 73COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2186211945.00007FF8A92D1000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FF8A92D0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186182358.00007FF8A92D0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9353000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9355000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A937D000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9388000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9393000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186542599.00007FF8A9397000.00000080.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186571704.00007FF8A9398000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff8a92d0000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3140674995-0
                                                                                                                                                                                                              • Opcode ID: a32b81c2ff6dfccb19a9728fe67c5763d4d0aea259f9004b58da64eb6530d66a
                                                                                                                                                                                                              • Instruction ID: 0bd23a50453fb659f648ead88f654aeae05f26b8bd79584f015443373e0a7887
                                                                                                                                                                                                              • Opcode Fuzzy Hash: a32b81c2ff6dfccb19a9728fe67c5763d4d0aea259f9004b58da64eb6530d66a
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9B315C7661AEC1A9EB608F60E8403ED6370FB84785F445039DA4D87B98DF7CD648C714
                                                                                                                                                                                                              Function 00007FF6E215D12C Relevance: 10.6, APIs: 7, Instructions: 71COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3140674995-0
                                                                                                                                                                                                              • Opcode ID: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
                                                                                                                                                                                                              • Instruction ID: 7edca1d3394ab746c28357a8ee3b33e26f8d548fc3ccf9a36028711439e90a6f
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
                                                                                                                                                                                                              • Instruction Fuzzy Hash: E7315C73A09B8186EB608F60E8843EE3361FB95708F04403ADB4E87B94DF79D648C705
                                                                                                                                                                                                              Function 00007FF6E2175C00 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF6E2175C45
                                                                                                                                                                                                                • Part of subcall function 00007FF6E2175598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E21755AC
                                                                                                                                                                                                                • Part of subcall function 00007FF6E216A948: RtlFreeHeap.NTDLL(?,?,?,00007FF6E2172D22,?,?,?,00007FF6E2172D5F,?,?,00000000,00007FF6E2173225,?,?,?,00007FF6E2173157), ref: 00007FF6E216A95E
                                                                                                                                                                                                                • Part of subcall function 00007FF6E216A948: GetLastError.KERNEL32(?,?,?,00007FF6E2172D22,?,?,?,00007FF6E2172D5F,?,?,00000000,00007FF6E2173225,?,?,?,00007FF6E2173157), ref: 00007FF6E216A968
                                                                                                                                                                                                                • Part of subcall function 00007FF6E216A900: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF6E216A8DF,?,?,?,?,?,00007FF6E216A7CA), ref: 00007FF6E216A909
                                                                                                                                                                                                                • Part of subcall function 00007FF6E216A900: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6E216A8DF,?,?,?,?,?,00007FF6E216A7CA), ref: 00007FF6E216A92E
                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF6E2175C34
                                                                                                                                                                                                                • Part of subcall function 00007FF6E21755F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E217560C
                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF6E2175EAA
                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF6E2175EBB
                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF6E2175ECC
                                                                                                                                                                                                              • GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6E217610C), ref: 00007FF6E2175EF3
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 4070488512-0
                                                                                                                                                                                                              • Opcode ID: 677ea417f3249c8bdb60afb6413c0575e0f743ff33606516b420b369f71394b1
                                                                                                                                                                                                              • Instruction ID: c21f94be5ef94d7bb4a99adc6697a178678c1d8f23b357d24c335c03a63720ff
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 677ea417f3249c8bdb60afb6413c0575e0f743ff33606516b420b369f71394b1
                                                                                                                                                                                                              • Instruction Fuzzy Hash: DAD1BC23E1824296E7249F25D8803F96762EBC6788F448035EF0DC76D5DFBEE641874A
                                                                                                                                                                                                              Function 00007FF8A828F620 Relevance: 9.2, APIs: 6, Instructions: 245COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2180285327.00007FF8A8261000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8260000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180246315.00007FF8A8260000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180285327.00007FF8A82B6000.00000040.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180285327.00007FF8A832D000.00000040.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182691075.00007FF8A832E000.00000080.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182728543.00007FF8A8330000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff8a8260000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: 00007$A2419$C6138
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3559315223-0
                                                                                                                                                                                                              • Opcode ID: 4d5f8cb658c489e435210d4949c78672a3c0ff4360f256d3127a63e6ec7d7eb5
                                                                                                                                                                                                              • Instruction ID: 9792dee4f3cd5ecdb8d32ccfac13feb05c835e586a537583c648937177ee32df
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4d5f8cb658c489e435210d4949c78672a3c0ff4360f256d3127a63e6ec7d7eb5
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7BA1F722A19FC5A9EA128B35A4007BAB755FF967C4F048332DE4E27659DF3CE086C714
                                                                                                                                                                                                              Function 00007FF8A8290F00 Relevance: 9.2, APIs: 6, Instructions: 239COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2180285327.00007FF8A8261000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8260000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180246315.00007FF8A8260000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180285327.00007FF8A82B6000.00000040.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180285327.00007FF8A832D000.00000040.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182691075.00007FF8A832E000.00000080.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182728543.00007FF8A8330000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff8a8260000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: 00007$A2419$C6138
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3559315223-0
                                                                                                                                                                                                              • Opcode ID: bead9de0f35735378f23ea55d365871010558179f8230bb8be135924470135c2
                                                                                                                                                                                                              • Instruction ID: ce78683a43679cfcf34a19926a24d2a1df44ce04f4428851d18b86a3fb8c1bbe
                                                                                                                                                                                                              • Opcode Fuzzy Hash: bead9de0f35735378f23ea55d365871010558179f8230bb8be135924470135c2
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 77A11422A19FC599E6128B75A4007BAB765FF967C4F448232DE8E27658DF3CE082C714
                                                                                                                                                                                                              Function 00007FF8A8292750 Relevance: 9.2, APIs: 6, Instructions: 239COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2180285327.00007FF8A8261000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8260000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180246315.00007FF8A8260000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180285327.00007FF8A82B6000.00000040.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180285327.00007FF8A832D000.00000040.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182691075.00007FF8A832E000.00000080.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182728543.00007FF8A8330000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff8a8260000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: 00007$A2419$C6138
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3559315223-0
                                                                                                                                                                                                              • Opcode ID: ae739e9c8768b61d34a53e8380dbf225ba3c88fc2270ed3bf18cf53171ac132b
                                                                                                                                                                                                              • Instruction ID: 35a2587b568c5b0d307a3e334c6b8bf2a4c7d844a6a29f630e5242fe0eda6a21
                                                                                                                                                                                                              • Opcode Fuzzy Hash: ae739e9c8768b61d34a53e8380dbf225ba3c88fc2270ed3bf18cf53171ac132b
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 18A12522A1AFC599E6128B35A4003BAB755FF967C0F048332DE5E27659DF3CE082C714
                                                                                                                                                                                                              Function 00007FF6E216A614 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1239891234-0
                                                                                                                                                                                                              • Opcode ID: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
                                                                                                                                                                                                              • Instruction ID: 2dbbba5189a78a9a9ec759c725910a8f6a79c7b8fb61533b103f6baa5aee0b4a
                                                                                                                                                                                                              • Opcode Fuzzy Hash: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 78316B33A18B8186DB208B25E8843EE73A5FB99758F540135EB8EC3B94DF7DD2458B05
                                                                                                                                                                                                              Function 00007FF8A92D1CC1 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 292COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2186211945.00007FF8A92D1000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FF8A92D0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186182358.00007FF8A92D0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9353000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9355000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A937D000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9388000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9393000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186542599.00007FF8A9397000.00000080.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186571704.00007FF8A9398000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff8a92d0000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID: ..\s\ssl\statem\statem_srvr.c$construct_stateful_ticket$resumption$tls_construct_new_session_ticket
                                                                                                                                                                                                              • API String ID: 0-1194634662
                                                                                                                                                                                                              • Opcode ID: 96c2b8e8d74ccfb18905530cb5a97d3460de52489f7ac5e01577cab4798c2ebd
                                                                                                                                                                                                              • Instruction ID: 9e3b6017e4befeede0524a36f8868dc621f02f565ed366503de6d16410cbe901
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 96c2b8e8d74ccfb18905530cb5a97d3460de52489f7ac5e01577cab4798c2ebd
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 78D17E22A0EAC2A5FB509F26D8406E977A0EBC5BC9F495036EE4C8775ADF7CE541C700
                                                                                                                                                                                                              Function 00007FF8A828E0E0 Relevance: 7.9, APIs: 5, Instructions: 359COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • 00007FF8C6138E00.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000100,?), ref: 00007FF8A828E391
                                                                                                                                                                                                              • 00007FF8C6138E00.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000100,?), ref: 00007FF8A828E415
                                                                                                                                                                                                              • 00007FF8C6138E00.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000100,?), ref: 00007FF8A828E5A1
                                                                                                                                                                                                              • 00007FF8C6138E00.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000100,?), ref: 00007FF8A828E600
                                                                                                                                                                                                              • 00007FF8C6138E00.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000100,?), ref: 00007FF8A828E650
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2180285327.00007FF8A8261000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8260000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180246315.00007FF8A8260000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180285327.00007FF8A82B6000.00000040.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180285327.00007FF8A832D000.00000040.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182691075.00007FF8A832E000.00000080.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182728543.00007FF8A8330000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff8a8260000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: 00007C6138
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2722774091-0
                                                                                                                                                                                                              • Opcode ID: a405a8573ef0059d34fbf0adc7b897dd3450eafbcd56fe8aba266c0f98d92266
                                                                                                                                                                                                              • Instruction ID: 9ee85514e41694e553ae0f3e4a66fe60a3c272adfd43d2676eed7b13b4ab4050
                                                                                                                                                                                                              • Opcode Fuzzy Hash: a405a8573ef0059d34fbf0adc7b897dd3450eafbcd56fe8aba266c0f98d92266
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 27E1FA35F19E855AFA17973890003B9A356FFA67D4F158332D94F33758EB3CA4828614
                                                                                                                                                                                                              Function 00007FF6E2171874 Relevance: 7.8, APIs: 5, Instructions: 282COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: FileFindFirst_invalid_parameter_noinfo
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2227656907-0
