96bac43faac2b1fa5e0bc495975b2e642af5da181e313a9c8f541912b83c0edb

Resubmissions

31/03/2024, 16:49

240331-vbyz9afb9s 7

Analysis

max time kernel
230s
max time network
233s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
30/03/2024, 11:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

qbittorrent_4.6.4_x64_setup.exe
Size

34.0MB
MD5

918224925563095d15dbab7c34b3bf17
SHA1

33902285adf411e5824547e849a4adcfc6531114
SHA256

96bac43faac2b1fa5e0bc495975b2e642af5da181e313a9c8f541912b83c0edb
SHA512

4d6bd949693ea60671ddb8dc19ec87d8e02bf4888aca290318488ca696e495e13bf49161ac8f75cfff9befb72589ab2bedcd1138fa9d81c5bf071191d6344b28
SSDEEP

786432:7KMXiEtPqJO5MB3/UOd64S49KmFRc85C2uWF3Dzn:7DXioy0DOd6o1HtuW5/

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	qbittorrent_4.6.4_x64_setup.exe

Executes dropped EXE 3 IoCs

pid	Process
3372	qbittorrent.exe
1376	qbittorrent.exe
752	qbittorrent.exe

Loads dropped DLL 5 IoCs

pid	Process
3136	qbittorrent_4.6.4_x64_setup.exe
3136	qbittorrent_4.6.4_x64_setup.exe
3136	qbittorrent_4.6.4_x64_setup.exe
3136	qbittorrent_4.6.4_x64_setup.exe
3136	qbittorrent_4.6.4_x64_setup.exe

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	95.105.69.98

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Program Files directory 37 IoCs

