8ab5c1ec0b309e33dd2928488d6b2f24b95d60f5d2f40d5783cd8c3cfe804213

Analysis

max time kernel
152s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2023 04:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

qBittorrent/qbittorrent.exe
Size

28.3MB
MD5

cb03a80bc17d2d81fd34aab4341e89eb
SHA1

baf0f8686769ae47ed411e8432028057974a1611
SHA256

8e6af6cbd3765b8d8c1dd553354a0d4ff9f7fc2eb293704845af7e66a9ccdb0a
SHA512

f2bc0fefab5c22b9732f506ad47b93108779859f2ba7615c8e0522622cd2587cdb711225d603804f75a28932389b2877ab2f886facbbe5871cd55dc20256bcbe
SSDEEP

393216:keHUAF/9iRC0o+9xU+q7WndIFdU5cqyRZUSfruM4Jsv6tWKFdu9CCoR1:keHUwy9y9Wn+FK5cbfrVor

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 17 IoCs

Processes:

qbittorrent.exefirefox.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\magnet\URL Protocol	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\magnet\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\qBittorrent\\qbittorrent.exe\",1"	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\magnet\shell\open\command	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\magnet\shell\open	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\.torrent\	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\.torrent\ = "qBittorrent"	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\magnet\shell\	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\magnet\shell\ = "open"	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\magnet\shell\open\command\	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\magnet\	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\magnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\qBittorrent\\qbittorrent.exe\" \"%1\""	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\magnet\ = "URL:Magnet link"	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\magnet\Content Type = "application/x-magnet"	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\magnet\DefaultIcon\	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\magnet	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\magnet\shell	qbittorrent.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

qbittorrent.exe

pid process

1752 qbittorrent.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

qbittorrent.exe

pid process

1752 qbittorrent.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

firefox.exe

description pid process

Token: SeDebugPrivilege 2636 firefox.exe
Token: SeDebugPrivilege 2636 firefox.exe

description	pid	process
Token: SeDebugPrivilege	2636	firefox.exe
Token: SeDebugPrivilege	2636	firefox.exe

Suspicious use of FindShellTrayWindow 11 IoCs

Processes:

qbittorrent.exefirefox.exe

pid	process
1752	qbittorrent.exe
1752	qbittorrent.exe
1752	qbittorrent.exe
1752	qbittorrent.exe
1752	qbittorrent.exe
1752	qbittorrent.exe
1752	qbittorrent.exe
2636	firefox.exe
2636	firefox.exe
2636	firefox.exe
2636	firefox.exe

Suspicious use of SendNotifyMessage 10 IoCs

Processes:

qbittorrent.exefirefox.exe

pid	process
1752	qbittorrent.exe
1752	qbittorrent.exe
1752	qbittorrent.exe
1752	qbittorrent.exe
1752	qbittorrent.exe
1752	qbittorrent.exe
1752	qbittorrent.exe
2636	firefox.exe
2636	firefox.exe
2636	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

firefox.exe

pid process

2636 firefox.exe

pid	process
2636	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 2548 wrote to memory of 2636	2548	firefox.exe	firefox.exe
PID 2548 wrote to memory of 2636	2548	firefox.exe	firefox.exe
PID 2548 wrote to memory of 2636	2548	firefox.exe	firefox.exe
PID 2548 wrote to memory of 2636	2548	firefox.exe	firefox.exe
PID 2548 wrote to memory of 2636	2548	firefox.exe	firefox.exe
PID 2548 wrote to memory of 2636	2548	firefox.exe	firefox.exe
PID 2548 wrote to memory of 2636	2548	firefox.exe	firefox.exe
PID 2548 wrote to memory of 2636	2548	firefox.exe	firefox.exe
PID 2548 wrote to memory of 2636	2548	firefox.exe	firefox.exe
PID 2548 wrote to memory of 2636	2548	firefox.exe	firefox.exe
PID 2548 wrote to memory of 2636	2548	firefox.exe	firefox.exe
PID 2636 wrote to memory of 5088	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 5088	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 3400	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 4300	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 4300	2636	firefox.exe	firefox.exe
PID 2636 wrote to memory of 4300	2636	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\qBittorrent\qbittorrent.exe
"C:\Users\Admin\AppData\Local\Temp\qBittorrent\qbittorrent.exe"
1⤵
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1752

