bazarloader | hxxps://archive[.]org/details/pizza-tower-online_202304

Analysis

max time kernel
2681s
max time network
2673s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
23-06-2023 17:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://archive.org/details/pizza-tower-online_202304

Score

10^/10

bazarloader discovery dropper loader persistence

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 3 IoCs

Processes:

resource	yara_rule
C:\Program Files\qBittorrent\qbittorrent.exe	BazarLoaderVar5
C:\Program Files\qBittorrent\qbittorrent.exe	BazarLoaderVar5
C:\Program Files\qBittorrent\qbittorrent.exe	BazarLoaderVar5

Executes dropped EXE 5 IoCs

Processes:

qbittorrent_4.5.4_x64_setup.exeqbittorrent_4.5.4_x64_setup.exeqbittorrent_4.5.4_x64_setup.exeqbittorrent.exePizzaTower_ONLINE.exe

pid	process
3904	qbittorrent_4.5.4_x64_setup.exe
1544	qbittorrent_4.5.4_x64_setup.exe
5456	qbittorrent_4.5.4_x64_setup.exe
5676	qbittorrent.exe
6084	PizzaTower_ONLINE.exe

Loads dropped DLL 10 IoCs

Processes:

qbittorrent_4.5.4_x64_setup.exeqbittorrent_4.5.4_x64_setup.exeqbittorrent_4.5.4_x64_setup.exePizzaTower_ONLINE.exe

pid	process
3904	qbittorrent_4.5.4_x64_setup.exe
1544	qbittorrent_4.5.4_x64_setup.exe
5456	qbittorrent_4.5.4_x64_setup.exe
5456	qbittorrent_4.5.4_x64_setup.exe
5456	qbittorrent_4.5.4_x64_setup.exe
5456	qbittorrent_4.5.4_x64_setup.exe
5456	qbittorrent_4.5.4_x64_setup.exe
5456	qbittorrent_4.5.4_x64_setup.exe
5456	qbittorrent_4.5.4_x64_setup.exe
6084	PizzaTower_ONLINE.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

qbittorrent_4.5.4_x64_setup.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qBittorrent = "C:\\Program Files\\qBittorrent\\qbittorrent.exe"	qbittorrent_4.5.4_x64_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Software\Microsoft\Windows\CurrentVersion\Run	qbittorrent_4.5.4_x64_setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 37 IoCs

Processes:

qbittorrent_4.5.4_x64_setup.exe

description	ioc	process
File created	C:\Program Files\qBittorrent\translations\qt_gl.qm	qbittorrent_4.5.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qt_sl.qm	qbittorrent_4.5.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qt_sv.qm	qbittorrent_4.5.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ar.qm	qbittorrent_4.5.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_da.qm	qbittorrent_4.5.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_fa.qm	qbittorrent_4.5.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_sk.qm	qbittorrent_4.5.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\uninst.exe	qbittorrent_4.5.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\qbittorrent.exe	qbittorrent_4.5.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\qbittorrent.pdb	qbittorrent_4.5.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ca.qm	qbittorrent_4.5.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_he.qm	qbittorrent_4.5.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\qt.conf	qbittorrent_4.5.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qt_pt_PT.qm	qbittorrent_4.5.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_gd.qm	qbittorrent_4.5.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ja.qm	qbittorrent_4.5.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_fr.qm	qbittorrent_4.5.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_it.qm	qbittorrent_4.5.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_lv.qm	qbittorrent_4.5.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_nl.qm	qbittorrent_4.5.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_pl.qm	qbittorrent_4.5.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_zh_CN.qm	qbittorrent_4.5.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_zh_TW.qm	qbittorrent_4.5.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_cs.qm	qbittorrent_4.5.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_hu.qm	qbittorrent_4.5.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_nn.qm	qbittorrent_4.5.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_fi.qm	qbittorrent_4.5.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_pt_BR.qm	qbittorrent_4.5.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_tr.qm	qbittorrent_4.5.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_es.qm	qbittorrent_4.5.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_hr.qm	qbittorrent_4.5.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ru.qm	qbittorrent_4.5.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_uk.qm	qbittorrent_4.5.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qt_lt.qm	qbittorrent_4.5.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_bg.qm	qbittorrent_4.5.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_de.qm	qbittorrent_4.5.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ko.qm	qbittorrent_4.5.4_x64_setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 46 IoCs

Processes:

qbittorrent_4.5.4_x64_setup.exeqbittorrent.exefirefox.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\magnet\DefaultIcon	qbittorrent_4.5.4_x64_setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000_Classes\magnet\DefaultIcon\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\",1"	qbittorrent_4.5.4_x64_setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000_Classes\magnet\shell\open\command\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\" \"%1\""	qbittorrent_4.5.4_x64_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000_Classes\Local Settings	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent\FriendlyTypeName = "qBittorrent Torrent File"	qbittorrent_4.5.4_x64_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000_Classes\.torrent	qbittorrent_4.5.4_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent\shell\open	qbittorrent_4.5.4_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.torrent\ = "qBittorrent"	qbittorrent_4.5.4_x64_setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000_Classes\.torrent\Content Type = "application/x-bittorrent"	qbittorrent_4.5.4_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\ = "URL:Magnet link"	qbittorrent_4.5.4_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\DefaultIcon\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\",1"	qbittorrent_4.5.4_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent	qbittorrent_4.5.4_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent\shell\open\command	qbittorrent_4.5.4_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent\shell	qbittorrent_4.5.4_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\shell\ = "open"	qbittorrent_4.5.4_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\shell\open	qbittorrent_4.5.4_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\shell\open\command	qbittorrent_4.5.4_x64_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000_Classes\magnet\shell\open\command	qbittorrent_4.5.4_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent\ = "qBittorrent Torrent File"	qbittorrent_4.5.4_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.torrent	qbittorrent_4.5.4_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet	qbittorrent_4.5.4_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\shell\open\command\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\" \"%1\""	qbittorrent_4.5.4_x64_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000_Classes\magnet\DefaultIcon	qbittorrent_4.5.4_x64_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000_Classes\magnet\shell	qbittorrent_4.5.4_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent\shell\open\command	qbittorrent_4.5.4_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.torrent\Content Type = "application/x-bittorrent"	qbittorrent_4.5.4_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\magnet	qbittorrent_4.5.4_x64_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000_Classes\magnet	qbittorrent_4.5.4_x64_setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000_Classes\magnet\shell\ = "open"	qbittorrent_4.5.4_x64_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000_Classes\magnet\shell\open	qbittorrent_4.5.4_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent\shell\open\command\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\" \"%1\""	qbittorrent_4.5.4_x64_setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000_Classes\.torrent\ = "qBittorrent"	qbittorrent_4.5.4_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\URL Protocol	qbittorrent_4.5.4_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent	qbittorrent_4.5.4_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\Content Type = "application/x-magnet"	qbittorrent_4.5.4_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\magnet\shell	qbittorrent_4.5.4_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\magnet\shell\open\command	qbittorrent_4.5.4_x64_setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000_Classes\magnet\URL Protocol	qbittorrent_4.5.4_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent\shell	qbittorrent_4.5.4_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent\DefaultIcon	qbittorrent_4.5.4_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent\DefaultIcon\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\",1"	qbittorrent_4.5.4_x64_setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000_Classes\magnet\Content Type = "application/x-magnet"	qbittorrent_4.5.4_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent\shell\ = "open"	qbittorrent_4.5.4_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\shell	qbittorrent_4.5.4_x64_setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000_Classes\magnet\ = "URL:Magnet link"	qbittorrent_4.5.4_x64_setup.exe

NTFS ADS 4 IoCs

Processes:

firefox.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\PizzaTower_ONLINE.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\NekoPresence_x64.dll:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\qbittorrent_4.5.4_x64_setup.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\pizza-tower-online_202304_archive.torrent:Zone.Identifier	firefox.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

qbittorrent.exe

pid process

5676 qbittorrent.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

qbittorrent_4.5.4_x64_setup.exe

pid process

5456 qbittorrent_4.5.4_x64_setup.exe
5456 qbittorrent_4.5.4_x64_setup.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

qbittorrent.exe

pid process

5676 qbittorrent.exe

pid	process
5676	qbittorrent.exe

pid	process
5456	qbittorrent_4.5.4_x64_setup.exe
5456	qbittorrent_4.5.4_x64_setup.exe

pid	process
5676	qbittorrent.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