                                                                                                                                                                                                              • Opcode ID: 471de8175ffa50438b20796c5ba06e190623de8bcba55c14971da5e7bf2bc1ae
                                                                                                                                                                                                              • Instruction ID: 6c393394069bc4215b11d833ee78c6cce62ca57a7224454f15f98c1ffa4e4691
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 471de8175ffa50438b20796c5ba06e190623de8bcba55c14971da5e7bf2bc1ae
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 28B1C323F1868241EA609B25D4003F963A2EB86BE8F485131DF4DC7BC5EEBDE641C305
                                                                                                                                                                                                              Function 00007FF8A92D1EE7 Relevance: 7.5, APIs: 1, Strings: 3, Instructions: 461COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2186211945.00007FF8A92D1000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FF8A92D0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186182358.00007FF8A92D0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9353000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9355000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A937D000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9388000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9393000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186542599.00007FF8A9397000.00000080.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186571704.00007FF8A9398000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff8a92d0000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: 00007C61208
                                                                                                                                                                                                              • String ID: ..\s\ssl\statem\extensions_srvr.c$D:\a\1\s\include\internal/packet.h$tls_parse_ctos_psk
                                                                                                                                                                                                              • API String ID: 3535234312-3130753023
                                                                                                                                                                                                              • Opcode ID: 7627f31dee975c6d768a394e5d6b8bcbc2deb779cee5e3752deeb65e0231a3f5
                                                                                                                                                                                                              • Instruction ID: 7401c00cf95b337987a87be284aa7da7cd48beb98fbf319b99afac4f36e274ba
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7627f31dee975c6d768a394e5d6b8bcbc2deb779cee5e3752deeb65e0231a3f5
                                                                                                                                                                                                              • Instruction Fuzzy Hash: A512A162A0EEC261F7509F6594446BEB7B1EF91BC4F046032EE4D87A9ADF7CE5418700
                                                                                                                                                                                                              Function 00007FF8A82A7AF0 Relevance: 6.2, APIs: 4, Instructions: 169COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2180285327.00007FF8A8261000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8260000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180246315.00007FF8A8260000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180285327.00007FF8A82B6000.00000040.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180285327.00007FF8A832D000.00000040.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182691075.00007FF8A832E000.00000080.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182728543.00007FF8A8330000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff8a8260000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: 00007$C6138$A2419
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2638009314-0
                                                                                                                                                                                                              • Opcode ID: 356486f7cd09bba83d452288d2f2bf37ab3cbbea5aa855d9c4ad7cdf557bac0d
                                                                                                                                                                                                              • Instruction ID: 1526b07bc9ae380ca30f61cb21f01535dfc50263ff8e568e2f8591ec67a3c35a
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 356486f7cd09bba83d452288d2f2bf37ab3cbbea5aa855d9c4ad7cdf557bac0d
                                                                                                                                                                                                              • Instruction Fuzzy Hash: BF613962F0AE855DE927873491013BAE256EFA57D4F05C332DA8F36A48EF2DA042C51C
                                                                                                                                                                                                              Function 00007FF8A82A0650 Relevance: 6.2, APIs: 4, Instructions: 160COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2180285327.00007FF8A8261000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8260000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180246315.00007FF8A8260000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180285327.00007FF8A82B6000.00000040.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180285327.00007FF8A832D000.00000040.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182691075.00007FF8A832E000.00000080.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182728543.00007FF8A8330000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff8a8260000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: 00007$C6138$A2419
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2638009314-0
                                                                                                                                                                                                              • Opcode ID: 5b56463fd863cf154fbcd706ef899aa10349edf28a230e844891e3160064b196
                                                                                                                                                                                                              • Instruction ID: 399ef060f5005f9e02a89be54d43e02eeeaf998a58fb83e604669d812cf7da68
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5b56463fd863cf154fbcd706ef899aa10349edf28a230e844891e3160064b196
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3B512721F1AE459DE507863881113BAE25AEF657D4E15C332E94F33A59DF3DB083C918
                                                                                                                                                                                                              Function 00007FF6E2175E7C Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF6E2175EAA
                                                                                                                                                                                                                • Part of subcall function 00007FF6E21755F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E217560C
                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF6E2175EBB
                                                                                                                                                                                                                • Part of subcall function 00007FF6E2175598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E21755AC
                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF6E2175ECC
                                                                                                                                                                                                                • Part of subcall function 00007FF6E21755C8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E21755DC
                                                                                                                                                                                                                • Part of subcall function 00007FF6E216A948: RtlFreeHeap.NTDLL(?,?,?,00007FF6E2172D22,?,?,?,00007FF6E2172D5F,?,?,00000000,00007FF6E2173225,?,?,?,00007FF6E2173157), ref: 00007FF6E216A95E
                                                                                                                                                                                                                • Part of subcall function 00007FF6E216A948: GetLastError.KERNEL32(?,?,?,00007FF6E2172D22,?,?,?,00007FF6E2172D5F,?,?,00000000,00007FF6E2173225,?,?,?,00007FF6E2173157), ref: 00007FF6E216A968
                                                                                                                                                                                                              • GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6E217610C), ref: 00007FF6E2175EF3
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3458911817-0
                                                                                                                                                                                                              • Opcode ID: 179af59534a267e8b56f66eebf2dbf2058aebcf107c16e98e161f461d30bd41f
                                                                                                                                                                                                              • Instruction ID: 99d2a59c9df3fa0981c408bdb53a70e523697dc7540e0f17aadc0cc14e9d67e3
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 179af59534a267e8b56f66eebf2dbf2058aebcf107c16e98e161f461d30bd41f
                                                                                                                                                                                                              • Instruction Fuzzy Hash: C8519B33E0864286E720DF25D8813E96762FB89788F404135EB0DC36D5DFBEE600874A
                                                                                                                                                                                                              Function 00007FF8A92D24EB Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 332COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2186211945.00007FF8A92D1000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FF8A92D0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186182358.00007FF8A92D0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9353000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9355000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A937D000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9388000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9393000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186542599.00007FF8A9397000.00000080.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186571704.00007FF8A9398000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff8a92d0000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: 00007C61208
                                                                                                                                                                                                              • String ID: ..\s\ssl\statem\extensions_clnt.c$tls_construct_ctos_psk
                                                                                                                                                                                                              • API String ID: 3535234312-446233508
                                                                                                                                                                                                              • Opcode ID: b36fb01384b575ec35d89c0d8260da8a6938daa3986464ee3d691d16473f4eab
                                                                                                                                                                                                              • Instruction ID: 3881f91dc36888f0b5ac0332b3bdbf3d23cce3b9fe631f1a687120347af98623
                                                                                                                                                                                                              • Opcode Fuzzy Hash: b36fb01384b575ec35d89c0d8260da8a6938daa3986464ee3d691d16473f4eab
                                                                                                                                                                                                              • Instruction Fuzzy Hash: D5E1A061A0EAC2A2FB549F15A8406BA77A4EF94FC4F441036EE4DC7A8ADF7CE501C700
                                                                                                                                                                                                              Function 00007FF6E2155830 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF6E21564CF,?,00007FF6E215336E), ref: 00007FF6E2155840
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00007FF6E21564CF,?,00007FF6E215336E), ref: 00007FF6E2155852
                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF6E21564CF,?,00007FF6E215336E), ref: 00007FF6E2155889
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00007FF6E21564CF,?,00007FF6E215336E), ref: 00007FF6E215589B
                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF6E21564CF,?,00007FF6E215336E), ref: 00007FF6E21558B4
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00007FF6E21564CF,?,00007FF6E215336E), ref: 00007FF6E21558C6
                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF6E21564CF,?,00007FF6E215336E), ref: 00007FF6E21558DF
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00007FF6E21564CF,?,00007FF6E215336E), ref: 00007FF6E21558F1
                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF6E21564CF,?,00007FF6E215336E), ref: 00007FF6E215590D
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00007FF6E21564CF,?,00007FF6E215336E), ref: 00007FF6E215591F
                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF6E21564CF,?,00007FF6E215336E), ref: 00007FF6E215593B
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00007FF6E21564CF,?,00007FF6E215336E), ref: 00007FF6E215594D
                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF6E21564CF,?,00007FF6E215336E), ref: 00007FF6E2155969
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00007FF6E21564CF,?,00007FF6E215336E), ref: 00007FF6E215597B
                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF6E21564CF,?,00007FF6E215336E), ref: 00007FF6E2155997
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00007FF6E21564CF,?,00007FF6E215336E), ref: 00007FF6E21559A9
                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF6E21564CF,?,00007FF6E215336E), ref: 00007FF6E21559C5
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00007FF6E21564CF,?,00007FF6E215336E), ref: 00007FF6E21559D7
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: AddressErrorLastProc
                                                                                                                                                                                                              • String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
                                                                                                                                                                                                              • API String ID: 199729137-653951865
                                                                                                                                                                                                              • Opcode ID: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
                                                                                                                                                                                                              • Instruction ID: 61912f7acd12f7028def84b506919813b99d23d3d85f1c986a977b6d58bc4d6c
                                                                                                                                                                                                              • Opcode Fuzzy Hash: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9922B366D49B07A1FA558B55E8147F422A3BF8674DF541035C61FC22A0FFFEA788830A
                                                                                                                                                                                                              Function 00007FF6E21576C0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: AddressErrorLastProc
                                                                                                                                                                                                              • String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                                                                                                                                                              • API String ID: 199729137-3427451314
                                                                                                                                                                                                              • Opcode ID: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
                                                                                                                                                                                                              • Instruction ID: d4fcec3a5ca4f9591e8bb36d8304c89a6795169d3bb1fb21de402dbcca68c2b9
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
                                                                                                                                                                                                              • Instruction Fuzzy Hash: D702BD22D4DB0B81FA159B55E8157F422B3BF8675CF440071D62EC22A4EFBEB349824A
                                                                                                                                                                                                              Function 00007FF6E21581D0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 00007FF6E2159390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6E21545F4,00000000,00007FF6E2151985), ref: 00007FF6E21593C9
                                                                                                                                                                                                              • ExpandEnvironmentStringsW.KERNEL32(?,00007FF6E21586B7,?,?,00000000,00007FF6E2153CBB), ref: 00007FF6E215822C
                                                                                                                                                                                                                • Part of subcall function 00007FF6E2152810: MessageBoxW.USER32 ref: 00007FF6E21528EA
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
                                                                                                                                                                                                              • String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