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2548

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2636

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.0.906881208\742709076" -parentBuildID 20221007134813 -prefsHandle 1844 -prefMapHandle 1836 -prefsLen 20812 -prefMapSize 232645 -appDir "C:\Program Files\Mozilla Firefox\browser" - {01979d15-9721-4591-9fe2-ad1a8297fa97} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 1920 21ba6bd6858 gpu
3⤵
PID:5088

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.1.1546356058\328444402" -parentBuildID 20221007134813 -prefsHandle 2304 -prefMapHandle 2300 -prefsLen 20848 -prefMapSize 232645 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aff95cec-fcd7-4fbe-bea6-bdbf650aeef0} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 2316 21b99c72b58 socket
3⤵
PID:3400

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.2.537678824\1822034829" -childID 1 -isForBrowser -prefsHandle 3096 -prefMapHandle 3092 -prefsLen 20931 -prefMapSize 232645 -jsInitHandle 1500 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {84e65320-c0f8-4b65-8233-12e1fe06e172} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 3108 21ba6b65758 tab
3⤵
PID:4300

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.3.1880886515\633618631" -childID 2 -isForBrowser -prefsHandle 3572 -prefMapHandle 3568 -prefsLen 26441 -prefMapSize 232645 -jsInitHandle 1500 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {23ffa31b-93fb-43a1-9fab-1aee8d1439f1} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 3584 21b99c70458 tab
3⤵
PID:4292

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.4.2145182276\2063882212" -childID 3 -isForBrowser -prefsHandle 3980 -prefMapHandle 3972 -prefsLen 26441 -prefMapSize 232645 -jsInitHandle 1500 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bc86cdea-6707-48ad-a96c-6332e8d20fe0} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 4000 21baab3a558 tab
3⤵
PID:880

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.5.1643057218\989055587" -childID 4 -isForBrowser -prefsHandle 5012 -prefMapHandle 5032 -prefsLen 26500 -prefMapSize 232645 -jsInitHandle 1500 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b0183260-83e6-40ad-a237-8337862e3707} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 5016 21bad152e58 tab
3⤵
PID:4600

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.6.916890554\1735597911" -childID 5 -isForBrowser -prefsHandle 5020 -prefMapHandle 4956 -prefsLen 26500 -prefMapSize 232645 -jsInitHandle 1500 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c92e01fa-94a3-489b-acdd-81e3ba404749} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 4944 21bad151958 tab
3⤵
PID:528

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.7.2042110780\2141514009" -childID 6 -isForBrowser -prefsHandle 5332 -prefMapHandle 5336 -prefsLen 26500 -prefMapSize 232645 -jsInitHandle 1500 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {741ab71e-2327-433d-afe0-7457ecae7f23} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 5404 21bad14fb58 tab
3⤵
PID:3556

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.8.1405238427\96504917" -childID 7 -isForBrowser -prefsHandle 5752 -prefMapHandle 5748 -prefsLen 27036 -prefMapSize 232645 -jsInitHandle 1500 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fecaa8c0-5a6d-41b2-911f-bf36f3999c93} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 5764 21bab5d2558 tab
3⤵
PID:4536

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.9.1398079190\37102672" -parentBuildID 20221007134813 -prefsHandle 5948 -prefMapHandle 5980 -prefsLen 27036 -prefMapSize 232645 -appDir "C:\Program Files\Mozilla Firefox\browser" - {05139299-654e-4be1-ba1e-d0f5c2404216} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 5968 21bae88ee58 rdd
3⤵
PID:232

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.10.737743511\1339541869" -childID 8 -isForBrowser -prefsHandle 1400 -prefMapHandle 6032 -prefsLen 27036 -prefMapSize 232645 -jsInitHandle 1500 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0baecba0-3de8-43db-94d5-7137e7f47f73} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 6064 21bab555658 tab
3⤵
PID:4308

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.11.1673235061\466091294" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 6172 -prefMapHandle 6032 -prefsLen 27036 -prefMapSize 232645 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f0edc6ec-89af-4f9d-b6fb-060d8a3966d5} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 6244 21bab554758 utility
3⤵
PID:2204