Processes:

firefox.exeqbittorrent_4.5.4_x64_setup.exeAUDIODG.EXE

description	pid	process
Token: SeDebugPrivilege	4440	firefox.exe
Token: SeDebugPrivilege	4440	firefox.exe
Token: SeDebugPrivilege	4440	firefox.exe
Token: SeDebugPrivilege	1544	qbittorrent_4.5.4_x64_setup.exe
Token: SeDebugPrivilege	4440	firefox.exe
Token: SeDebugPrivilege	4440	firefox.exe
Token: SeDebugPrivilege	4440	firefox.exe
Token: SeDebugPrivilege	4440	firefox.exe
Token: SeDebugPrivilege	4440	firefox.exe
Token: SeDebugPrivilege	4440	firefox.exe
Token: SeDebugPrivilege	4440	firefox.exe
Token: SeDebugPrivilege	4440	firefox.exe
Token: SeDebugPrivilege	4440	firefox.exe
Token: SeDebugPrivilege	4440	firefox.exe
Token: SeDebugPrivilege	4440	firefox.exe
Token: SeDebugPrivilege	4440	firefox.exe
Token: SeDebugPrivilege	4440	firefox.exe
Token: SeDebugPrivilege	4440	firefox.exe
Token: SeDebugPrivilege	4440	firefox.exe
Token: SeDebugPrivilege	4440	firefox.exe
Token: SeDebugPrivilege	4440	firefox.exe
Token: SeDebugPrivilege	4440	firefox.exe
Token: SeDebugPrivilege	4440	firefox.exe
Token: SeDebugPrivilege	4440	firefox.exe
Token: SeDebugPrivilege	4440	firefox.exe
Token: SeDebugPrivilege	4440	firefox.exe
Token: 33	4140	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4140	AUDIODG.EXE
Token: SeDebugPrivilege	4440	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

firefox.exeqbittorrent.exe

pid	process
4440	firefox.exe
4440	firefox.exe
4440	firefox.exe
4440	firefox.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

firefox.exeqbittorrent.exe

pid	process
4440	firefox.exe
4440	firefox.exe
4440	firefox.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe

Suspicious use of SetWindowsHookEx 24 IoCs

Processes:

firefox.exePizzaTower_ONLINE.exe

pid	process
4440	firefox.exe
4440	firefox.exe
4440	firefox.exe
4440	firefox.exe
4440	firefox.exe
4440	firefox.exe
4440	firefox.exe
4440	firefox.exe
4440	firefox.exe
4440	firefox.exe
4440	firefox.exe
4440	firefox.exe
4440	firefox.exe
4440	firefox.exe
4440	firefox.exe
4440	firefox.exe
4440	firefox.exe
4440	firefox.exe
4440	firefox.exe
4440	firefox.exe
4440	firefox.exe
4440	firefox.exe
6084	PizzaTower_ONLINE.exe
6084	PizzaTower_ONLINE.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 4980 wrote to memory of 4440	4980	firefox.exe	firefox.exe
PID 4980 wrote to memory of 4440	4980	firefox.exe	firefox.exe
PID 4980 wrote to memory of 4440	4980	firefox.exe	firefox.exe
PID 4980 wrote to memory of 4440	4980	firefox.exe	firefox.exe
PID 4980 wrote to memory of 4440	4980	firefox.exe	firefox.exe
PID 4980 wrote to memory of 4440	4980	firefox.exe	firefox.exe
PID 4980 wrote to memory of 4440	4980	firefox.exe	firefox.exe
PID 4980 wrote to memory of 4440	4980	firefox.exe	firefox.exe
PID 4980 wrote to memory of 4440	4980	firefox.exe	firefox.exe
PID 4980 wrote to memory of 4440	4980	firefox.exe	firefox.exe
PID 4980 wrote to memory of 4440	4980	firefox.exe	firefox.exe
PID 4440 wrote to memory of 4284	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 4284	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 1408	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 2368	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 2368	4440	firefox.exe	firefox.exe
PID 4440 wrote to memory of 2368	4440	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://archive.org/details/pizza-tower-online_202304
1⤵
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://archive.org/details/pizza-tower-online_202304
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4440.0.1700404916\1890149058" -parentBuildID 20221007134813 -prefsHandle 1852 -prefMapHandle 1844 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c127ad0-03ac-4400-b08e-91c3a27f8b5a} 4440 "\\.\pipe\gecko-crash-server-pipe.4440" 1932 2df10717a58 gpu
    3⤵
    PID:4284
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4440.1.840573760\1905794379" -parentBuildID 20221007134813 -prefsHandle 2428 -prefMapHandle 2424 -prefsLen 21706 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {303b3481-efca-478f-84d4-b34689b05e56} 4440 "\\.\pipe\gecko-crash-server-pipe.4440" 2440 2df02770d58 socket
    3⤵
    PID:1408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4440.2.1862928631\1951054077" -childID 1 -isForBrowser -prefsHandle 3440 -prefMapHandle 3216 -prefsLen 21854 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {699e2695-1faf-44cb-979b-929a2b4cd0e5} 4440 "\\.\pipe\gecko-crash-server-pipe.4440" 3404 2df13413e58 tab
    3⤵
    PID:2368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4440.3.1189694006\1542358943" -childID 2 -isForBrowser -prefsHandle 4016 -prefMapHandle 4012 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {90c89790-d54d-4e16-a6fe-4c741ba622f1} 4440 "\\.\pipe\gecko-crash-server-pipe.4440" 4020 2df0275dc58 tab
    3⤵
    PID:3108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4440.5.1885618494\877581035" -childID 4 -isForBrowser -prefsHandle 5144 -prefMapHandle 5148 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {680c0d98-3888-4867-b74b-06e01eab59a1} 4440 "\\.\pipe\gecko-crash-server-pipe.4440" 5224 2df16b1c358 tab
    3⤵
    PID:4592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4440.4.234183935\1177093299" -childID 3 -isForBrowser -prefsHandle 4960 -prefMapHandle 4944 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e0f0b870-800e-43cc-97ee-0224f46a1e09} 4440 "\\.\pipe\gecko-crash-server-pipe.4440" 4988 2df16b1d258 tab
    3⤵
    PID:1240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4440.6.25805102\780813054" -childID 5 -isForBrowser -prefsHandle 5368 -prefMapHandle 5132 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f21769e4-3aa8-4a49-bc01-a5b3feb060c3} 4440 "\\.\pipe\gecko-crash-server-pipe.4440" 5360 2df16b1cf58 tab
    3⤵
    PID:748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4440.7.678253821\252699961" -childID 6 -isForBrowser -prefsHandle 3148 -prefMapHandle 3412 -prefsLen 27371 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {542aa1b0-4fb3-4707-a2bc-3b8778ebdf7f} 4440 "\\.\pipe\gecko-crash-server-pipe.4440" 3324 2df0eb3e358 tab
    3⤵
    PID:1116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4440.8.1102927142\298468534" -childID 7 -isForBrowser -prefsHandle 5904 -prefMapHandle 5900 -prefsLen 27371 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {86a422c5-2621-40f1-bd54-3ef4d5051e92} 4440 "\\.\pipe\gecko-crash-server-pipe.4440" 5880 2df13a28858 tab
    3⤵
    PID:3512
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4440.9.830446761\2093586425" -childID 8 -isForBrowser -prefsHandle 5028 -prefMapHandle 5544 -prefsLen 27371 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {87d5f4f7-2cde-43e0-9f30-0f074cca2457} 4440 "\\.\pipe\gecko-crash-server-pipe.4440" 5340 2df18899a58 tab
    3⤵
    PID:4404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4440.10.261055190\1112855354" -childID 9 -isForBrowser -prefsHandle 6184 -prefMapHandle 6196 -prefsLen 27371 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a5facabf-9fcb-4025-88c8-f881200a8d06} 4440 "\\.\pipe\gecko-crash-server-pipe.4440" 6204 2df16bece58 tab
    3⤵
    PID:2628
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4440.11.980688583\1375925323" -childID 10 -isForBrowser -prefsHandle 6352 -prefMapHandle 6356 -prefsLen 27371 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {64b8ff72-6f87-43d1-a336-38ab0161180e} 4440 "\\.\pipe\gecko-crash-server-pipe.4440" 6344 2df16beb658 tab
    3⤵
    PID:1872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4440.13.1371770609\345963433" -childID 12 -isForBrowser -prefsHandle 10488 -prefMapHandle 10484 -prefsLen 27371 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e714ec4b-15e3-4de1-a5b9-44e779715fc5} 4440 "\\.\pipe\gecko-crash-server-pipe.4440" 10496 2df1881e158 tab
    3⤵
    PID:4836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4440.12.567359553\1647672728" -childID 11 -isForBrowser -prefsHandle 10132 -prefMapHandle 10136 -prefsLen 27371 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {34339803-7814-4aa6-8ea6-476ac08c538a} 4440 "\\.\pipe\gecko-crash-server-pipe.4440" 10124 2df1881d858 tab
    3⤵
    PID:1560
- - C:\Users\Admin\Downloads\qbittorrent_4.5.4_x64_setup.exe
    "C:\Users\Admin\Downloads\qbittorrent_4.5.4_x64_setup.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3904
  - - C:\Users\Admin\Downloads\qbittorrent_4.5.4_x64_setup.exe
      C:\Users\Admin\Downloads\qbittorrent_4.5.4_x64_setup.exe /UAC:301DA /NCRC
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:1544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4440.14.1428938634\1979512395" -childID 13 -isForBrowser -prefsHandle 3272 -prefMapHandle 4564 -prefsLen 27380 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {88c603b0-49ae-4ede-9745-2faae8313616} 4440 "\\.\pipe\gecko-crash-server-pipe.4440" 4552 2df16fb1e58 tab
    3⤵
    PID:5524
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4440.15.1542680470\969088541" -childID 14 -isForBrowser -prefsHandle 10468 -prefMapHandle 10544 -prefsLen 30497 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {281f3fd6-5f3d-4703-8935-852578b48947} 4440 "\\.\pipe\gecko-crash-server-pipe.4440" 5464 2df185f7558 tab
    3⤵
    PID:1412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4440.16.589440427\259979289" -childID 15 -isForBrowser -prefsHandle 5732 -prefMapHandle 10296 -prefsLen 30497 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {74e0cc89-bfaa-45d2-a6c8-d6b23c5eea37} 4440 "\\.\pipe\gecko-crash-server-pipe.4440" 6248 2df1881fc58 tab
    3⤵
    PID:1936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4440.17.2002119498\792895861" -childID 16 -isForBrowser -prefsHandle 5520 -prefMapHandle 5784 -prefsLen 30497 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7291d02f-6949-4a70-a08a-76844734d335} 4440 "\\.\pipe\gecko-crash-server-pipe.4440" 4484 2df14258658 tab
    3⤵
    PID:5452