                                                                                                                                                                                                              • API String ID: 1662231829-930877121
                                                                                                                                                                                                              • Opcode ID: d247d3a0ca85f1815ed913d402e51827366718a31552b00c9fe28dde0a2555e6
                                                                                                                                                                                                              • Instruction ID: 742266539339f380f7d01bb8cc031d0b1cb4cf8df55caaf7343e42ed436f9aba
                                                                                                                                                                                                              • Opcode Fuzzy Hash: d247d3a0ca85f1815ed913d402e51827366718a31552b00c9fe28dde0a2555e6
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0B51C613E6C64641FA509B24E8513FA2292AF9478CF444431DB0EC26D5EFBEE744C34A
                                                                                                                                                                                                              Function 00007FF6E2151600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CurrentProcess
                                                                                                                                                                                                              • String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                                                                                                                                                                                              • API String ID: 2050909247-1550345328
                                                                                                                                                                                                              • Opcode ID: 7b3dbec223ebe4a5612306ee09dd1c56cff58f7effc42cf14bd45051afb99717
                                                                                                                                                                                                              • Instruction ID: 14f70254904721b0c814fe08b53c9a12940062c80676413d58f49948e9547f18
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7b3dbec223ebe4a5612306ee09dd1c56cff58f7effc42cf14bd45051afb99717
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5F51AC63E4864282EA11AB55D4402E92393BF8179CF484571EF1DC77D2DFBEE744830A
                                                                                                                                                                                                              Function 00007FF8A92E5CA0 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 101COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2186211945.00007FF8A92D1000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FF8A92D0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186182358.00007FF8A92D0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9353000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9355000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A937D000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9388000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9393000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186542599.00007FF8A9397000.00000080.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186571704.00007FF8A9398000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff8a92d0000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: 00007C6126570
                                                                                                                                                                                                              • String ID: ..\s\ssl\ssl_ciph.c$ECDHE-ECDSA-AES128-GCM-SHA256$ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384$ECDHE-ECDSA-AES256-GCM-SHA384$SUITEB128$SUITEB128C2$SUITEB128ONLY$SUITEB192$check_suiteb_cipher_list
                                                                                                                                                                                                              • API String ID: 800424832-1099454403
                                                                                                                                                                                                              • Opcode ID: 4fb00667328cc24e5a01ced80a969a7b37fcff98c645767f26b4f54dc518abc7
                                                                                                                                                                                                              • Instruction ID: c563ee35b0c5614965acc9c9b6318722f8a54a8b21b8a48516029118308d5d9f
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4fb00667328cc24e5a01ced80a969a7b37fcff98c645767f26b4f54dc518abc7
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1E416135A2EA82AAFB149F14E89077827B1EB487C4F445435EA1DC7698EF6CE550C701
                                                                                                                                                                                                              Function 00007FF6E2152180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: MoveWindow$ObjectSelect$DrawReleaseText
                                                                                                                                                                                                              • String ID: P%
                                                                                                                                                                                                              • API String ID: 2147705588-2959514604
                                                                                                                                                                                                              • Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
                                                                                                                                                                                                              • Instruction ID: 88934d0cb49f134a6707a2c70a978a97294f9114fbb6d15c30608fcc9f30caa8
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 36511627A04BA186D6249F22E4182BAB7A2FB98B65F004131EFDFC3694DF7CD145CB14
                                                                                                                                                                                                              Function 00007FF6E21580C0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: LongWindow$BlockCreateErrorLastReasonShutdown
                                                                                                                                                                                                              • String ID: Needs to remove its temporary files.
                                                                                                                                                                                                              • API String ID: 3975851968-2863640275
                                                                                                                                                                                                              • Opcode ID: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
                                                                                                                                                                                                              • Instruction ID: 05de7c8ada41b03055de0bd0b14ba55dc046350cd25bbd3725ebefc9006d3b17
                                                                                                                                                                                                              • Opcode Fuzzy Hash: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0D217322F48A4681E6418B7AF8443A96252BF89B98F594130DB1EC33D4DEADD7808306
                                                                                                                                                                                                              Function 00007FF8A8142740 Relevance: 16.7, APIs: 11, Instructions: 230COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177832756.00007FF8A8141000.00000040.00000001.01000000.00000017.sdmp, Offset: 00007FF8A8140000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177799498.00007FF8A8140000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177832756.00007FF8A81A2000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177832756.00007FF8A81EE000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177832756.00007FF8A81F2000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177832756.00007FF8A81F7000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177832756.00007FF8A824F000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177832756.00007FF8A8254000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177832756.00007FF8A8257000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180094427.00007FF8A8258000.00000080.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180136487.00007FF8A825A000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff8a8140000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 349153199-0
                                                                                                                                                                                                              • Opcode ID: ba629577db6599826cb9fb44cf19b8c727e776d8ab71a1e0ce86f35fe3adb7c8
                                                                                                                                                                                                              • Instruction ID: 108b3856c62005933313071864958c6f4c4a9b3eb4e7fc63b751647b053e23c1
                                                                                                                                                                                                              • Opcode Fuzzy Hash: ba629577db6599826cb9fb44cf19b8c727e776d8ab71a1e0ce86f35fe3adb7c8
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0B81C0E9E1E243F6FA669B6694412B922D0EF957C0F148135D90C837A6DF7CE885C338
                                                                                                                                                                                                              Function 00007FF6E2166290 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                              • String ID: -$:$f$p$p
                                                                                                                                                                                                              • API String ID: 3215553584-2013873522
                                                                                                                                                                                                              • Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
                                                                                                                                                                                                              • Instruction ID: e5618eb1ce352b458c9695171c1a42a65443f160b02f216b9756641bcd42cc2d
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4B1291B3E2928386FB245A14A1843FD7757EB40798F844135D789C66C4DFBEE6808B4A
                                                                                                                                                                                                              Function 00007FF6E2160FC8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                              • String ID: f$f$p$p$f
                                                                                                                                                                                                              • API String ID: 3215553584-1325933183
                                                                                                                                                                                                              • Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
                                                                                                                                                                                                              • Instruction ID: 012b4fa190d1dc8efa997cde36dcfe31ac972b722b789b4e8db7d436b7d9d1fa
                                                                                                                                                                                                              • Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9F126173E2814385FB209A1590943FE66A3FB40758F8C4135D79AC6BC4DFBEE6408B4A
                                                                                                                                                                                                              Function 00007FF6E2151050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CurrentProcess
                                                                                                                                                                                                              • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                              • API String ID: 2050909247-3659356012
                                                                                                                                                                                                              • Opcode ID: c7bb58550f5bcf0f519764ea051c05a3a8a65a2fbe38e578e675a30a6b1f643e
                                                                                                                                                                                                              • Instruction ID: 1b4945884bc05787d5cbd5d763a2a2da40c4ec091888413efe6f6bcb72c90348
                                                                                                                                                                                                              • Opcode Fuzzy Hash: c7bb58550f5bcf0f519764ea051c05a3a8a65a2fbe38e578e675a30a6b1f643e
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 84418E23E1825285EA11DB21D8407F96393BF45B88F5844B1EF0DC7785DEBEE301874A
                                                                                                                                                                                                              Function 00007FF6E2158660 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetTempPathW.KERNEL32(?,?,00000000,00007FF6E2153CBB), ref: 00007FF6E2158704
                                                                                                                                                                                                              • GetCurrentProcessId.KERNEL32(?,00000000,00007FF6E2153CBB), ref: 00007FF6E215870A
                                                                                                                                                                                                              • CreateDirectoryW.KERNEL32(?,00000000,00007FF6E2153CBB), ref: 00007FF6E215874C
                                                                                                                                                                                                                • Part of subcall function 00007FF6E2158830: GetEnvironmentVariableW.KERNEL32(00007FF6E215388E), ref: 00007FF6E2158867
                                                                                                                                                                                                                • Part of subcall function 00007FF6E2158830: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF6E2158889
                                                                                                                                                                                                                • Part of subcall function 00007FF6E2168238: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E2168251
                                                                                                                                                                                                                • Part of subcall function 00007FF6E2152810: MessageBoxW.USER32 ref: 00007FF6E21528EA
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
                                                                                                                                                                                                              • String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
                                                                                                                                                                                                              • API String ID: 3563477958-1339014028
                                                                                                                                                                                                              • Opcode ID: 881e4fca8e19ec4ab2ebb52834f4ac375ff8f2bae867f31c8bf391ae1f14406c
                                                                                                                                                                                                              • Instruction ID: b6b1e06ab56150865575e8018c6460c5ad60f7de8c75506e6a76c0b049cfb0fc
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 881e4fca8e19ec4ab2ebb52834f4ac375ff8f2bae867f31c8bf391ae1f14406c
                                                                                                                                                                                                              • Instruction Fuzzy Hash: DE41B523E2964644EA20AB65A8513F91293AF857CCF810071DF0DC77DADEBED745C24A
                                                                                                                                                                                                              Function 00007FF6E215EA08 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                                                                                                                                                              • String ID: csm$csm$csm
                                                                                                                                                                                                              • API String ID: 849930591-393685449
                                                                                                                                                                                                              • Opcode ID: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
                                                                                                                                                                                                              • Instruction ID: e873157a30fdeca8cc168d8440ee694608d8766e394dd7dd1580fce55440d0fc