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.12.1402973350\1018148313" -childID 9 -isForBrowser -prefsHandle 2892 -prefMapHandle 4652 -prefsLen 27172 -prefMapSize 232645 -jsInitHandle 1500 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7aeb9b08-bde9-4bd1-803b-f648e0c4dc59} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 2900 21baf0b5458 tab
3⤵
PID:2864

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.13.445391646\1389647699" -childID 10 -isForBrowser -prefsHandle 2896 -prefMapHandle 4804 -prefsLen 27172 -prefMapSize 232645 -jsInitHandle 1500 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1545f098-131b-4be1-a874-2211cef1168d} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 3560 21bab582b58 tab
3⤵
PID:568

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.15.43186732\560920431" -childID 12 -isForBrowser -prefsHandle 6648 -prefMapHandle 6652 -prefsLen 27172 -prefMapSize 232645 -jsInitHandle 1500 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {66d97576-fb73-455d-9aab-82e3069ab701} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 6636 21bae7d1158 tab
3⤵
PID:1004

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.14.663291616\1663063652" -childID 11 -isForBrowser -prefsHandle 3688 -prefMapHandle 1080 -prefsLen 27172 -prefMapSize 232645 -jsInitHandle 1500 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {af2db903-fb15-4a68-925d-9e97b5fe491f} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 3628 21bae779358 tab
3⤵
PID:32

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jesyn8dv.default-release\activity-stream.discovery_stream.json.tmp
Filesize
156KB

MD5
d567068e6271fa2d4481c3f2e2a7b3cc

SHA1
c078dbaeda75eaf0dcb44b9921c96ab565f2e65f

SHA256
0191beec681bcbc60efe4f8fc4f946509ff1e758629e9afdfab6f565441c81c3

SHA512
9264eba4bfa136880d4e4135464c8e9eedf05574a25f13f3a4ef1f3cac32628e0f792c548fd58b7ea1a5661b345921e825ff024347861221f896d036e573d39e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jesyn8dv.default-release\cache2\doomed\13841
Filesize
14KB

MD5
cec8bf8a0a424204c1ff1111bf6df243

SHA1
2b251903dc3a09dbeb0f2cc44648aba919a43a52

SHA256
2ee8df93a496de45dd7d6781f7371304d1fc6d43e1fdd03be783f173b19304c6

SHA512
5d0d20b7f907541014a5672d19b2bd7bebff69264128d544bfb77363639763754225e19a068fce66c2ad0cc69e96b0f634621ea57f01b24d548b5bcce8387fee

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jesyn8dv.default-release\cache2\doomed\22550
Filesize
16KB

MD5
b45e7bf0f8a00dc6836155e1e6bf5bad

SHA1
455f2e57fc37e911740abb959d23396c774186f2

SHA256
4ef9215a692bbdc8ea5619d1523a9965a93c37013e105910eebeb9ad16377d2e

SHA512
7cbf0df0873d96a7a1e4fb326190df3a8ad6d23c58f6462ea8ddf61689bed8879660a610313adb61b74d3016bb4c6746b20ce58f82246d71e66a5cb05f4ddecc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jesyn8dv.default-release\cache2\doomed\26378
Filesize
15KB

MD5
7c9b6c3871156225c72581c0b9f4b265

SHA1
c290cb184173e703b59e8448b0023a5c11fb1ab8

SHA256
c712c3cacb4085836b1fa48f220614a4a03b78a95a24b89f0bac459bfeca8a84

SHA512
15bfee75a2f35d2189931ce326dbef326229a528bda052558a70a5017a09c8cba47b835a36b7221ee074d25e7bb006d913c0860fd1def85406565ba66a189f63

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jesyn8dv.default-release\cache2\doomed\30245
Filesize
9KB

MD5
8252dff6c5d6935ea5ed5ceb345b6840

SHA1
ac478d694545bb51b7086d9d3aef35de433d49aa

SHA256
10f7136c1b17295024b16b335a2c60497c3bd94f4e2f329eafd5e47b916b717b

SHA512
f8ceb2001e54ab5bcb538a459104742f5174adae714658a34f1ca9089920eefb8ece038a3870914d14f8788677ca1e536da89cc0a8db15677bf6a0212887152e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jesyn8dv.default-release\cache2\doomed\3678
Filesize
14KB