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5408

C:\Users\Admin\Downloads\qbittorrent_4.5.4_x64_setup.exe
"C:\Users\Admin\Downloads\qbittorrent_4.5.4_x64_setup.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5456

C:\Program Files\qBittorrent\qbittorrent.exe
"C:\Program Files\qBittorrent\qbittorrent.exe" "C:\Users\Admin\Downloads\pizza-tower-online_202304_archive.torrent"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5676

C:\Users\Admin\Downloads\pizza-tower-online_202304\PizzaTower_ONLINE.exe
"C:\Users\Admin\Downloads\pizza-tower-online_202304\PizzaTower_ONLINE.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:6084

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x470 0x240
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4140

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\qBittorrent\qbittorrent.exe

Filesize
28.5MB

MD5
299af9fcfb3067e8f5f64f0866c8fe33

SHA1
5244f3c95dbee3c29c4171899a1a158087419f59

SHA256
aacf4cc8c1591d4a5aeb1d1c32be0c0211fa593a3a4c5107f906a3910fdb6c34

SHA512
35598c4d22d29acec1f98fc61cb5e7ca8d3f281bb0ef586c0f1735497fcba4b714f8f5ab2c539cef8b843b35151e0516acd18724c04160c5cddd642cd754ebd2

Download Submit
C:\Program Files\qBittorrent\qbittorrent.exe

Filesize
28.5MB

MD5
299af9fcfb3067e8f5f64f0866c8fe33

SHA1
5244f3c95dbee3c29c4171899a1a158087419f59

SHA256
aacf4cc8c1591d4a5aeb1d1c32be0c0211fa593a3a4c5107f906a3910fdb6c34

SHA512
35598c4d22d29acec1f98fc61cb5e7ca8d3f281bb0ef586c0f1735497fcba4b714f8f5ab2c539cef8b843b35151e0516acd18724c04160c5cddd642cd754ebd2

Download Submit
C:\Program Files\qBittorrent\qbittorrent.exe

Filesize
28.5MB

MD5
299af9fcfb3067e8f5f64f0866c8fe33

SHA1
5244f3c95dbee3c29c4171899a1a158087419f59

SHA256
aacf4cc8c1591d4a5aeb1d1c32be0c0211fa593a3a4c5107f906a3910fdb6c34

SHA512
35598c4d22d29acec1f98fc61cb5e7ca8d3f281bb0ef586c0f1735497fcba4b714f8f5ab2c539cef8b843b35151e0516acd18724c04160c5cddd642cd754ebd2

Download Submit
C:\Program Files\qBittorrent\qt.conf

Filesize
84B

MD5
af7f56a63958401da8bea1f5e419b2af

SHA1
f66ee8779ca6d570dea22fe34ef8600e5d3c5f38

SHA256
fdb8fa58a6ffc14771ca2b1ef6438061a6cba638594d76d9021b91e755d030d3

SHA512
02f70ca7f1291b25402989be74408eb82343ab500e15e4ac22fbc7162eb9230cd7061eaa7e34acf69962b57ed0827f51ceaf0fa63da3154b53469c7b7511d23d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\48tr9744.default-release\activity-stream.discovery_stream.json.tmp

Filesize
145KB

MD5
29af6a4780fada32a8956c38e83e49b1

SHA1
2525fb1916ffd1353d8a2a7dd7527fe08afc1574

SHA256
48c8113b002e4843455903b5ad8dfdc4b596f5689a6d0b42a12ee60d438ecc9b

SHA512
73a6206d9982b2af3996e2e300fd83cda3c2be328400aba1839f6e37261771031b6da3b40c9e3629f7110c8e755967b61ff0f20b3b5b06948ed44f7feb94b1e9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\48tr9744.default-release\activity-stream.discovery_stream.json.tmp

Filesize
147KB

MD5
fdefd5ef8bfd6f2a163b51d33b9c6d76

SHA1
08c8abb79f227040cda1474bca4e063448f0185a

SHA256
e3982bd707ee7deb7682fcde3087918c7f3b023f5136ab96e198f3b4f6b8d18f

SHA512
63bd7154621d9b817d930a35f2fa24f308c18e0f441c64be8cf5927725b0046ad53dfcd9c388bf9c6f2dd1560068ac0af4f2edc42d2d0243000dcac9119aab07

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\48tr9744.default-release\cache2\doomed\19379

Filesize
40KB

MD5
715537d33d879bfe60ab8bcddcbd454b

SHA1
84a9e4c24e1ed989d033583dcb68ed2c622e5591

SHA256
8662bb6251f042d496b412b94ac14fed729146fbeb70ff7c41ceeb2c438bae62

SHA512
f0263cfb0e24fdfc864fd915dc5050b7bd3ea991b38bbbcec421792851868bd174b3ea80f492f608a6fef6e14e090415d27b65f08b69a5ba62cd826a4bcdcf5f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\48tr9744.default-release\cache2\doomed\25866

Filesize
9KB

MD5
8ad4d6d8d34d7cd77d53ac9558a1b496

SHA1
39e7107a9482cce56a8fe57b8d95a1d5a8ca6196

SHA256
6f87a771ddc7463e5bac35c89e0f775512cd4eaf387ebf1d346254aa3fbb4408

SHA512
8b66cc2f52c8760b48047e1dbeefbe1d4ca4ebd92450f38f1978029c8347b4328b01e8b5477e0181549c27869ec09a791bb5b630b51e7ff0dda87777b1fcfa0a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\48tr9744.default-release\cache2\doomed\2743

Filesize
9KB

MD5
246c9d3676b2671fef399ab9488c0fe1

SHA1
b92e583a19439b77c3e528e6df052bbced85c521

SHA256
e06773d13e61ab8135017fc36adafae6f364569b14589498e6b1da1be3e21b2c

SHA512
0e0b90e6fd3ae356e21688ae87b87f8f07f583c3c7c546ccc2df33b91985d01318383146cd4d7a026d2622077d62576cde558f12cff1006e7a01772900e856ca

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\48tr9744.default-release\cache2\entries\58D46C4012E4AD3623A4EA72BB3C1CDD25B3FF87

Filesize
14KB

MD5
7d99af66e2c23b784c4039ed4d8fb4d8

SHA1
d8f5e2b717a88eac65ecb43174ea2d31be45e8b7

SHA256
5d08746af2ded28cff5fbb6a7e3e718f0310576f91186acd8c2c4d19b49b58c0

SHA512
b023de8f9975a60b87f72fb3173616189219047dbe3e1c9a2cce3081c079accb6aa7558d1c7830c00c246a8b42779177a79a323358a0cebc1810dbe30a68e643

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\48tr9744.default-release\personality-provider\nb_model_build_attachment_arts_and_entertainment.json

Filesize
67KB

MD5
6c651609d367b10d1b25ef4c5f2b3318

SHA1
0abcc756ea415abda969cd1e854e7e8ebeb6f2d4

SHA256
960065cc44a09bef89206d28048d3c23719d2f5e9b38cfc718ca864c9e0e91e9

SHA512
3e084452eefe14e58faa9ef0d9fda2d21af2c2ab1071ae23cde60527df8df43f701668ca0aa9d86f56630b0ab0ca8367803c968347880d674ad8217fba5d8915

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\48tr9744.default-release\personality-provider\nb_model_build_attachment_autos_and_vehicles.json

Filesize
44KB

MD5
39b73a66581c5a481a64f4dedf5b4f5c

SHA1
90e4a0883bb3f050dba2fee218450390d46f35e2

SHA256
022f9495f8867fea275ece900cfa7664c68c25073db4748343452dbc0b9eda17

SHA512
cfb697958e020282455ab7fabc6c325447db84ead0100d28b417b6a0e2455c9793fa624c23cb9b92dfea25124f59dcd1d5c1f43bf1703a0ad469106b755a7cdd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\48tr9744.default-release\personality-provider\nb_model_build_attachment_beauty_and_fitness.json

Filesize
33KB

MD5
0ed0473b23b5a9e7d1116e8d4d5ca567

SHA1
4eb5e948ac28453c4b90607e223f9e7d901301c4

SHA256
eed46e8fe6ff20f89884b4fc68a81e8d521231440301a01bb89beec8ebad296b

SHA512
464508d7992edfa0dfb61b04cfc5909b7daacf094fc81745de4d03214b207224133e48750a710979445ee1a65bb791bf240a2b935aacaf3987e5c67ff2d8ba9c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\48tr9744.default-release\personality-provider\nb_model_build_attachment_blogging_resources_and_services.json