                                                                                                                                                                                                              • Opcode Fuzzy Hash: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 22D15A23E48B418AEB209B6594403ED77A2FB4578CF100175EB4DD7B96DFBAE680C706
                                                                                                                                                                                                              Function 00007FF8A92D2545 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 206COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2186211945.00007FF8A92D1000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FF8A92D0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186182358.00007FF8A92D0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9353000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9355000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A937D000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9388000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9393000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186542599.00007FF8A9397000.00000080.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186571704.00007FF8A9398000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff8a92d0000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: 00007A3420ErrorLast
                                                                                                                                                                                                              • String ID: %s/%s$..\s\ssl\ssl_cert.c$SSL_add_dir_cert_subjects_to_stack$SSL_add_file_cert_subjects_to_stack$calling OPENSSL_dir_read(%s)
                                                                                                                                                                                                              • API String ID: 3659664395-502574948
                                                                                                                                                                                                              • Opcode ID: de604455da3dd15423185ed5a6f4ce6acae7e7dc6e9530e8d9251f24d1117e73
                                                                                                                                                                                                              • Instruction ID: 7345cad3d571278f04232ff17b7caedcb894e581a66e2e929ef26e2ed57736a5
                                                                                                                                                                                                              • Opcode Fuzzy Hash: de604455da3dd15423185ed5a6f4ce6acae7e7dc6e9530e8d9251f24d1117e73
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 64917551A0EAC265FA50AF15A8517FE66A0EFC57C1F416031EA5EC7B9ADF3CE501C700
                                                                                                                                                                                                              Function 00007FF6E2152C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF6E2153706,?,00007FF6E2153804), ref: 00007FF6E2152C9E
                                                                                                                                                                                                              • FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6E2153706,?,00007FF6E2153804), ref: 00007FF6E2152D63
                                                                                                                                                                                                              • MessageBoxW.USER32 ref: 00007FF6E2152D99
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Message$CurrentFormatProcess
                                                                                                                                                                                                              • String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
                                                                                                                                                                                                              • API String ID: 3940978338-251083826
                                                                                                                                                                                                              • Opcode ID: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
                                                                                                                                                                                                              • Instruction ID: 408ea30f5687263fdc0cccce5ffd321b9b69d55d8b90508c40bea3a33e5b9d72
                                                                                                                                                                                                              • Opcode Fuzzy Hash: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7531B423F08A4142E6209B65E8543EA6692BF8879CF414136EF4ED3799DF7ED706C305
                                                                                                                                                                                                              Function 00007FF8A92D1497 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 306COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2186211945.00007FF8A92D1000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FF8A92D0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186182358.00007FF8A92D0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9353000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9355000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A937D000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9388000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9393000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186542599.00007FF8A9397000.00000080.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186571704.00007FF8A9398000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff8a92d0000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID: $..\s\ssl\statem\extensions_srvr.c$HMAC$SHA2-256$tls_construct_stoc_cookie
                                                                                                                                                                                                              • API String ID: 0-1087561517
                                                                                                                                                                                                              • Opcode ID: d743759746665b7db7d4fba4d59fd9459b03d2bc73fc4485894cad057df26e57
                                                                                                                                                                                                              • Instruction ID: ead0aa2a9f34a8e4f9ee522bbab56783cc3dc0d1038c0b2f615b5f4fd38e7af6
                                                                                                                                                                                                              • Opcode Fuzzy Hash: d743759746665b7db7d4fba4d59fd9459b03d2bc73fc4485894cad057df26e57
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 17D15A65B0EAC365FB54AE629A543F922B5EF957C4F046032DE0EC7B8ADE3DE4058310
                                                                                                                                                                                                              Function 00007FF8A92D26F8 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 257COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2186211945.00007FF8A92D1000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FF8A92D0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186182358.00007FF8A92D0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9353000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9355000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A937D000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9388000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9393000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186542599.00007FF8A9397000.00000080.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186571704.00007FF8A9398000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff8a92d0000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID: ..\s\ssl\ssl_rsa.c$SERVERINFO FOR $SERVERINFOV2 FOR $SSL_CTX_use_serverinfo_file
                                                                                                                                                                                                              • API String ID: 0-2528746747
                                                                                                                                                                                                              • Opcode ID: d40431e4e7c82da1deeb9ad1052418d7cfdc64fe3625217e02e6807bcc9b9d45
                                                                                                                                                                                                              • Instruction ID: 7d93c594285485eb41571532b4c50df7720580f1e26013cf6aaf0d504d12f946
                                                                                                                                                                                                              • Opcode Fuzzy Hash: d40431e4e7c82da1deeb9ad1052418d7cfdc64fe3625217e02e6807bcc9b9d45
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 01B1AD61B0EAC2B5FB109F61D8401FD67B5EF847C4F415032DA1D87A9AEE7CEA4A8350
                                                                                                                                                                                                              Function 00007FF6E215DCC8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • LoadLibraryExW.KERNEL32(?,?,?,00007FF6E215DF7A,?,?,?,00007FF6E215DC6C,?,?,?,00007FF6E215D869), ref: 00007FF6E215DD4D
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF6E215DF7A,?,?,?,00007FF6E215DC6C,?,?,?,00007FF6E215D869), ref: 00007FF6E215DD5B
                                                                                                                                                                                                              • LoadLibraryExW.KERNEL32(?,?,?,00007FF6E215DF7A,?,?,?,00007FF6E215DC6C,?,?,?,00007FF6E215D869), ref: 00007FF6E215DD85
                                                                                                                                                                                                              • FreeLibrary.KERNEL32(?,?,?,00007FF6E215DF7A,?,?,?,00007FF6E215DC6C,?,?,?,00007FF6E215D869), ref: 00007FF6E215DDF3
                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,?,?,00007FF6E215DF7A,?,?,?,00007FF6E215DC6C,?,?,?,00007FF6E215D869), ref: 00007FF6E215DDFF
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                                                                                                                              • String ID: api-ms-
                                                                                                                                                                                                              • API String ID: 2559590344-2084034818
                                                                                                                                                                                                              • Opcode ID: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
                                                                                                                                                                                                              • Instruction ID: 95c771cabec28a3c76d36ac7e20500f862dbc6daecf9879bc77e05ec1bd34e95
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1F31A323F5A64291EE119B0298007F52396FF49BA8F594575DF1EC63C0EFBEE6448309
                                                                                                                                                                                                              Function 00007FF6E2152A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF6E215351A,?,00000000,00007FF6E2153F1B), ref: 00007FF6E2152AA0
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CurrentProcess
                                                                                                                                                                                                              • String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
                                                                                                                                                                                                              • API String ID: 2050909247-2900015858
                                                                                                                                                                                                              • Opcode ID: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
                                                                                                                                                                                                              • Instruction ID: d410375d5844b05b3e0a0b63bbb84c81e7df705f1da650f82dbebd82308e0af6
                                                                                                                                                                                                              • Opcode Fuzzy Hash: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2B219C33A18B8192E6209B50F8807EA6395FB88388F400136FF8DC3699DFBDD345C645
                                                                                                                                                                                                              Function 00007FF6E2158570 Relevance: 10.6, APIs: 7, Instructions: 63COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 995526605-0
                                                                                                                                                                                                              • Opcode ID: f75ab0f0843ea553283f31270fa2e47dd05c34398218a1d4d57149fb78d89f01
                                                                                                                                                                                                              • Instruction ID: 4323e6d103b4b3498319d9643d724ab856bddbdb4d8cd012e415deaf337ec80e
                                                                                                                                                                                                              • Opcode Fuzzy Hash: f75ab0f0843ea553283f31270fa2e47dd05c34398218a1d4d57149fb78d89f01
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 17216432E0C64641EB108B59F4443AAA3A2FFC17A8F500235E76DC3AD4DFADD6458745
                                                                                                                                                                                                              Function 00007FF6E216B150 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Value$ErrorLast
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2506987500-0
                                                                                                                                                                                                              • Opcode ID: bd40692f84e3da01acd5c9e715af8932c2ff4b5b564443a413d720313231dc09
                                                                                                                                                                                                              • Instruction ID: e1f3f71c3256f02eeca3c5fe9d79638161f450e54d9cd9ed07e66eaafeb849b9
                                                                                                                                                                                                              • Opcode Fuzzy Hash: bd40692f84e3da01acd5c9e715af8932c2ff4b5b564443a413d720313231dc09
                                                                                                                                                                                                              • Instruction Fuzzy Hash: ED216032F2C24241F9586325A5D13BD61835F547A8F104634EB2FD66C6DEAEE700430A
                                                                                                                                                                                                              Function 00007FF6E2177D6C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                                                                                                              • String ID: CONOUT$
                                                                                                                                                                                                              • API String ID: 3230265001-3130406586
                                                                                                                                                                                                              • Opcode ID: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
                                                                                                                                                                                                              • Instruction ID: dcd3743cc3b5115fc1c7fa79a171efcc07351f497d9f4dd2a899ab9b274a87fd
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
                                                                                                                                                                                                              • Instruction Fuzzy Hash: C911B422E18B4586E3508B12F8443A962A1FB89BE8F000234EB5EC77E4CFBDD6408709
                                                                                                                                                                                                              Function 00007FF6E2158ED0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetCurrentProcess.KERNEL32(?,FFFFFFFF,00000000,00007FF6E2153FA9), ref: 00007FF6E2158EFD
                                                                                                                                                                                                              • K32EnumProcessModules.KERNEL32(?,FFFFFFFF,00000000,00007FF6E2153FA9), ref: 00007FF6E2158F5A
                                                                                                                                                                                                                • Part of subcall function 00007FF6E2159390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6E21545F4,00000000,00007FF6E2151985), ref: 00007FF6E21593C9
                                                                                                                                                                                                              • K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF6E2153FA9), ref: 00007FF6E2158FE5
                                                                                                                                                                                                              • K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF6E2153FA9), ref: 00007FF6E2159044