MD5
dd60519df6f13f5f503f76d21a1e8afd

SHA1
7a5694ff660cf53bb7b9e0c01fb3d8280638b89e

SHA256
b71736b53cf1cfb25f47679fd26a43cb8be66fc710abaea46e2ae45f4e965fc1

SHA512
85903572db215032a077b3ca75ed1feac1f9d6fcb7c25b784d7b15cceb2666d8acfa76953ee2766216e7db49c3cdcec50a01333682ab20e826b40c537e2025f3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\prefs-1.js
Filesize
6KB

MD5
435a402ce14afd94b0d4d80f80719f9a

SHA1
4da378acf46947c2aae4b4bf66905656861a0aba

SHA256
1615576803bd7b0307a6970192172c16eba98318d085e914a3eda7f9fe4983a0

SHA512
2211b4cbcdd4452c64e5125453d1a345fc5c5d0a9fa867da258f46032198e2a5047b8804fd526d44a6cbe27d8c12f373512aa43bcc7341fc7009904688679785

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\prefs-1.js
Filesize
6KB

MD5
b3bb33465b86b704b6b3a8966f93710e

SHA1
32fd4f16d32a1163ebee3f4ba135fa032449882a

SHA256
6973df931871c74378b85687faf68b8fe60bcbd9a223ec5c9c2dd5d0094a514e

SHA512
97390489cc4e5a8a5a815fd4eb86ce6aa5d0f4fa335393252a67b69c09557b3623d7104622d19f92d31d51644eb5ddd60a85e1736e1d2d4239e18780e96d7e15

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\prefs-1.js
Filesize
6KB

MD5
66f0b47dcdef79dd0b17c55fd22eae71

SHA1
b4c3a6511bb8a2d057315debbc7f2cf1fa316bcb

SHA256
d547bad31539a1b7232da23eb8f3c8332694a0070d6b744f6e5122d1a69e33d6

SHA512
1543600d2ae73d8fccf2b2e40ab088d4fe77d668d4f8d9d69b7785186c1d432cc8d0de5c866028539c7e729ab392e9527b85f50251101a7f01b2ce8156c2b462

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\prefs-1.js
Filesize
7KB

MD5
bef606ecd6a37d8ee4d24e321206b17c

SHA1
5e4083cb07c1395744fbb306bcb828833f43f821

SHA256
a13e5c5edabd069dbc2c6775eb043824383c618fa2b95dc9e2cd27ff0abce504

SHA512
02eba0ffe6f421a8b7b2183f5d927a5822d0638c0612b9ab72508fe8200a0e7dcebcb32b43885f01e8f8b3904dee3edf9baac03fe7859cb042ef0c83408eaa71

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\prefs-1.js
Filesize
6KB

MD5
d3fe74add60a75088eb187c2e38b57a6

SHA1
cb1a0183bb3f3f5dbc4c652b66a3ca2db62d38a0

SHA256
601653f4925a7273a05a6eace8266586b6a8bfef695e998e863a94f484b61b57

SHA512
4c2878230f02331d4d493668c30c5f8743959531a619ecda8ada93c398a6375104b9825e8dd1630d06e2a1162d76628090e4daf851b9149d7943885d945ef639

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\prefs.js
Filesize
6KB

MD5
9971fa8fa89a208685d3e30835832fb5

SHA1
5d9972a3bdbd4c18b3648597d2fd9f9fd6e30300

SHA256
13417a67a65fecc73ad5acc94d17d8a6fac3b0a343daf12d1cd2d126b9198084

SHA512
02b107e0d9449fa2d4d3655a880fbdeea4477205fa6c21aaf641c3d358353aa437cf040ec842107f973253bef767e48b9a0267dea5ed2d331aa192ef540e3b1f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\serviceworker-1.txt
Filesize
161B

MD5
c0680df1e6ba23e84169acaf5e0312ee

SHA1
a67c0ee162c3f62c313ab597794308b3ce6bc870

SHA256
39b7f162f6a39fa8b7f54e132cb910211bb1324872700ec37cbe255c7d55fac4

SHA512
31c6f33de63a5712f7dc2001e5475ed900f0a40b6c966e7df4759cc51d5ae196cc557eecb15ff1bf0f7e21c3e511f7ce97aeb7aeb24f01335929f87e341db209