Filesize
33KB

MD5
c82700fcfcd9b5117176362d25f3e6f6

SHA1
a7ad40b40c7e8e5e11878f4702952a4014c5d22a

SHA256
c9f2a779dba0bc886cc1255816bd776bdc2e8a6a8e0f9380495a92bb66862780

SHA512
d38e65ab55cee8fef538ad96448cd0c6b001563714fc7b37c69a424d0661ec6b7d04892cf4b76b13ddbc7d300c115e87e0134d47c3f38ef51617e5367647b217

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\48tr9744.default-release\personality-provider\nb_model_build_attachment_books_and_literature.json

Filesize
67KB

MD5
df96946198f092c029fd6880e5e6c6ec

SHA1
9aee90b66b8f9656063f9476ff7b87d2d267dcda

SHA256
df23a5b6f583ec3b4dce2aca8ff53cbdfadfd58c4b7aeb2e397eade5ff75c996

SHA512
43a9fc190f4faadef37e01fa8ad320940553b287ed44a95321997a48312142f110b29c79eed7930477bfb29777a5a9913b42bf22ce6bb3e679dda5af54a125ea

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\48tr9744.default-release\personality-provider\nb_model_build_attachment_business_and_industrial.json

Filesize
45KB

MD5
a92a0fffc831e6c20431b070a7d16d5a

SHA1
da5bbe65f10e5385cbe09db3630ae636413b4e39

SHA256
8410809ebac544389cf27a10e2cbd687b7a68753aa50a42f235ac3fc7b60ce2c

SHA512
31a8602e1972900268651cd074950d16ad989b1f15ff3ebbd8e21e0311a619eef4d7d15cdb029ea8b22cf3b8759fa95b3067b4faaadcb90456944dbc3c9806a9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\48tr9744.default-release\personality-provider\nb_model_build_attachment_computers_and_electronics.json

Filesize
45KB

MD5
6ccd943214682ac8c4ec08b7ec6dbcbd

SHA1
18417647f7c76581d79b537a70bf64f614f60fa2

SHA256
ab20b97406b0d9bf4f695e5ec7db4ebad5efb682311e74ca757d45b87ffc106b

SHA512
e57573d6f494df8aa7e8e6a20427a18f6868e19dc853b441b8506998158b23c7a4393b682c83b3513aae5075a21148dd8ca854a11dabcea6a0a0db8f2e6828b8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\48tr9744.default-release\personality-provider\nb_model_build_attachment_finance.json

Filesize
33KB

MD5
e95c2d2fc654b87e77b0a8a37aaa7fcf

SHA1
b4b00c9554839cab6a50a7ed8cd43d21fdaf35dc

SHA256
384bf5fcc6928200c7ebb1f03f99bf74f6063e78d3cd044374448f879799318e

SHA512
9696998a8d0e3a85982016ff0a22bb8ae1790410f1f6198bb379c0a192579f24c75c25c7648b76b00d25a32ac204178acaccd744ee78846dfc62ebf70bf7b93a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\48tr9744.default-release\personality-provider\nb_model_build_attachment_food_and_drink.json

Filesize
67KB

MD5
70ba02dedd216430894d29940fc627c2

SHA1
f0c9aa816c6b0e171525a984fd844d3a8cabd505

SHA256
905357002f2eced8bba1be2285a9b83198f60d2f9bb1144b5c119994f2ec6e34

SHA512
3ae60d0bf3c45d28e340d97106790787be2cc80ba579d313b5414084664b86e89879391c99e94b6e33bdc5508ea42a9fd34f48ca9b1e7adfa7b6dd22c783c263

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\48tr9744.default-release\personality-provider\nb_model_build_attachment_games.json

Filesize
44KB

MD5
4182a69a05463f9c388527a7db4201de

SHA1
5a0044aed787086c0b79ff0f51368d78c36f76bc

SHA256
35e67835a5cf82144765dfb1095ebc84ac27d08812507ad0a2d562bf68e13e85

SHA512
40023c9f89e0357fae26c33a023609de96b2a0b439318ef944d3d5b335b0877509f90505d119154eaa81e1097ecfb5aa44dd8bb595497cdecfc3ee711a1fe1d5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\48tr9744.default-release\personality-provider\nb_model_build_attachment_health.json

Filesize
33KB

MD5
11711337d2acc6c6a10e2fb79ac90187

SHA1
5583047c473c8045324519a4a432d06643de055d

SHA256
150f21c4f60856ab5e22891939d68d062542537b42a7ce1f8a8cec9300e7c565

SHA512
c2301ed72f623b22f05333c5ecc5ebf55d8a2d9593167cc453a66d8f42c05ff7c11e2709b6298912038a8ea6175f050bbc6d1fc4381f385f7ad7a952ad1e856b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\48tr9744.default-release\personality-provider\nb_model_build_attachment_hobbies_and_leisure.json

Filesize
67KB

MD5
bb45971231bd3501aba1cd07715e4c95

SHA1
ea5bfd43d60a3d30cda1a31a3a5eb8ea0afa142a

SHA256
47db7797297a2a81d28c551117e27144b58627dbac1b1d52672b630d220f025d

SHA512
74767b1badbd32cacd3f996b8172df9c43656b11fea99f5a51fff38c6c6e2120fae8bdd0dd885234a3f173334054f580164fdf8860c27cbcf5fb29c5bcdc060d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\48tr9744.default-release\personality-provider\nb_model_build_attachment_home_and_garden.json

Filesize
33KB

MD5
250acc54f92176775d6bdd8412432d9f

SHA1
a6ad9ad7519e5c299d4b4ba458742b1b4d64cb65

SHA256
19edd15ebce419b83469d2ab783c0c1377d72a186d1ff08857a82bca842eea54

SHA512
a52c81062f02c15701f13595f4476f0a07735034fcf177b1a65b001394a816020ee791fed5afae81d51de27630b34a85efa717fe80da733556fdda8739030f49

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\48tr9744.default-release\personality-provider\nb_model_build_attachment_internet_and_telecom.json

Filesize
67KB

MD5
36689de6804ca5af92224681ee9ea137

SHA1
729d590068e9c891939fc17921930630cd4938dd

SHA256
e646d43505c9c4e53dbaa474ef85d650a3f309ccf153d106f328d9b6aeb66d52

SHA512
1c4f4aa02a65a9bbdf83dc5321c24cbe49f57108881616b993e274f5705f0466be2dd3389055a725b79f3317c98bdf9f8d47f86d62ebd151e4c57cc4dca2487c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\48tr9744.default-release\personality-provider\nb_model_build_attachment_jobs_and_education.json

Filesize
33KB

MD5
2d69892acde24ad6383082243efa3d37

SHA1
d8edc1c15739e34232012bb255872991edb72bc7

SHA256
29080288b2130a67414ecb296a53ddd9f0a4771035e3c1b2112e0ce656a7481a

SHA512
da391152e1fbce1f03607b486c5dea9a298a438e58e440ebb7b871bd5c62d7339b540eed115b4001b9840de1ba3898c6504872ff9094ba4d6a47455051c3f1c5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\48tr9744.default-release\personality-provider\nb_model_build_attachment_law_and_government.json

Filesize
68KB

MD5
80c49b0f2d195f702e5707ba632ae188

SHA1
e65161da245318d1f6fdc001e8b97b4fd0bc50e7

SHA256
257ee9a218a1b7f9c1a6c890f38920eb7e731808e3d9b9fc956f8346c29a3e63

SHA512
972e95de7fe330c61cd22111bd3785999d60e7c02140809122d696a1f1f76f2cd0d63d6d92f657cdec24366d66b681e24f2735a8aabb8bcecec43c74e23fb4f5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\48tr9744.default-release\personality-provider\nb_model_build_attachment_online_communities.json

Filesize
67KB

MD5
37a74ab20e8447abd6ca918b6b39bb04

SHA1
b50986e6bb542f5eca8b805328be51eaa77e6c39

SHA256
11b6084552e2979b5bc0fd6ffdc61e445d49692c0ae8dffedc07792f8062d13f

SHA512
49c6b96655ba0b5d08425af6815f06237089ec06926f49de1f03bc11db9e579bd125f2b6f3eaf434a2ccf10b262c42af9c35ab27683e8e9f984d5b36ec8f59fd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\48tr9744.default-release\personality-provider\nb_model_build_attachment_people_and_society.json

Filesize
45KB

MD5
b1bd26cf5575ebb7ca511a05ea13fbd2

SHA1
e83d7f64b2884ea73357b4a15d25902517e51da8

SHA256
4990a5d17bea15617624c48a0c7c23d16e95f15e2ec9dd1d82ee949567bbaec0

SHA512
edcede39c17b494474859bc1a9bbf18c9f6abd3f46f832086db3bb1337b01d862452d639f89f9470ca302a6fcb84a1686853ebb4b08003cb248615f0834a1e02

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\48tr9744.default-release\personality-provider\nb_model_build_attachment_pets_and_animals.json

Filesize
44KB

MD5
5b26aca80818dd92509f6a9013c4c662

SHA1
31e322209ba7cc1abd55bbb72a3c15bc2e4a895f

SHA256
dd537bfb1497eb9457c0c8ecbd2846f325e13ddef3988fd293a29e68ab0b2671

SHA512
29038f9f3b9b12259fb42daa93cdefabb9fb32a10f0d20f384a72fe97214eff1864b7fa2674c37224b71309d7d9cea4e36abd24a45a0e65f0c61dc5ca161ec7c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\48tr9744.default-release\personality-provider\nb_model_build_attachment_real_estate.json