                                                                                                                                                                                                              • FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF6E2153FA9), ref: 00007FF6E2159055
                                                                                                                                                                                                              • FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF6E2153FA9), ref: 00007FF6E215906A
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3462794448-0
                                                                                                                                                                                                              • Opcode ID: b9812aa4a412ff6f242132f81c88a7c8c76a4ef9029947ab8fd2a45bc25d6007
                                                                                                                                                                                                              • Instruction ID: 3bbcc77cdc3df311cdc1a10fd410afcfe26ab2058134a3a5b6f53534ec5cbeba
                                                                                                                                                                                                              • Opcode Fuzzy Hash: b9812aa4a412ff6f242132f81c88a7c8c76a4ef9029947ab8fd2a45bc25d6007
                                                                                                                                                                                                              • Instruction Fuzzy Hash: E541BF63E1968281EA309B12A4403EA7396FF85B88F040535DF4DD7789DFBEE600C74A
                                                                                                                                                                                                              Function 00007FF6E21590E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 00007FF6E2158570: GetCurrentProcess.KERNEL32 ref: 00007FF6E2158590
                                                                                                                                                                                                                • Part of subcall function 00007FF6E2158570: OpenProcessToken.ADVAPI32 ref: 00007FF6E21585A3
                                                                                                                                                                                                                • Part of subcall function 00007FF6E2158570: GetTokenInformation.ADVAPI32 ref: 00007FF6E21585C8
                                                                                                                                                                                                                • Part of subcall function 00007FF6E2158570: GetLastError.KERNEL32 ref: 00007FF6E21585D2
                                                                                                                                                                                                                • Part of subcall function 00007FF6E2158570: GetTokenInformation.ADVAPI32 ref: 00007FF6E2158612
                                                                                                                                                                                                                • Part of subcall function 00007FF6E2158570: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6E215862E
                                                                                                                                                                                                                • Part of subcall function 00007FF6E2158570: CloseHandle.KERNEL32 ref: 00007FF6E2158646
                                                                                                                                                                                                              • LocalFree.KERNEL32(?,00007FF6E2153C55), ref: 00007FF6E215916C
                                                                                                                                                                                                              • LocalFree.KERNEL32(?,00007FF6E2153C55), ref: 00007FF6E2159175
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                                                                                                                                                              • String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
                                                                                                                                                                                                              • API String ID: 6828938-1529539262
                                                                                                                                                                                                              • Opcode ID: 0222097b9c90264a1a2c87a2a2fde68e1a94831f5278aced0db9eca26447961c
                                                                                                                                                                                                              • Instruction ID: ca79256b2201b0e9c25f9119f18bf51f1d685f183fb2bcda15a90feb3d907493
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0222097b9c90264a1a2c87a2a2fde68e1a94831f5278aced0db9eca26447961c
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 29217E23E0874281F610AB50E8553EA62A2FF89788F444071EB4DC37C6DFBEDA44C786
                                                                                                                                                                                                              Function 00007FF6E216B2C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF6E2164F11,?,?,?,?,00007FF6E216A48A,?,?,?,?,00007FF6E216718F), ref: 00007FF6E216B2D7
                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF6E2164F11,?,?,?,?,00007FF6E216A48A,?,?,?,?,00007FF6E216718F), ref: 00007FF6E216B30D
                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF6E2164F11,?,?,?,?,00007FF6E216A48A,?,?,?,?,00007FF6E216718F), ref: 00007FF6E216B33A
                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF6E2164F11,?,?,?,?,00007FF6E216A48A,?,?,?,?,00007FF6E216718F), ref: 00007FF6E216B34B
                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF6E2164F11,?,?,?,?,00007FF6E216A48A,?,?,?,?,00007FF6E216718F), ref: 00007FF6E216B35C
                                                                                                                                                                                                              • SetLastError.KERNEL32(?,?,?,00007FF6E2164F11,?,?,?,?,00007FF6E216A48A,?,?,?,?,00007FF6E216718F), ref: 00007FF6E216B377
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Value$ErrorLast
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2506987500-0
                                                                                                                                                                                                              • Opcode ID: 511c86220214880ca4b01c77dd55d0a7de68e458561f726588d357ec3f22002e
                                                                                                                                                                                                              • Instruction ID: 16a10d63207adc22c3bb300239f9f2e70efcc1cf03d7c7063759c06853195491
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 511c86220214880ca4b01c77dd55d0a7de68e458561f726588d357ec3f22002e
                                                                                                                                                                                                              • Instruction Fuzzy Hash: BE119F32F1D24282FA58672196C03BE61439F447B8F184334EB2FD66D6DEAEE700430A
                                                                                                                                                                                                              Function 00007FF6E2152910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF6E2151B6A), ref: 00007FF6E215295E
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CurrentProcess
                                                                                                                                                                                                              • String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
                                                                                                                                                                                                              • API String ID: 2050909247-2962405886
                                                                                                                                                                                                              • Opcode ID: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
                                                                                                                                                                                                              • Instruction ID: 71cb21cc6a58a64456ed1b702b27e08c55f404536c1603049c3abeaa767209fa
                                                                                                                                                                                                              • Opcode Fuzzy Hash: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6831CF23F1868552E7209B61E8403EA6296BF887DCF400132EF8DC3789EFBDD6468205
                                                                                                                                                                                                              Function 00007FF6E2152390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
                                                                                                                                                                                                              • String ID: Unhandled exception in script
                                                                                                                                                                                                              • API String ID: 3081866767-2699770090
                                                                                                                                                                                                              • Opcode ID: 3b326f38696452fedce944a8216705a7f012b21920c96e855d1ab8eaac442c5d
                                                                                                                                                                                                              • Instruction ID: 849c3f58384829ff7cfeba30aa173ef21e552655eba930a71104ec1a1cf440d6
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3b326f38696452fedce944a8216705a7f012b21920c96e855d1ab8eaac442c5d
                                                                                                                                                                                                              • Instruction Fuzzy Hash: C1314E33A1968189EB209B61E8553FA6361FB89788F440135EB4EC7B89DF7DD201C706
                                                                                                                                                                                                              Function 00007FF6E2152B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF6E215918F,?,00007FF6E2153C55), ref: 00007FF6E2152BA0
                                                                                                                                                                                                              • MessageBoxW.USER32 ref: 00007FF6E2152C2A
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CurrentMessageProcess
                                                                                                                                                                                                              • String ID: WARNING$Warning$[PYI-%d:%ls]
                                                                                                                                                                                                              • API String ID: 1672936522-3797743490
                                                                                                                                                                                                              • Opcode ID: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
                                                                                                                                                                                                              • Instruction ID: f80ca236a00fec59ac5b0ce53c18fdd0d264ef7476104678795712c2a9738008
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
                                                                                                                                                                                                              • Instruction Fuzzy Hash: B121AB23B18B4192E6209B64F8847EA63A6EB88788F400136EF8ED3659DF7DD305C745
                                                                                                                                                                                                              Function 00007FF6E2152710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF6E2151B99), ref: 00007FF6E2152760
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CurrentProcess
                                                                                                                                                                                                              • String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
                                                                                                                                                                                                              • API String ID: 2050909247-1591803126
                                                                                                                                                                                                              • Opcode ID: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
                                                                                                                                                                                                              • Instruction ID: 766b3b422a524bfc67e2a999ddb9f607e2575c0cc339977c4a5fddfe44dda2e4
                                                                                                                                                                                                              • Opcode Fuzzy Hash: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
                                                                                                                                                                                                              • Instruction Fuzzy Hash: B2217C33A19B8192E6209B50F8817EA6295AB88388F400135EF8DD3699DFBDD3458645
                                                                                                                                                                                                              Function 00007FF6E2169A88 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                              • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                              • API String ID: 4061214504-1276376045
                                                                                                                                                                                                              • Opcode ID: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
                                                                                                                                                                                                              • Instruction ID: 01cce14c2c4b0621e023387194d399c0e3c1086a117c2fb0d50a5dce569538c3
                                                                                                                                                                                                              • Opcode Fuzzy Hash: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 78F0C822F1870682EA148B14E4843BA23A1BF85768F540235C76FC55E4CFAED344C306
                                                                                                                                                                                                              Function 00007FF6E2179368 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _set_statfp
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1156100317-0
                                                                                                                                                                                                              • Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                                                                                                                                                              • Instruction ID: c026bc5a2a3f4ae08c8ee3aa24de6eef47dc0fd13eb4f178172b6a374bbe1b69
                                                                                                                                                                                                              • Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                                                                                                                                                              • Instruction Fuzzy Hash: F8116333D58A0201F6545179E4913FA1053BFDB37CE040634EB6ED72D68EEEAA49410A
                                                                                                                                                                                                              Function 00007FF6E216B390 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • FlsGetValue.KERNEL32(?,?,?,00007FF6E216A5A3,?,?,00000000,00007FF6E216A83E,?,?,?,?,?,00007FF6E216A7CA), ref: 00007FF6E216B3AF
                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF6E216A5A3,?,?,00000000,00007FF6E216A83E,?,?,?,?,?,00007FF6E216A7CA), ref: 00007FF6E216B3CE
                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF6E216A5A3,?,?,00000000,00007FF6E216A83E,?,?,?,?,?,00007FF6E216A7CA), ref: 00007FF6E216B3F6
                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF6E216A5A3,?,?,00000000,00007FF6E216A83E,?,?,?,?,?,00007FF6E216A7CA), ref: 00007FF6E216B407
                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF6E216A5A3,?,?,00000000,00007FF6E216A83E,?,?,?,?,?,00007FF6E216A7CA), ref: 00007FF6E216B418
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Value
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3702945584-0
                                                                                                                                                                                                              • Opcode ID: 6f944022d23edc1c4acf36ee41aa723466f994e0e1af3fb98e05b0010e79b0d5
                                                                                                                                                                                                              • Instruction ID: 8ad0cee34a8d24f256edbac3a4dbb1f7fc0c2a3141d8ce5c8b8b907849f8254e