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\serviceworker.txt
Filesize
146B

MD5
df1ac2ada403f7cfec3a24038f7ff5d2

SHA1
c5bfb2e5cbd519a5625324f654707b216757fb99

SHA256
dbb79be1769bf05fe8d525d97621261f651f55b2b57a680354963ebd033946bc

SHA512
a1b5e01b83c854b0f64d67a6ab1fca1852a7763ad0a14f1e511f7e302fa12494a84f3d3512b6f5397c64bd0fb8ccfb52a50213dd857e222027fb41b6c07c4548

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
1KB

MD5
05899fedcaa6136017dbc8f9f52506eb

SHA1
304a4c4b8ebef9ca3a7e4a29bd096e995ec0b7b2

SHA256
1e67006d522bde6ef339ee53310771071971da0f1a6add04d7dee324002d0104

SHA512
47e03aa3d0de94a591bf11e73bb3eccdf3b6a558f52a518099664516efd8747b02a0b10a014072e908001f3f7eabc83a3d9d53159482501bd85d38ad01abcd2d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
3KB

MD5
71556c2d30db739c44c6816610b193ba

SHA1
514868ac2b735dbdab43d0f2be55d262d2751d0a

SHA256
ab99879296dd88de47a498f66939aa9dfbe6c7610659e9e99c842432cc86a7c9

SHA512
24bb3d0fc2ddf8247e98b38621da6c45f9d8e5fc5980135bcaf68478e222de5f702a618a7c1b839b62e99c270bafd8360985260643cf760745901464c1764b72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\storage\default\https+++www.quora.com\cache\morgue\233\{a16777d1-bc73-47b4-819a-8ad0971cc3e9}.final
Filesize
4KB

MD5
b30b1cc71038ef374ce254c688555604

SHA1
a117eba8a26de91111c94486544d03f011058ced

SHA256
c8e0b440e946a509ffcb6a0454817d9bb9fd6be9125b9f1e75994aa68f1a4970

SHA512
6c5c0dcde9e82eb8fb9d0c9519fd484a6f4d560edf4678d5363fddd854b04d070d2142501140b966a6e1e1eda5410c5b4d8b83195eee5b2eb4a17b402bce4dbc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\storage\default\https+++www.quora.com\cache\morgue\54\{36dbec04-9ba4-48e8-83c2-3bd91ec95d36}.final
Filesize
266B

MD5
f1882832535efcaee1710e9f83ee39eb

SHA1
f1048975fb42e3431f80dcde7092e7de42aff213

SHA256
5f49d9d73229e53df2e6b9b18ebd54324ac37fe71f21b94b6a521c7ffd466e59

SHA512
f195a2d3633e7182938ee0179fc768003d401e4ff8fd34607ae12f57e8155b891aeaa93e86226aa6939455755370f9910c84efa768069eaadbdef9b0cb1c0342

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\storage\default\https+++www.youtube.com^partitionKey=%28https%2Cgoogle.com%29\idb\2171031483YattIedMb.sqlite
Filesize
48KB

MD5
1b313049178ff879569f1807ae790f82

SHA1
fbf5162c2f8b5ebd1679c8527fbcea84fc681063

SHA256
220a7af9aaa9a274b17cf57966bf86186f4737ed3a7f9ec96d5fcb24a6b21dfd

SHA512
16c2c5c8643d790dd7214a7aa794fe428a66b68043c5e68873cc0cc2e0e9c50758f970b7eeae70635629730b1e6cc0ac586a27e62cdf901614918e27d12df09f

Download Submit
C:\Users\Admin\AppData\Roaming\qBittorrent\watched_folders.json
Filesize
4B

MD5
5b76b0eef9af8a2300673e0553f609f9

SHA1
0b56d40c0630a74abec5398e01c6cd83263feddc

SHA256
d914176fd50bd7f565700006a31aa97b79d3ad17cee20c8e5ff2061d5cb74817

SHA512
cf06a50de1bf63b7052c19ad53766fa0d99a4d88db76a7cbc672e33276e3d423e4c5f5cb4a8ae188c5c0e17d93bb740eaab6f25753f0d26501c5f84aeded075d

Download Submit
memory/1752-133-0x0000023405150000-0x0000023405160000-memory.dmp

Filesize
64KB

Download