Filesize
67KB

MD5
9899942e9cd28bcb9bf5074800eae2d0

SHA1
15e5071e5ed58001011652befc224aed06ee068f

SHA256
efcf6b2d09e89b8c449ffbcdb5354beaa7178673862ebcdd6593561f2aa7d99a

SHA512
9f7a5fbe6d46c694e8bc9b50e7843e9747ea3229cf4b00b8e95f1a5467bd095d166cbd523b3d9315c62e9603d990b8e56a018ba4a11d30ad607f5281cc42b4cd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\48tr9744.default-release\personality-provider\nb_model_build_attachment_reference.json

Filesize
56KB

MD5
567eaa19be0963b28b000826e8dd6c77

SHA1
7e4524c36113bbbafee34e38367b919964649583

SHA256
3619daa64036d1f0197cdadf7660e390d4b6e8c1b328ed3b59f828a205a6ea49

SHA512
6766919b06ca209eaed86f99bee20c6dad9cc36520fc84e1c251a668bcfe0afcf720ea6c658268dc3bbaaf602bfdf61eb237c68e08d5252ea6e5d1d2a373b9fe

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\48tr9744.default-release\personality-provider\nb_model_build_attachment_science.json

Filesize
56KB

MD5
7a8fd079bb1aeb4710a285ec909c62b9

SHA1
8429335e5866c7c21d752a11f57f76399e5634b6

SHA256
9606ce3988b2d2a4921b58ac454f54e53a9ea8f358326522a8b1dcc751b50b32

SHA512
8fc1546e509b5386c9e1088e0e3a1b81f288ef67f1989f3e83888057e23769907a2b184d624a4e4c44fcd5b88d719bd4cca94dfb33798804a721b8be022ec0c6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\48tr9744.default-release\personality-provider\nb_model_build_attachment_shopping.json

Filesize
67KB

MD5
97d4a0fd003e123df601b5fd205e97f8

SHA1
a802a515d04442b6bde60614e3d515d2983d4c00

SHA256
bfd7e68ddca6696c798412402965a0384df0c8c209931bbadabf88ccb45e3bb6

SHA512
111e8a96bc8e07be2d1480a820fc30797d861a48d80622425af00b009512aacb30a2df9052c53bfbf4ee0800b6e6f5b56daa93d33f30fecb52e2f3850dfa9130

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\48tr9744.default-release\personality-provider\nb_model_build_attachment_sports.json

Filesize
56KB

MD5
ce4e75385300f9c03fdd52420e0f822f

SHA1
85c34648c253e4c88161d09dd1e25439b763628c

SHA256
44da98b03350e91e852fe59f0fc05d752fc867a5049ab0363da8bb7b7078ad14

SHA512
d119dc4706bbf3b6369fe72553cfacf1c9b2688e0188a7524b56d3e2ac85582a18bbee66d5594e0fb40767432646c23bf3e282090bd9b4c29f989a374aeae61f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\48tr9744.default-release\personality-provider\nb_model_build_attachment_travel.json

Filesize
67KB

MD5
48139e5ba1c595568f59fe880d6e4e83

SHA1
5e9ea36b9bb109b1ecfc41356cd5c8c9398d4a78

SHA256
4336ac211a822b0a5c3ce5de0d4730665acc351ee1965ea8da1c72477e216dfa

SHA512
57e826f0e1d9b12d11b05d47e2f5ae4f5787537862f26e039918cb14faff4bc854298c0b7de3023e371756a331c0f3ee1aa7cebbbf94ec70cdfc29e00a900ed1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\48tr9744.default-release\personality-provider\recipe_attachment.json

Filesize
1KB

MD5
be3d0f91b7957bbbf8a20859fd32d417

SHA1
fbc0380fe1928d6d0c8ab8b0a793a2bba0722d10

SHA256
fc07d42847eeaf69dcbf1b9a16eb48b141c11feb67aa40724be2aee83cb621b7

SHA512
8da24afcf587fbd4f945201702168e7cfc12434440200d00f09ddcd1d1d358a5e01065ac2a411fdf96a530e94db3697e3530578b392873cf874476b5e65d774a

Download Submit
C:\Users\Admin\AppData\Local\PizzaTower_ONLINE\saveData1.ini

Filesize
30B

MD5
c27fee3e95b72cb5b5238a1165aeca07

SHA1
7cee326492c9fc2b64587dbed194ef43d5a27499

SHA256
56b6519fd8d98c618862f7fc95a053e75bdaf2835faac72e96cd8b4cfd90204a

SHA512
8ddcc93bb2ecc6e90ac772abb9a956c43f9569547511ef5cd985866d29879b81c71a63c815a097171549512dc3a433329d6f5704d6c91f9b46de9e8900b84c6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse4246.tmp\FindProcDLL.dll

Filesize
3KB

MD5
b4faf654de4284a89eaf7d073e4e1e63

SHA1
8efcfd1ca648e942cbffd27af429784b7fcf514b

SHA256
c0948b2ec36a69f82c08935fac4b212238b6792694f009b93b4bdb478c4f26e3

SHA512
eef31e332be859cf2a64c928bf3b96442f36fe51f1a372c5628264a0d4b2fc7b3e670323c8fb5ffa72db995b8924da2555198e7de7b4f549d9e0f9e6dbb6b388

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse4246.tmp\LangDLL.dll

Filesize
5KB

MD5
68b287f4067ba013e34a1339afdb1ea8

SHA1
45ad585b3cc8e5a6af7b68f5d8269c97992130b3

SHA256
18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026

SHA512
06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse4246.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse4246.tmp\UAC.dll

Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse4246.tmp\modern-wizard.bmp

Filesize
25KB

MD5
cbe40fd2b1ec96daedc65da172d90022

SHA1
366c216220aa4329dff6c485fd0e9b0f4f0a7944

SHA256
3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2

SHA512
62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse4246.tmp\nsDialogs.dll

Filesize
9KB

MD5
6c3f8c94d0727894d706940a8a980543

SHA1
0d1bcad901be377f38d579aafc0c41c0ef8dcefd

SHA256
56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2

SHA512
2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse4246.tmp\nsisFirewallW.dll

Filesize
8KB

MD5
f5bf81a102de52a4add21b8a367e54e0

SHA1
cf1e76ffe4a3ecd4dad453112afd33624f16751c

SHA256
53be5716ad80945cb99681d5dbda60492f5dfb206fbfdb776b769b3eeb18d2c2

SHA512
6e280a75f706474ad31b2ce770fa34f54cb598528fac4477c466200a608b79c0f9b84011545595d9ba94331ad08e2f51bd42de91f92379db27686a28ba351256

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse4246.tmp\nsisFirewallW.dll

Filesize
8KB

MD5
f5bf81a102de52a4add21b8a367e54e0

SHA1
cf1e76ffe4a3ecd4dad453112afd33624f16751c

SHA256
53be5716ad80945cb99681d5dbda60492f5dfb206fbfdb776b769b3eeb18d2c2

SHA512
6e280a75f706474ad31b2ce770fa34f54cb598528fac4477c466200a608b79c0f9b84011545595d9ba94331ad08e2f51bd42de91f92379db27686a28ba351256

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse4246.tmp\nsisFirewallW.dll

Filesize
8KB

MD5
f5bf81a102de52a4add21b8a367e54e0

SHA1
cf1e76ffe4a3ecd4dad453112afd33624f16751c

SHA256
53be5716ad80945cb99681d5dbda60492f5dfb206fbfdb776b769b3eeb18d2c2

SHA512
6e280a75f706474ad31b2ce770fa34f54cb598528fac4477c466200a608b79c0f9b84011545595d9ba94331ad08e2f51bd42de91f92379db27686a28ba351256

Download Submit
C:\Users\Admin\AppData\Local\Temp\nslFC05.tmp\UAC.dll

Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
C:\Users\Admin\AppData\Local\Temp\nslFC05.tmp\UAC.dll

Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvD3BD.tmp\UAC.dll

Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
19KB

MD5
3c2dcb939cd306bfc25c7721011ad984

SHA1
9e0b5716310c72dae40bcfc8de0f4eca29c86dc6

SHA256
4627dd83167f6e7b39d185be241e949678f285a553d5f4c58f72c8e80edc52eb

SHA512
610690ab4a61cf1f7bbcc3241147551f74ac5657e1cbb44211267e1947651e136bdd06c9dff7da7a4fa9e7ae81aae956ab2eccd1bede3bd7c8233b6ae8b62a85

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
19KB

MD5
d7f9f34739b3fa3ab91e4fdf3a089fa1

SHA1
4b23d02c1c753587bc29dc9e81b3a58de2f06b6f

SHA256
e2e875b2cd88865e4fde540f045ba5361cba59d6df7ed511cbed55bf45a25087

SHA512
930df9e68fe9e0dd2becfcfd9188efee0029625fec22d016f018c99cbeda561c7469002b3883561422e20c2d3a391cc724e11cd7e4479ff671a8a8793e93941f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
19KB

MD5
12251051d9af9014aff13b267f8f9d9a

SHA1
122508cdb0b297c3d1bf92422dfc8c1a88cf3be7

SHA256
93c0707756ccbd4f38e86aee72ef9cd38ac4ac4b266c6c8a74c758dfcb12ef60

SHA512
655a52b8203c5c118b09f985d024ad9ef240644a2b732703a9bd0270cd4c3e9903c1fa934da23a57e495b16cc29949fa7d0a69ece2f79398301e22db1b23a0d4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\48tr9744.default-release\SiteSecurityServiceState.txt