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6f944022d23edc1c4acf36ee41aa723466f994e0e1af3fb98e05b0010e79b0d5
                                                                                                                                                                                                              • Instruction Fuzzy Hash: A3119032F2D64241FA58A72655C13FD61435F507B8F584334EB2FD6AC6DEAEE701820A
                                                                                                                                                                                                              Function 00007FF6E216B224 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Value
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3702945584-0
                                                                                                                                                                                                              • Opcode ID: cf61fb6c00b1796c5bed08ecf7b6551a73a14dc995a044f45feadad5ae41d3ad
                                                                                                                                                                                                              • Instruction ID: 3ccb892974351504738bdd24b510cd5146f760cc96a3bc38564a85b7cfc46b85
                                                                                                                                                                                                              • Opcode Fuzzy Hash: cf61fb6c00b1796c5bed08ecf7b6551a73a14dc995a044f45feadad5ae41d3ad
                                                                                                                                                                                                              • Instruction Fuzzy Hash: C811E332E2920641FAAC626144D13FD22834F55328F244738EB2EDA6C2DEAEB740420B
                                                                                                                                                                                                              Function 00007FF6E2165FA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                              • String ID: verbose
                                                                                                                                                                                                              • API String ID: 3215553584-579935070
                                                                                                                                                                                                              • Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
                                                                                                                                                                                                              • Instruction ID: e008a95b5d0d7ed475e2a57b24264cd6f9c3aa1ab4598e7231fb76c8958d64f6
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9B91D3B3E2868681E7208F25D4903BD3796AB80BD8F444135DB5DC33D5DEBEEA45834A
                                                                                                                                                                                                              Function 00007FF8A92FF1F0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 223COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2186211945.00007FF8A92D1000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FF8A92D0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186182358.00007FF8A92D0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9353000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9355000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A937D000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9388000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9393000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186542599.00007FF8A9397000.00000080.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186571704.00007FF8A9398000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff8a92d0000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: 00007C61208
                                                                                                                                                                                                              • String ID: ..\s\ssl\ssl_sess.c$SSL_SESSION_new$ssl_get_new_session
                                                                                                                                                                                                              • API String ID: 3535234312-2527649602
                                                                                                                                                                                                              • Opcode ID: 2ee31989e1f8588aa90a28ce799d2be3adf3df8615bd0751dc503f655c2d097d
                                                                                                                                                                                                              • Instruction ID: 884ae8ecf7ae38f5ce70552fa0e0a95e556a5176f05f831fb70266966fc49e38
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2ee31989e1f8588aa90a28ce799d2be3adf3df8615bd0751dc503f655c2d097d
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8CB17C21A0EAC2A2FB44EF61C8547F927A1FB84BC4F445035EA1DCB6AADF7CE5548310
                                                                                                                                                                                                              Function 00007FF6E216FBC8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                              • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                                                                                                                                                              • API String ID: 3215553584-1196891531
                                                                                                                                                                                                              • Opcode ID: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
                                                                                                                                                                                                              • Instruction ID: f0d3d4a52674556a3bb5aae63bb9259a4ffa8e39b0082663cf6499bffe95ce4f
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 23816373E2828285E7655E6981903FD2AA3AB1174CF564035CB0FD7295DFAFBB01930B
                                                                                                                                                                                                              Function 00007FF8A92D2478 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 175COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2186211945.00007FF8A92D1000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FF8A92D0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186182358.00007FF8A92D0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9353000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9355000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A937D000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9388000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9393000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186542599.00007FF8A9397000.00000080.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186571704.00007FF8A9398000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff8a92d0000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: 00007A241170
                                                                                                                                                                                                              • String ID: ..\s\ssl\statem\extensions_srvr.c$D:\a\1\s\include\internal/packet.h$tls_parse_ctos_server_name
                                                                                                                                                                                                              • API String ID: 2866013487-4157686371
                                                                                                                                                                                                              • Opcode ID: 67e0e25362e592984ee9547ed76d1c5314335af9c27ff3d6de0578625d6f2b20
                                                                                                                                                                                                              • Instruction ID: 11bce9a8da3a585cc0e24935f8292b7fea463ab7d61480feaec3c5d1a44e16de
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 67e0e25362e592984ee9547ed76d1c5314335af9c27ff3d6de0578625d6f2b20
                                                                                                                                                                                                              • Instruction Fuzzy Hash: F671C061A0EFC2A5EB609F21D4007BAB3A1EF967C4F586032DA5DC7A96DF2CE5408700
                                                                                                                                                                                                              Function 00007FF8A8141FD0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 173COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177832756.00007FF8A8141000.00000040.00000001.01000000.00000017.sdmp, Offset: 00007FF8A8140000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177799498.00007FF8A8140000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177832756.00007FF8A81A2000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177832756.00007FF8A81EE000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177832756.00007FF8A81F2000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177832756.00007FF8A81F7000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177832756.00007FF8A824F000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177832756.00007FF8A8254000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177832756.00007FF8A8257000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180094427.00007FF8A8258000.00000080.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180136487.00007FF8A825A000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff8a8140000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: 00007C6126570
                                                                                                                                                                                                              • String ID: CJK UNIFIED IDEOGRAPH-$HANGUL SYLLABLE
                                                                                                                                                                                                              • API String ID: 800424832-87138338
                                                                                                                                                                                                              • Opcode ID: d800521c55394c3ad25b6a38125f6762d0e11982fd6218b3e6ef33505340922b
                                                                                                                                                                                                              • Instruction ID: 73554a38af96e29241fad36790f8333a11d4bfc21ba79130aa2966ffca9a6eaa
                                                                                                                                                                                                              • Opcode Fuzzy Hash: d800521c55394c3ad25b6a38125f6762d0e11982fd6218b3e6ef33505340922b
                                                                                                                                                                                                              • Instruction Fuzzy Hash: C9613BF2B19642D6E7628B19A80067E72A2FF80BD4F444235EA5E47BD5DF3CE442C714
                                                                                                                                                                                                              Function 00007FF6E215D648 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                                                                                                                                                              • String ID: csm
                                                                                                                                                                                                              • API String ID: 2395640692-1018135373
                                                                                                                                                                                                              • Opcode ID: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
                                                                                                                                                                                                              • Instruction ID: 63c4f080357b1a9d103e07b3e2e307199cad46dd6cfad11a8d959fda5c04af88
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
                                                                                                                                                                                                              • Instruction Fuzzy Hash: F3519F33E596428ADB148B15D844BB87792EB44B9CF108170DB4EC7788DFBEEA41C709
                                                                                                                                                                                                              Function 00007FF8A8261CA0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 149COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2180285327.00007FF8A8261000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8260000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180246315.00007FF8A8260000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180285327.00007FF8A82B6000.00000040.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180285327.00007FF8A832D000.00000040.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182691075.00007FF8A832E000.00000080.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182728543.00007FF8A8330000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff8a8260000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: 00007$C610F020
                                                                                                                                                                                                              • String ID: BrotliDecompress failed$y*|:decompress
                                                                                                                                                                                                              • API String ID: 1199462638-3609120798
                                                                                                                                                                                                              • Opcode ID: 1dfeb41befc088f359630a9009b93ccc2498eed697200d288a3dde7c9a2760e2
                                                                                                                                                                                                              • Instruction ID: 95c95dacd7c2e541e27066008ee00be06d8e995f1564c8aa99ecddcbd8df1aed
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1dfeb41befc088f359630a9009b93ccc2498eed697200d288a3dde7c9a2760e2
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4C612C32E0AA42A6EB509B61E4443B923A5FB44BC5F444432CE8D53B58EF3CE515C368
                                                                                                                                                                                                              Function 00007FF6E215F288 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                                                                                                                                                              • String ID: csm$csm
                                                                                                                                                                                                              • API String ID: 3896166516-3733052814
                                                                                                                                                                                                              • Opcode ID: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
                                                                                                                                                                                                              • Instruction ID: eec930d1136ebb91342eb5bfcc1d53efb720780e1e3c28c0e7848242e4802c0c
                                                                                                                                                                                                              • Opcode Fuzzy Hash: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 98518033E4828287EB648B2191443AD37A2FB56B88F144176DB4DC3B85CFBDE650C70A
                                                                                                                                                                                                              Function 00007FF6E215EED8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CallEncodePointerTranslator
                                                                                                                                                                                                              • String ID: MOC$RCC
                                                                                                                                                                                                              • API String ID: 3544855599-2084237596
                                                                                                                                                                                                              • Opcode ID: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
                                                                                                                                                                                                              • Instruction ID: d2cf063541a908a11f5ca8cbd599513202484c824939f447f782989e2afa10e1
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
                                                                                                                                                                                                              • Instruction Fuzzy Hash: EE618F33D08BC586DB608B15E4403EAB7A1FB95788F044265EB9C83B95DFBDD290CB05