Filesize
1KB

MD5
f16af8c65d5c81ad423b7801cc116a43

SHA1
55963077a9d5f1dd5fa7d591d426bae701aa7c50

SHA256
57971ee43ae2bd5a3bd87d72e0347207d3a1697c3382cdf45a8fb044944614a1

SHA512
b9406e41db5d0a41f3ae3296dafc65691661568426d6c207025b421b315cf9628bda73d9678f93347b71c80d9bb2dae76e599df53221f3888d96294fd450c78a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\48tr9744.default-release\addonStartup.json.lz4

Filesize
5KB

MD5
94030df6b0e441add1eccc29764c964b

SHA1
a8e26159d7033fdd7130fb475a16fd818f00364d

SHA256
fb7c7b9af7890e1db6152b2d1c449347490e7c07020c40d310eeac6685d037d8

SHA512
82a767489410dcbd6a0e7b505c65cdd8187dbdfad9e9c5cf09775d5c99cb54d1feec580e60598be4f84b23156f7af31e278f3ea09c7cbcbc27b8c7144dff9264

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\48tr9744.default-release\bookmarkbackups\bookmarks-2023-06-23_11_z2jrr3EmwB0mTzMVRYYctg==.jsonlz4

Filesize
935B

MD5
663085a07173c44cfd8c4c88aa9cd576

SHA1
ddae94c8da02ccb67bd2ffc33ec0dc20f4a1abc0

SHA256
fea9013dc7b749d803a733ca810af89c6e038bbb45806ef48da90fa55294defb

SHA512
9dceab7316d7432446b477a311b54989d3ee48eaafe94ffb055a3ae653fc1661e751995b7960e5ad852892ef8e7c7aaf3955872779e3d0b9bed8041ace387f03

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\48tr9744.default-release\broadcast-listeners.json

Filesize
216B

MD5
939ac8a8bbcd02d58abf7f55e4477446

SHA1
fae06442ab09c025c4b2f20f83f31f7120a4e09b

SHA256
3c390adaf7aaa6aca30b70c12b268c5627b271cddc1bb852685f815fa0465b07

SHA512
57316c32ef714c299e65bac6fd9c2c9a6f7e449fee91e94e34b70864bd30c12839b91789379f6e65f612f21746186d1c96451f2824b4fc442fb643ed18bda9c1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\48tr9744.default-release\datareporting\glean\db\data.safe.bin

Filesize
182B

MD5
b1c8aa9861b461806c9e738511edd6ae

SHA1
fe13c1bbc7e323845cbe6a1bb89259cbd05595f8

SHA256
7cea48e7add3340b36f47ba4ea2ded8d6cb0423ffc2a64b44d7e86e0507d6b70

SHA512
841a0f8c98dd04dc9a4be2f05c34ecd511388c76d08ca0f415bfb6056166d9a521b8bc2c46b74697f3ecdac5141d1fe6af76dd0689350caca14e9f849ee75a8b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\48tr9744.default-release\datareporting\glean\db\data.safe.bin

Filesize
182B

MD5
7fba44cb533472c1e260d1f28892d86b

SHA1
727dce051fc511e000053952d568f77b538107bb

SHA256
14fb5cda1708000576f35c39c15f80a0c653afaf42ed137a3d31678f94b6e8bf

SHA512
1330b0f39614a3af2a6f5e1ea558b3f5451a7af20b6f7a704784b139a0ec17a20c8d7b903424cb8020a003319a3d75794e9fe8bc0aeb39e81721b9b2fdb9e031

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\48tr9744.default-release\datareporting\glean\db\data.safe.bin

Filesize
182B

MD5
63b1bb87284efe954e1c3ae390e7ee44

SHA1
75b297779e1e2a8009276dd8df4507eb57e4e179

SHA256
b017ee25a7f5c09eb4bf359ca721d67e6e9d9f95f8ce6f741d47f33bde6ef73a

SHA512
f7768cbd7dd80408bd270e5a0dc47df588850203546bbc405adb0b096d00d45010d0fb64d8a6c050c83d81bd313094036f3d3af2916f1328f3899d76fad04895

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\48tr9744.default-release\extensions.json

Filesize
41KB

MD5
ffa285e0db09f02675201fcf3b901627

SHA1
88a723376a077cca356656e848eeab459b9461f1

SHA256
d16a3a2afa17730ade7c4d30e60f245cd26ff591b6ef2b1b8efcb5f49a995da3

SHA512
98321938acee55a77f543401d1c01b639523b00406c7558c52dae1f649a63e2e46e92304f1ff147e39dd016f17759c19c8fcee8a64d0c7ab71d61d653ac58111

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\48tr9744.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\48tr9744.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\48tr9744.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\48tr9744.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\48tr9744.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\48tr9744.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\48tr9744.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\48tr9744.default-release\prefs-1.js

Filesize
6KB

MD5
3e0e1659700bf8d5da4af8d5d061d714

SHA1
4e079fb0b0170aa7289b5f191f9f2031dc7d060b

SHA256
db119946d97e60cf6582927959695b403e823e80c529456358f5a88338c7d7d7

SHA512
7a1e327b438c591b2285f31c53cced923452addc385861c6e745e68cf75d3d80e36c1df498bee226a555eb605fc9230dd42c9d9cdbe152a397a8241c0c5bc964

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\48tr9744.default-release\prefs-1.js

Filesize
8KB

MD5
2dc3c84f2beaa5266b45c40e2d767f83

SHA1
cc2fefbd07f185dc67a146311d695da674daf0b7

SHA256
306860a97badd1f687d781b809285651ab4c2428cd34bdceee9d86046240ce88

SHA512
2560a2425a14c89b252f728527873e0892fb4212c0c4396d3e0835cdec806b3dae2458ade2c1985d4a054740c4d4cf25f6fe32d850839a72a8f563689e6ad749

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\48tr9744.default-release\prefs-1.js

Filesize
10KB

MD5
bde0debe418850f565b9be13cb87ea30

SHA1
db057b23023f6bf6e04f91cafab812ae3fd7d5ed

SHA256
fe60a42302396d9b00e008c6625ffe876848b4d39c04f9844eeeba60bb86b31c

SHA512
3aeec8b4ba470c983378be568f9d46e80a936a69cb6a532791e35ca458604c396a70db3aa29a68add9c3b645e9d460a92ce60f5f1caf4bb3cd799e689e439247

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\48tr9744.default-release\prefs-1.js

Filesize
11KB

MD5
d1602131426bcfc23c43488dac67ef3e

SHA1
6dadc63ff2b67276a6ed2add4a2dc437a9bde76e

SHA256
3b2085141c129acd45c2d7562251208fb2e1a2dcde32ee46abed3522bdf6453f

SHA512
a0033b6dc2082d20ebbf058731f3dd5a3abdcc3cecd522737d6ae9b0c394c70e6a21f9da35d5d0c38ac31739f79b7ec56d20463edc89c5133020a1d46295db87

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\48tr9744.default-release\prefs-1.js

Filesize
7KB

MD5
b940a4245ad9d64fedaa320f9e6b0298

SHA1
7ed4066e46841d689391710651388657d9fcd1ff

SHA256
93899630e15074923211a7ec1f4b34b8cb29838ee108d12a03199b66089b8c93

SHA512
882cf673909faac3cda8028320fce3bf7101958c27b3295a11cc7a872b7ee6eb17b5d055850f4d932a89384788f76e142f217b74958f721a4eed71c20400bafc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\48tr9744.default-release\prefs-1.js

Filesize
7KB

MD5
7604285a528d384a4b2f9a87417444ea

SHA1
27b17842bfe4aedb31d92c1ccf4c12a9bcdf5fd1

SHA256
0ade953275d77b05ef9212d5ccaf61357e635b333ea46c1c72b8535a49082c3d

SHA512
d47b60dcff6b0738b3580b3297f6a393fb5af888565423c34f435dec828b1362d29c490df1f52086b9bf1446febe122fb0eb6a75172681fb5d0710d7887ed636

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\48tr9744.default-release\prefs.js

Filesize
11KB

MD5
9d51bf676afeb8562a4542e260bade0d

SHA1
0966fd56fd3484a917b691ab73a468dc17b44d60

SHA256
563b5460b1ab21ed479d5501753aa657efd3ff3b942abc7e86751d1441baff4e

SHA512
385e856307da8d3d33f165097e1b77792d041488dee0c6fe422c3be8ce34f0be0082f1573d988d203ec8c979b31f6872e08d1a027dd18e5da5b91b837b19201d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\48tr9744.default-release\prefs.js

Filesize
10KB

MD5
4bb58378f03a2951e6db8ab2e6dcfc52

SHA1
e8722b8a46d1cfc677a4914fb61c5027a8877626

SHA256
aba80ed7b76c0b605096e9d6bdae16bfeaa40c0d58d4589f6c65df6b1a539d3c

SHA512
da4bf0d32dffe82b9b76809fe0acab29e7d783884856885071c26ad14812d92582932c8aea557af7b08c8d4b76d4a13f35bf177fd0a344b6ba716115f3415fdf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\48tr9744.default-release\search.json.mozlz4

Filesize
296B

MD5
033eb0645837c8b618a593f7b9a72642

SHA1
cf4c2e7ccaa275ee47cdd945a7bd1f8b57c61172

SHA256
3409fd08295094b37673d748a0374cf0afaecf1671188b2ed012626cad67a582

SHA512
27dd0743306b0845c06b3be3e3ae2f515777dced4bbf91a4864bb95c5873e2d6351d99be36d4762a2ba8262130c6d139db3f4f5272afb8717e02b09c1e39c2b4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\48tr9744.default-release\sessionCheckpoints.json

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\48tr9744.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
6ffa3d4dfbfabd7b172333ab17a70dd3

SHA1
f2b0953f151f81960b4fda3e15302b3944de0b4f

SHA256
8d4033a2bb9596437a5cf8beb9851f7ec24a0aa83063b2b14b8827ac7ff0cf52

SHA512
185bf2885cd1f61889a8fd96c5848e6a88a823500a3f8f8f485896396efee219e63a1dd6e066c5de13f087da786e2c3899f4c7e6263ce72a2920643873bb5b08

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\48tr9744.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
671884c337ca21e3c5eda279d3ae03f2

SHA1
d7a9234d796b404a33def9faaf2f9a1d5e7d5a5e

SHA256
ae81b1d0ece64bb63f1abe61bcd936f4e3e068a937aa508fd5057bc7929af7f2

SHA512
494337ee6349da3f2f77c642fbd086c7f4fee5009a4819dc6c7060e2b30d53a0bf5a93599aba58d15c345a6cfebe454026addc0023f099602079fd697d02f340

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\48tr9744.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
dd5d19e8f8c4a0c00eb328c195458156

SHA1
72d69592aef863a37ab21ff8f08a83baf1897f7b

SHA256
a7a310b0b70dd6258b448fa1f56f78ebdda4d99823a1a3ca8ed591c35421f72c

SHA512
6ae1d096ec0a52c8f83aa19a66cc70879c8b77e99c842e47c49bd6a101ee9c72559e38a69371399475a43de60cee878a627b8b2b276470cac0b3fead9e8fa332

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\48tr9744.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
9ded5717d2aecd3a166f9613bbe32c7b

SHA1
233d8a21121a111c2b3dc3834fec81a6a93eb9b9

SHA256
3267ed3188dc0103028f345491de9b566e4781a5787dada8a4eed95e8190f9dc

SHA512
295f6d368177bf107e1f001fb4d8101cc9c61493fad1f9377e8c911a031524fd8242157285182f164b49ada0f10f0a2d402facce8e3462901984fe99054fd6f1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\48tr9744.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
95993b139b3420421b85bfb5de21e53e

SHA1
e0ee0e06a31293cbb6f4a63a63fabfd758385d29

SHA256
0a021090a5b88d0c6c26893b3969f14c497839c9f361cb99806c557d7e04f0ae

SHA512
58e702877d66cdb8891fdb58e38e58c06cc7aceb898c06d4f2a2e48e2b3e345fd3b25141be28ce69582c656a4351ad43eb3bdcb0c3f40725b15a1cf165969102

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\48tr9744.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
37add672b40d2f8b4602574c690b2f60

SHA1
a2206a9185705fc8b98971e347b30ed52442083c

SHA256
09984d2a3cb871507c37ad29811adac31020db3cabbdc870b50b09e679ccef94

SHA512
32ab1089d4a39e8f111752ba580ebe242f7679720866c4fe3b230c9dfcccbcec5354e94b001adb23effb1756877eaa0e9506d0fcf64293fe36194b1a808fdf99

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\48tr9744.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
a13d22853da2191dd74baf8b24dc3dac

SHA1
a145587808e758d65b74570a872e66bbcc1459fc

SHA256
087c6028ecf5187b77c2cfd1638f8da3bc9811697516b9fb9629ea96e9df3137

SHA512
fea7571882467e0db0db8b2f9d3233b7326b6650ffb4274a42bf02bcea336e6a26cfd7ba597f48251e3553ff6c3cae0d1bbc83da2b41ae6211f6358c646b34a5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\48tr9744.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
673ad164a0b41ddbe549d7a8722a2f7a

SHA1
53ed4a72ec0328e702879e36e8877076d039469f

SHA256
168b26823ebb2948a71358df01c4080c105ccee71b704e876acc0e4c48e3a2c1

SHA512
73b35b0a4b095619891b90a26f28e307a5d813d0cf75d182d0163ff9f74dd55f1e3df094af157be88c8a030cfb4d276bc1ec62ff939d018a1fbcaeeb4004a9c9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\48tr9744.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
23KB

MD5
ddd9ea2773d88b79090a6c5e4b870904

SHA1
b9b90464b53964f47a765387339b65d8af7f6624

SHA256
2bbefa5d122efba378498bec1db49cc1cc5bd828c49fdbc98befcc54da07fc6b

SHA512
d07ae2fcc4528b98d4696506efd27f14ba863d1fb71a4a2b817348f5a38ec8e42f52983ae2b70c5c06b2f4d1b556950190f1800ac2423c0e8633e265c85cbd3f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\48tr9744.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
54caa8c5c2c4c8260c3ce215897a52f7

SHA1
cc5b7182dde91bceaf2b0f651f784df87cfdf5e6

SHA256
ed9f46db4f1f13ebef626131ade21eb9789760d235822a58f932a86fe775f4f8

SHA512
80972351f5fbb627ff92a6ca7a34f55852fca47350e8b55ccd23ef285b5bf4e9c8bac613c26447a542514a9a5ffac7fbd37691000e0d41e1c86727760ffa3501

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\48tr9744.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
8.5MB

MD5
2fae84800839e5f182c24cbc0eac35ba

SHA1
593dcba09c3e9105894f18176c997447ce69f564

SHA256
ba529df30c207143e432a512a85f8ce955cc2a136ae35e2bf98cb779dc6ec216

SHA512
9990eb4be334cf610e7e09ce27ef2106801fe90a826ca7df39e00116d9605c5bc40777a0a4dda6b5a08c22efa25eaf8fbd088184932c04416fa9f057569924b1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\48tr9744.default-release\targeting.snapshot.json

Filesize
4KB

MD5
f6cfa8ca15a9d563e7fb3d0b098efe9e

SHA1
49a6ec06bd2479978881c439587e52c12f7a9e79

SHA256
c0df6dcb4e287d6090dbd793066584458e2945890ea7002d0c32bd9f61524caa

SHA512
cb00ac09b4e9c029315780bcf78e228cb8d5a8165ca353310e27da0452f74e3d875e996ad947f4a0d6f6f300622de98b22ad50b45fffdc1c24afab6830a81d5e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\48tr9744.default-release\xulstore.json

Filesize
323B

MD5
8d306548361c9b32bb53fefef9d8e858

SHA1
01711d0e4ec1da3d6f93280b59d9f749429bb7f3

SHA256
1261c8f7eee2ccac3fc325b6d5c84f98f246bd5129bc0f1ab3ca458c405ae599

SHA512
74918c8030cb92ba99f3414f37d93eef2cbbb87a2874935737db3a030d43df0be3f8efe2538df90c156e806a52ab7193597c02d06c885b56baed62f5ec9d5e09

Download Submit
C:\Users\Admin\AppData\Roaming\qBittorrent\watched_folders.json

Filesize
4B

MD5
5b76b0eef9af8a2300673e0553f609f9

SHA1
0b56d40c0630a74abec5398e01c6cd83263feddc

SHA256
d914176fd50bd7f565700006a31aa97b79d3ad17cee20c8e5ff2061d5cb74817

SHA512
cf06a50de1bf63b7052c19ad53766fa0d99a4d88db76a7cbc672e33276e3d423e4c5f5cb4a8ae188c5c0e17d93bb740eaab6f25753f0d26501c5f84aeded075d

Download Submit
C:\Users\Admin\Downloads\NekoPresence_x64.noo7Dt4M.dll.part

Filesize
72KB

MD5
4e16dcab5d51e96c4a75a474a14361c6

SHA1
87eba991de551025cf72cc16e6cab28120944b07

SHA256
bd0a41b6f52f02d26fd79f0a6e28c2fb15bc06cebce91cf19a7b84fda58e0591

SHA512
8ca679806fb835adc6abdb2216649cc82342ca7cb04ad4bd51cb3dd152e409c0e1e65127adbe85cd387cca24dfaa283f6296ed720cf622cbdf2e2ed8a9f6edef

Download Submit
C:\Users\Admin\Downloads\PizzaTower_ONLINE.NUMsXtwm.exe.part

Filesize
32KB

MD5
0883fb2abddffe72fd4cdc608e874409

SHA1
58be1591cf16c8ca298fdac47c512a1a92ea6a53

SHA256
593cd9097544756db519034f537f024e96f65ab7903d4729ddc75544dd9310b0

SHA512
c40f65477276fdd042ff6ba1f30dd194ab59c2965dd198d03aebcfb908a96260d8343139afb37aab290edb6d348827ede02eab782ed12279d084725cf5a2670e