                                                                                                                                                                                                              Function 00007FF8A92D19DD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2186211945.00007FF8A92D1000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FF8A92D0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186182358.00007FF8A92D0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9353000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9355000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A937D000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9388000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9393000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186542599.00007FF8A9397000.00000080.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186571704.00007FF8A9398000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff8a92d0000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: 00007A8344
                                                                                                                                                                                                              • String ID: ..\s\ssl\tls_srp.c
                                                                                                                                                                                                              • API String ID: 2099648154-1778748169
                                                                                                                                                                                                              • Opcode ID: d6d5d50e08cea8272b2b5593a2dc40e5a6ae0df675d4a32b6bc603cce94478c2
                                                                                                                                                                                                              • Instruction ID: d2369d746df01687198eb7493cd0d5316f97401aaf1d92306e6c3d00be798716
                                                                                                                                                                                                              • Opcode Fuzzy Hash: d6d5d50e08cea8272b2b5593a2dc40e5a6ae0df675d4a32b6bc603cce94478c2
                                                                                                                                                                                                              • Instruction Fuzzy Hash: EE416B21A0FEC2A4FE54AF2194507B962F0EF80BD4F29A534DD5D8B7A9EF2CA4518314
                                                                                                                                                                                                              Function 00007FF6E2157E20 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateDirectoryW.KERNEL32(00000000,?,00007FF6E215352C,?,00000000,00007FF6E2153F1B), ref: 00007FF6E2157F32
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CreateDirectory
                                                                                                                                                                                                              • String ID: %.*s$%s%c$\
                                                                                                                                                                                                              • API String ID: 4241100979-1685191245
                                                                                                                                                                                                              • Opcode ID: a1c59376f93c8b4c6db0aee125681cb96c2ab9e1787ffa8cf6eb7b68f1c1c36c
                                                                                                                                                                                                              • Instruction ID: c463de639151b2a20e2dccdaefdc30b5360a639a126e70f1264d9c112f97a014
                                                                                                                                                                                                              • Opcode Fuzzy Hash: a1c59376f93c8b4c6db0aee125681cb96c2ab9e1787ffa8cf6eb7b68f1c1c36c
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8B31E122F19AC545EA218B20E8503EA6256FB84BE8F040231EF6DC7BC9DF6DD3028705
                                                                                                                                                                                                              Function 00007FF6E2152810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Message
                                                                                                                                                                                                              • String ID: ERROR$Error$[PYI-%d:%ls]
                                                                                                                                                                                                              • API String ID: 2030045667-255084403
                                                                                                                                                                                                              • Opcode ID: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
                                                                                                                                                                                                              • Instruction ID: dc9d9df2251a628d8ecec9d312ee7ba80c21f6006fb120efe300474988b1499b
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6121AB73B18B4192E6209B54F8847EA63A2EB88788F400136EB8ED3659DFBDD345C745
                                                                                                                                                                                                              Function 00007FF6E216C5A0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: FileWrite$ConsoleErrorLastOutput
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2718003287-0
                                                                                                                                                                                                              • Opcode ID: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
                                                                                                                                                                                                              • Instruction ID: d9d50ac113835312aafef29a6e5749ddffcec5b11d4081138b5272c28c4cad41
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 43D1CB73F28A818AE710CF65C4843EC37A2EB55798B444226DF4ED7B89DE79D206C709
                                                                                                                                                                                                              Function 00007FF6E216CF60 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6E216CF4B), ref: 00007FF6E216D07C
                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6E216CF4B), ref: 00007FF6E216D107
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ConsoleErrorLastMode
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 953036326-0
                                                                                                                                                                                                              • Opcode ID: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
                                                                                                                                                                                                              • Instruction ID: bbe36dfc50154ff811872fef0901d9746f4721379bd6ee3374ba3ef7169d3319
                                                                                                                                                                                                              • Opcode Fuzzy Hash: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0791B633E2865145F7509F6598803FD27A2BB4478CF544139DF0ED6684DFBAD642C70A
                                                                                                                                                                                                              Function 00007FF6E216F98C Relevance: 6.2, APIs: 4, Instructions: 162COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _get_daylight$_isindst
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 4170891091-0
                                                                                                                                                                                                              • Opcode ID: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
                                                                                                                                                                                                              • Instruction ID: 79549f2cd96a98e9e411ca4400af2d3accca44a6a7150b61b93e2ad45f33d56a
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4F511473F142528AEB28CF6499913FC2762AB4435CF140235DF1ED2AE5DF79A602C705
                                                                                                                                                                                                              Function 00007FF8A8296C80 Relevance: 6.2, APIs: 4, Instructions: 154COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2180285327.00007FF8A8261000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8260000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180246315.00007FF8A8260000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180285327.00007FF8A82B6000.00000040.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180285327.00007FF8A832D000.00000040.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182691075.00007FF8A832E000.00000080.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182728543.00007FF8A8330000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff8a8260000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: 00007$A2419$C61203
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 667864500-0
                                                                                                                                                                                                              • Opcode ID: e52e19dddba48d9fc27f932283582fe1209b610db4686e9e18e3710054b30bbc
                                                                                                                                                                                                              • Instruction ID: 4bba579e9a15241ece6ae6e1b694be4ca63469747b1bcfec3a101629e0cceb56
                                                                                                                                                                                                              • Opcode Fuzzy Hash: e52e19dddba48d9fc27f932283582fe1209b610db4686e9e18e3710054b30bbc
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5E71E236609BC586D660CB16F8807AAB7A8F788B84F548126EFDD43B58DF38C195CB44
                                                                                                                                                                                                              Function 00007FF6E216577C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2780335769-0
                                                                                                                                                                                                              • Opcode ID: 601044899bb77d1db34704472f686b9691880a3163deed0eb7e9945e8072c835
                                                                                                                                                                                                              • Instruction ID: 14e35ba40ae6f47b8af5e0545336bc8860c4aaa4d73f5676cdd2c989ddd3b2a8
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 601044899bb77d1db34704472f686b9691880a3163deed0eb7e9945e8072c835
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 13517B33E286419AFB10CF65D4903BD27A6AB48B9CF108434DF49C7A88DFB9D6808706
                                                                                                                                                                                                              Function 00007FF6E21520C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: LongWindow$DialogInvalidateRect
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1956198572-0
                                                                                                                                                                                                              • Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
                                                                                                                                                                                                              • Instruction ID: 5ac8ec086ec563cf95fd09c58e6f37d37bd655789ee524321a1183154f45fe64
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
                                                                                                                                                                                                              • Instruction Fuzzy Hash: C911E923F4C14242F65487A9E5883FA5253EF95788F484030DB4BC7B89CEAED781820A
                                                                                                                                                                                                              Function 00007FF6E215D010 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2933794660-0
                                                                                                                                                                                                              • Opcode ID: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
                                                                                                                                                                                                              • Instruction ID: 1ceb0bab9867d38da2ed9b918334c53b4a219aeab7db985b1e650b3fe4a1bcf1
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 25111C22B15B058AEB008B60E8943B933A4FB5A75CF440E31EB6DC67A4DFB8E2548345
                                                                                                                                                                                                              Function 00007FF8A92D1A05 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 283COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2186211945.00007FF8A92D1000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FF8A92D0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186182358.00007FF8A92D0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9353000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9355000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A937D000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9388000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9393000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186542599.00007FF8A9397000.00000080.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186571704.00007FF8A9398000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff8a92d0000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: 00007C61208
                                                                                                                                                                                                              • String ID: ..\s\ssl\ssl_asn1.c$d2i_SSL_SESSION
                                                                                                                                                                                                              • API String ID: 3535234312-384499812
                                                                                                                                                                                                              • Opcode ID: bf6ac2c97a372f31d576a85372ebd442c85ef0c615da678fdf509a5c98780009
                                                                                                                                                                                                              • Instruction ID: 9955df669ff3a8332c22122db79a97d9abe9ac7da7261eeca7131241a6f8991c
                                                                                                                                                                                                              • Opcode Fuzzy Hash: bf6ac2c97a372f31d576a85372ebd442c85ef0c615da678fdf509a5c98780009
                                                                                                                                                                                                              • Instruction Fuzzy Hash: CBD12A22A0EBC2A6EB559F29D4C02B837A4FB44BC4F455035DE6D8779AEF38E451C310
                                                                                                                                                                                                              Function 00007FF8A82619F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 130COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2180285327.00007FF8A8261000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8260000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180246315.00007FF8A8260000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180285327.00007FF8A82B6000.00000040.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180285327.00007FF8A832D000.00000040.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182691075.00007FF8A832E000.00000080.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182728543.00007FF8A8330000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff8a8260000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: 00007
                                                                                                                                                                                                              • String ID: BrotliDecoderDecompressStream failed while processing the stream$y*:process
                                                                                                                                                                                                              • API String ID: 3568877910-3378180327
                                                                                                                                                                                                              • Opcode ID: ebe849aa38d28a6f9b76366784e34f312a3ee510abe0b2ee51e6d9ec1560f0ea
                                                                                                                                                                                                              • Instruction ID: 4e566adc8ea235bb1ff9fd09ffe69816e2f1129091d5c4f6d512e248937ea4c9
                                                                                                                                                                                                              • Opcode Fuzzy Hash: ebe849aa38d28a6f9b76366784e34f312a3ee510abe0b2ee51e6d9ec1560f0ea
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 17513C72A0AB46AAEB509F61E4443BD33A8FB48785F480535CE8D17B5CEF38E455C364
                                                                                                                                                                                                              Function 00007FF6E2175B1C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: _get_daylight$_invalid_parameter_noinfo
                                                                                                                                                                                                              • String ID: ?