Download Submit
C:\Users\Admin\Downloads\data.1EOHtMsP.win.part

Filesize
15KB

MD5
db149e201dc609a4fb483c043d65bda5

SHA1
67361a1813dfe0943141d2c5f6177dfbaf43a490

SHA256
c28cb0329ee5c2f4a98b2ba5ca928876e3193eaeddf2aa502750dc3ff4102676

SHA512
5d5f892b581b3d5d668b9ac5162bbdd726bc96d3f44d18804f8f4d1d2d9d0ee225aa7e7016ac1a61e9da136a471fe3b793884210d048c42b5a15e1583448fb3c

Download Submit
C:\Users\Admin\Downloads\pizza-tower-online_202304\NekoPresence_x64.dll

Filesize
72KB

MD5
4e16dcab5d51e96c4a75a474a14361c6

SHA1
87eba991de551025cf72cc16e6cab28120944b07

SHA256
bd0a41b6f52f02d26fd79f0a6e28c2fb15bc06cebce91cf19a7b84fda58e0591

SHA512
8ca679806fb835adc6abdb2216649cc82342ca7cb04ad4bd51cb3dd152e409c0e1e65127adbe85cd387cca24dfaa283f6296ed720cf622cbdf2e2ed8a9f6edef

Download Submit
C:\Users\Admin\Downloads\pizza-tower-online_202304\NekoPresence_x64.dll

Filesize
72KB

MD5
4e16dcab5d51e96c4a75a474a14361c6

SHA1
87eba991de551025cf72cc16e6cab28120944b07

SHA256
bd0a41b6f52f02d26fd79f0a6e28c2fb15bc06cebce91cf19a7b84fda58e0591

SHA512
8ca679806fb835adc6abdb2216649cc82342ca7cb04ad4bd51cb3dd152e409c0e1e65127adbe85cd387cca24dfaa283f6296ed720cf622cbdf2e2ed8a9f6edef

Download Submit
C:\Users\Admin\Downloads\pizza-tower-online_202304\PizzaTower_ONLINE.exe

Filesize
8.2MB

MD5
954f44de8ece883474184c4bdf535389

SHA1
f928e3f109f92720c1072f4735abc75fa9832258

SHA256
fadc128eb44c720bf31840ece4e28038185691a5dd975cd80c6be8464cbcc98a

SHA512
7940ab21479471dc369aec2b0d682bdccd76840546a24e620069b534aadb4e708db787e050504c5ea8d6a861155ba60ab5507a86e8e4041f6800c52b169f747b

Download Submit
C:\Users\Admin\Downloads\pizza-tower-online_202304\PizzaTower_ONLINE.exe

Filesize
8.2MB

MD5
954f44de8ece883474184c4bdf535389

SHA1
f928e3f109f92720c1072f4735abc75fa9832258

SHA256
fadc128eb44c720bf31840ece4e28038185691a5dd975cd80c6be8464cbcc98a

SHA512
7940ab21479471dc369aec2b0d682bdccd76840546a24e620069b534aadb4e708db787e050504c5ea8d6a861155ba60ab5507a86e8e4041f6800c52b169f747b

Download Submit
C:\Users\Admin\Downloads\pizza-tower-online_202304\data.win

Filesize
670.9MB

MD5
c76b50b880966272d323ba06d7c9c6b3

SHA1
b46405b0c27fc590a0ab1be234fd254adaabdef3

SHA256
adf8c455b206366d3ec9fcc1297cff9f0725efe9145dbf4c65fdc39d1cce71d0

SHA512
0b661303596aef9503119e1fe9837449786ad74612451e589f21de70f2c087766b0af17f23c83e19e7773499cd87a01d68b3420f3dd6fcca850cf67ec0ea0e21

Download Submit
C:\Users\Admin\Downloads\pizza-tower-online_202304\options.ini

Filesize
63B

MD5
543893107102e844c287665c7e739d6b

SHA1
674cdd3db9a43f5a34053a644867c2735b7dec5e

SHA256
dff0cdeda8d5fe15b88c089871afae661b21d112ecb3e547d4d3f8a38269d2a2

SHA512
3c12fc88cc9a9c04c4a24d85703dc08c52723746139f354b504cd31debbafb7d9556510026797246144a5a93536a291cb392b07c0d65bb1b74679cbe6dbbb8c7

Download Submit
C:\Users\Admin\Downloads\pizza-tower-online_202304\splash.png

Filesize
114KB

MD5
4e417a293a2561a5bfa1fcb97bed5bea

SHA1
b1eabb987bdcddfbc83dc35c75628d8ab314c0e2

SHA256
7da42b9faeee0277e8fc3c5d783b402f2ebd785a07899098d18dfb148f31352f

SHA512
314b63457bdd159cfca5977100b8db7a305e6fe8dfc673f35572976b7b008b75c9569abb6583acf7ff95be71d573ba2d0f53025e9be73c1c06352629334f4e3b

Download Submit
C:\Users\Admin\Downloads\pizza-tower-online_202304_archive.torrent

Filesize
29KB

MD5
54230d4973f96f9ab118eca2a4d2bc11

SHA1
4dc4f6d18bd307233b1489072fd3e8144d2813b8

SHA256
c314237024041895faab6be65d1aa6d8d90ed90354ed6d718585844fd1c9dce0

SHA512
458c89e4b0546be47f20e81893fd2cfeff2fadb8a8e61b2560a8c48538aab82ba33e575e1f1f94fa104ca85adc28745cf1574dcfa06e4536aacd37369e398319

Download Submit
C:\Users\Admin\Downloads\qbittorrent_4.5.4_x64_setup.exe

Filesize
31.3MB

MD5
6e35e4512488a44ebf34bff82dc4724f

SHA1
38903134b1a0a774cdcf728d3484493e7d83592a

SHA256
3ba266ddbe5624aeedec1a23c6bf86d6cfd5b547e8c1a31169f6a08434c9e615

SHA512
a6faa23d08c34da39111b9da1d9be62eb9486d010b6217b0aaacaa0cc240bca4e305bdbdaf1f4175f4a4ddb12530ddecc3c488d1620e2ead20b9e90f3cbe6a1e

Download Submit
C:\Users\Admin\Downloads\qbittorrent_4.5.4_x64_setup.exe

Filesize
31.3MB

MD5
6e35e4512488a44ebf34bff82dc4724f

SHA1
38903134b1a0a774cdcf728d3484493e7d83592a

SHA256
3ba266ddbe5624aeedec1a23c6bf86d6cfd5b547e8c1a31169f6a08434c9e615

SHA512
a6faa23d08c34da39111b9da1d9be62eb9486d010b6217b0aaacaa0cc240bca4e305bdbdaf1f4175f4a4ddb12530ddecc3c488d1620e2ead20b9e90f3cbe6a1e

Download Submit
C:\Users\Admin\Downloads\qbittorrent_4.5.4_x64_setup.exe

Filesize
31.3MB

MD5
6e35e4512488a44ebf34bff82dc4724f

SHA1
38903134b1a0a774cdcf728d3484493e7d83592a

SHA256
3ba266ddbe5624aeedec1a23c6bf86d6cfd5b547e8c1a31169f6a08434c9e615

SHA512
a6faa23d08c34da39111b9da1d9be62eb9486d010b6217b0aaacaa0cc240bca4e305bdbdaf1f4175f4a4ddb12530ddecc3c488d1620e2ead20b9e90f3cbe6a1e

Download Submit
C:\Users\Admin\Downloads\qbittorrent_4.5.4_x64_setup.exe

Filesize
31.3MB

MD5
6e35e4512488a44ebf34bff82dc4724f

SHA1
38903134b1a0a774cdcf728d3484493e7d83592a

SHA256
3ba266ddbe5624aeedec1a23c6bf86d6cfd5b547e8c1a31169f6a08434c9e615

SHA512
a6faa23d08c34da39111b9da1d9be62eb9486d010b6217b0aaacaa0cc240bca4e305bdbdaf1f4175f4a4ddb12530ddecc3c488d1620e2ead20b9e90f3cbe6a1e

Download Submit
C:\Users\Admin\Downloads\qbittorrent_4.fgFgNbs5.5.4_x64_setup.exe.part

Filesize
31.3MB

MD5
6e35e4512488a44ebf34bff82dc4724f

SHA1
38903134b1a0a774cdcf728d3484493e7d83592a

SHA256
3ba266ddbe5624aeedec1a23c6bf86d6cfd5b547e8c1a31169f6a08434c9e615

SHA512
a6faa23d08c34da39111b9da1d9be62eb9486d010b6217b0aaacaa0cc240bca4e305bdbdaf1f4175f4a4ddb12530ddecc3c488d1620e2ead20b9e90f3cbe6a1e

Download Submit
C:\Users\Admin\Downloads\wd6_N74a.torrent.part

Filesize
29KB

MD5
54230d4973f96f9ab118eca2a4d2bc11

SHA1
4dc4f6d18bd307233b1489072fd3e8144d2813b8

SHA256
c314237024041895faab6be65d1aa6d8d90ed90354ed6d718585844fd1c9dce0

SHA512
458c89e4b0546be47f20e81893fd2cfeff2fadb8a8e61b2560a8c48538aab82ba33e575e1f1f94fa104ca85adc28745cf1574dcfa06e4536aacd37369e398319

Download Submit
memory/5676-846-0x0000020BCF8F0000-0x0000020BCF900000-memory.dmp

Filesize
64KB

Download
memory/5676-865-0x0000020BCF8F0000-0x0000020BCF900000-memory.dmp

Filesize
64KB

Download