                                                                                                                                                                                                              • API String ID: 1286766494-1684325040
                                                                                                                                                                                                              • Opcode ID: 34aa9ba053483d92f686c00bb3d23c2ed0895a5cb55bf09a4ef316522e0c30cf
                                                                                                                                                                                                              • Instruction ID: 55b1d896a359b231ccce3b844c81e3eaa8fc5ec7f4bf883aa64f2aca00537481
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 34aa9ba053483d92f686c00bb3d23c2ed0895a5cb55bf09a4ef316522e0c30cf
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 05414723E0828666F7308B25D4413F96662EBC2BA8F144235EF4CC7AD5DFBED6418705
                                                                                                                                                                                                              Function 00007FF6E2169014 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E2169046
                                                                                                                                                                                                                • Part of subcall function 00007FF6E216A948: RtlFreeHeap.NTDLL(?,?,?,00007FF6E2172D22,?,?,?,00007FF6E2172D5F,?,?,00000000,00007FF6E2173225,?,?,?,00007FF6E2173157), ref: 00007FF6E216A95E
                                                                                                                                                                                                                • Part of subcall function 00007FF6E216A948: GetLastError.KERNEL32(?,?,?,00007FF6E2172D22,?,?,?,00007FF6E2172D5F,?,?,00000000,00007FF6E2173225,?,?,?,00007FF6E2173157), ref: 00007FF6E216A968
                                                                                                                                                                                                              • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF6E215CBA5), ref: 00007FF6E2169064
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              • C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe, xrefs: 00007FF6E2169052
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
                                                                                                                                                                                                              • String ID: C:\Users\user\Desktop\tor-browser-windows-x86_64-portable-14.0.2.exe
                                                                                                                                                                                                              • API String ID: 3580290477-524912626
                                                                                                                                                                                                              • Opcode ID: 652ac8178d02f9bf502bb0dac840cc2c27021cfa98e1c84195502d2d1921a3a9
                                                                                                                                                                                                              • Instruction ID: 13436bc04cc25523bfec1375aef358c20cd37be23c79a1b8c2fdb6199f7126f3
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 652ac8178d02f9bf502bb0dac840cc2c27021cfa98e1c84195502d2d1921a3a9
                                                                                                                                                                                                              • Instruction Fuzzy Hash: B841AF33E1860286EB189F25D4802FC33A6FB447D8B554035EB4EC7B85CE7EE6918346
                                                                                                                                                                                                              Function 00007FF8A828A350 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2180285327.00007FF8A8261000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8260000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180246315.00007FF8A8260000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180285327.00007FF8A82B6000.00000040.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2180285327.00007FF8A832D000.00000040.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182691075.00007FF8A832E000.00000080.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2182728543.00007FF8A8330000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff8a8260000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: 00007C6138
                                                                                                                                                                                                              • String ID: Tg]@
                                                                                                                                                                                                              • API String ID: 2722774091-1367013573
                                                                                                                                                                                                              • Opcode ID: 3719e9e772ddd07db95e1395b94176eaae3edf7eef6ff48e371fe99230a2501a
                                                                                                                                                                                                              • Instruction ID: a5aa1be74a6248244080acb3a2b0fafd01855db3d2694366cf0ffb074558ba34
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3719e9e772ddd07db95e1395b94176eaae3edf7eef6ff48e371fe99230a2501a
                                                                                                                                                                                                              • Instruction Fuzzy Hash: F5411B32B16B899ADE118F3690046B9B650FF45BC4F148331EA4B27758EF39E593C614
                                                                                                                                                                                                              Function 00007FF6E216CC38 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ErrorFileLastWrite
                                                                                                                                                                                                              • String ID: U
                                                                                                                                                                                                              • API String ID: 442123175-4171548499
                                                                                                                                                                                                              • Opcode ID: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
                                                                                                                                                                                                              • Instruction ID: 8de3ff0bfd1ec27e8f3fb1a014825065259b794b46ffdc4fcef58b3d4545c0d4
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9E419133A28A8581DB208F25E4483EA6762FB98788F504135EF4DC7798EFBDD641C745
                                                                                                                                                                                                              Function 00007FF8A92FDDC0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 89COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2186211945.00007FF8A92D1000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FF8A92D0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186182358.00007FF8A92D0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9353000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9355000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A937D000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9388000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9393000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186542599.00007FF8A9397000.00000080.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186571704.00007FF8A9398000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff8a92d0000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID: ..\s\ssl\ssl_sess.c$SSL_SESSION_new
                                                                                                                                                                                                              • API String ID: 0-402823876
                                                                                                                                                                                                              • Opcode ID: 8bcf40587d5a5fa41e3c70954e128ebca469350227bdc8224ae571735e6d0bcf
                                                                                                                                                                                                              • Instruction ID: 575c64fcf1165c1cf7932d8e0fadfd63ce44d438e242705976532b2ebad96681
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8bcf40587d5a5fa41e3c70954e128ebca469350227bdc8224ae571735e6d0bcf
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6F419A25A1EAC2A2FB44AF21D8517E962E0FFC87C4F855036EA0C8779ADF7CE1418700
                                                                                                                                                                                                              Function 00007FF8A92D85B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68timeCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2186211945.00007FF8A92D1000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FF8A92D0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186182358.00007FF8A92D0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9353000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9355000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A937D000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9388000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9393000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186542599.00007FF8A9397000.00000080.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186571704.00007FF8A9398000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff8a92d0000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Time$System$File
                                                                                                                                                                                                              • String ID: gfff
                                                                                                                                                                                                              • API String ID: 2838179519-1553575800
                                                                                                                                                                                                              • Opcode ID: 5530e0db4563f3136961ddcacea572fb8f4abfde4476f4fcd83b7edc0dcc1c0e
                                                                                                                                                                                                              • Instruction ID: 4ffdc91b3df20a81d462d05ac4afc897d13b5d2ee66091061d43b140310b4454
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5530e0db4563f3136961ddcacea572fb8f4abfde4476f4fcd83b7edc0dcc1c0e
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8E21A572A0D6C696EB94CF29D8003B976E8EB88BD4F449035DA5DCB799DE7CD1408B40
                                                                                                                                                                                                              Function 00007FF6E216F5B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CurrentDirectory
                                                                                                                                                                                                              • String ID: :
                                                                                                                                                                                                              • API String ID: 1611563598-336475711
                                                                                                                                                                                                              • Opcode ID: e8d367c4ea258391d160676196091cc4497c978f166048fd005a5cb1bdaac227
                                                                                                                                                                                                              • Instruction ID: 73bdf6b5c8d397ab12b8f9baea60b14021068cab88be22108e2ca33e00d0ac76
                                                                                                                                                                                                              • Opcode Fuzzy Hash: e8d367c4ea258391d160676196091cc4497c978f166048fd005a5cb1bdaac227
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5021C373F2828181EB209B15D0843BD63A2FB84B4CF464035DB4EC3694DFBED6448796
                                                                                                                                                                                                              Function 00007FF6E215FD48 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ExceptionFileHeaderRaise
                                                                                                                                                                                                              • String ID: csm
                                                                                                                                                                                                              • API String ID: 2573137834-1018135373
                                                                                                                                                                                                              • Opcode ID: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
                                                                                                                                                                                                              • Instruction ID: 4fceea49c924b85948d436fd7796e58857944604fcee20e5e6187d762360a03c
                                                                                                                                                                                                              • Opcode Fuzzy Hash: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 23115E33A08B8582EB218F15E4003A977E5FB89B88F184230DB8D87758DF7ED6518B04
                                                                                                                                                                                                              Function 00007FF6E217073C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2177591285.00007FF6E2151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E2150000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177557296.00007FF6E2150000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177637314.00007FF6E217B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E218E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177682424.00007FF6E2191000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2177752501.00007FF6E2194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff6e2150000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: DriveType_invalid_parameter_noinfo
                                                                                                                                                                                                              • String ID: :
                                                                                                                                                                                                              • API String ID: 2595371189-336475711
                                                                                                                                                                                                              • Opcode ID: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
                                                                                                                                                                                                              • Instruction ID: 2c5d642c827ed9e5cec17397393d8e3b197b59bc065beb7d0e54c3ac61d6f117
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
                                                                                                                                                                                                              • Instruction Fuzzy Hash: B0017123E2820285E7309F60D4613BE63A1EF8574CF901439D78DC26C1DEBED6048A1A
                                                                                                                                                                                                              Function 00007FF8A92D8FD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35timeCOMMON
                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2186211945.00007FF8A92D1000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FF8A92D0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186182358.00007FF8A92D0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9353000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9355000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A937D000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9388000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186211945.00007FF8A9393000.00000040.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186542599.00007FF8A9397000.00000080.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2186571704.00007FF8A9398000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_7ff8a92d0000_tor-browser-windows-x86_64-portable-14.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Time$System$File
                                                                                                                                                                                                              • String ID: gfff
                                                                                                                                                                                                              • API String ID: 2838179519-1553575800
                                                                                                                                                                                                              • Opcode ID: 67d5b2b245d6d65e2ef5cc5c305487d292cfc8c0b311219f02d73a446867e23b
                                                                                                                                                                                                              • Instruction ID: efc43dd88305754dbfa29b6e507cc383ab8e63119737a36e3d8ee5d2e465f8be
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 67d5b2b245d6d65e2ef5cc5c305487d292cfc8c0b311219f02d73a446867e23b
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 91012BE2B1998552EB64DF25F80115567E0FBCC7C4B44D032E65DCBB59EE2CD1018700