description	ioc	Process
File created	C:\Program Files\qBittorrent\translations\qtbase_cs.qm	qbittorrent_4.6.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_he.qm	qbittorrent_4.6.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_hu.qm	qbittorrent_4.6.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ja.qm	qbittorrent_4.6.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_zh_CN.qm	qbittorrent_4.6.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_uk.qm	qbittorrent_4.6.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qt_lt.qm	qbittorrent_4.6.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_da.qm	qbittorrent_4.6.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_de.qm	qbittorrent_4.6.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_fi.qm	qbittorrent_4.6.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_fr.qm	qbittorrent_4.6.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_it.qm	qbittorrent_4.6.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_tr.qm	qbittorrent_4.6.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qt_sl.qm	qbittorrent_4.6.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_gd.qm	qbittorrent_4.6.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_lv.qm	qbittorrent_4.6.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ca.qm	qbittorrent_4.6.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ko.qm	qbittorrent_4.6.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_nn.qm	qbittorrent_4.6.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_sk.qm	qbittorrent_4.6.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\qbittorrent.exe	qbittorrent_4.6.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qt_gl.qm	qbittorrent_4.6.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_bg.qm	qbittorrent_4.6.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_es.qm	qbittorrent_4.6.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_fa.qm	qbittorrent_4.6.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_pt_BR.qm	qbittorrent_4.6.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_zh_TW.qm	qbittorrent_4.6.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\qt.conf	qbittorrent_4.6.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qt_sv.qm	qbittorrent_4.6.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ar.qm	qbittorrent_4.6.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_hr.qm	qbittorrent_4.6.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_nl.qm	qbittorrent_4.6.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_pl.qm	qbittorrent_4.6.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ru.qm	qbittorrent_4.6.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\qbittorrent.pdb	qbittorrent_4.6.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qt_pt_PT.qm	qbittorrent_4.6.4_x64_setup.exe
File created	C:\Program Files\qBittorrent\uninst.exe	qbittorrent_4.6.4_x64_setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.torrent\Content Type = "application/x-bittorrent"	qbittorrent_4.6.4_x64_setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\magnet\shell\ = "open"	qbittorrent_4.6.4_x64_setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616193"	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	qbittorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet	qbittorrent_4.6.4_x64_setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\magnet	qbittorrent_4.6.4_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\Content Type = "application/x-magnet"	qbittorrent_4.6.4_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\DefaultIcon\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\",1"	qbittorrent_4.6.4_x64_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	qbittorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent\shell\open	qbittorrent_4.6.4_x64_setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e8005398e082303024b98265d99428e115f0000	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	qbittorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent	qbittorrent_4.6.4_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\shell	qbittorrent_4.6.4_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\shell\open\command	qbittorrent_4.6.4_x64_setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\.torrent\ = "qBittorrent"	qbittorrent_4.6.4_x64_setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\.torrent\Content Type = "application/x-bittorrent"	qbittorrent_4.6.4_x64_setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\magnet\ = "URL:Magnet link"	qbittorrent_4.6.4_x64_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616193"	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	qbittorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent\shell	qbittorrent_4.6.4_x64_setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\magnet\URL Protocol	qbittorrent_4.6.4_x64_setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\magnet\shell\open\command\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\" \"%1\""	qbittorrent_4.6.4_x64_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	qbittorrent.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent	qbittorrent_4.6.4_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent\shell\open\command\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\" \"%1\""	qbittorrent_4.6.4_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\URL Protocol	qbittorrent_4.6.4_x64_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\magnet\DefaultIcon	qbittorrent_4.6.4_x64_setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	qbittorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent\ = "qBittorrent Torrent File"	qbittorrent_4.6.4_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent\shell\open\command	qbittorrent_4.6.4_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent\DefaultIcon	qbittorrent_4.6.4_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.torrent	qbittorrent_4.6.4_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.torrent\ = "qBittorrent"	qbittorrent_4.6.4_x64_setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\.torrent	qbittorrent_4.6.4_x64_setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\magnet\DefaultIcon\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\",1"	qbittorrent_4.6.4_x64_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\magnet\shell\open\command	qbittorrent_4.6.4_x64_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	qbittorrent.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\cyberpunk-2077-by-xatab.torrent:Zone.Identifier	firefox.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
3372	qbittorrent.exe
1376	qbittorrent.exe
752	qbittorrent.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3136	qbittorrent_4.6.4_x64_setup.exe
3136	qbittorrent_4.6.4_x64_setup.exe
4480	msedge.exe
4480	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3372	qbittorrent.exe
752	qbittorrent.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4692	firefox.exe
Token: SeDebugPrivilege	4692	firefox.exe
Token: SeDebugPrivilege	4692	firefox.exe
Token: SeDebugPrivilege	4692	firefox.exe
Token: SeDebugPrivilege	4692	firefox.exe
Token: SeDebugPrivilege	4692	firefox.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4692	firefox.exe
4692	firefox.exe
4692	firefox.exe
4692	firefox.exe
3372	qbittorrent.exe
3372	qbittorrent.exe
3372	qbittorrent.exe
3372	qbittorrent.exe
3372	qbittorrent.exe
3372	qbittorrent.exe
752	qbittorrent.exe
752	qbittorrent.exe
752	qbittorrent.exe
752	qbittorrent.exe
752	qbittorrent.exe
752	qbittorrent.exe
752	qbittorrent.exe
752	qbittorrent.exe
752	qbittorrent.exe
752	qbittorrent.exe
752	qbittorrent.exe
752	qbittorrent.exe
752	qbittorrent.exe
752	qbittorrent.exe
752	qbittorrent.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4692	firefox.exe
4692	firefox.exe
4692	firefox.exe
3372	qbittorrent.exe
3372	qbittorrent.exe
3372	qbittorrent.exe
3372	qbittorrent.exe
3372	qbittorrent.exe
3372	qbittorrent.exe
752	qbittorrent.exe
752	qbittorrent.exe
752	qbittorrent.exe
752	qbittorrent.exe
752	qbittorrent.exe
752	qbittorrent.exe
752	qbittorrent.exe
752	qbittorrent.exe
752	qbittorrent.exe
752	qbittorrent.exe
752	qbittorrent.exe
752	qbittorrent.exe
752	qbittorrent.exe
752	qbittorrent.exe
752	qbittorrent.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4692	firefox.exe
4692	firefox.exe
4692	firefox.exe
4692	firefox.exe
752	qbittorrent.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 4692	2572	firefox.exe	88
PID 2572 wrote to memory of 4692	2572	firefox.exe	88
PID 2572 wrote to memory of 4692	2572	firefox.exe	88
PID 2572 wrote to memory of 4692	2572	firefox.exe	88
PID 2572 wrote to memory of 4692	2572	firefox.exe	88
PID 2572 wrote to memory of 4692	2572	firefox.exe	88
PID 2572 wrote to memory of 4692	2572	firefox.exe	88
PID 2572 wrote to memory of 4692	2572	firefox.exe	88
PID 2572 wrote to memory of 4692	2572	firefox.exe	88
PID 2572 wrote to memory of 4692	2572	firefox.exe	88
PID 2572 wrote to memory of 4692	2572	firefox.exe	88
PID 4692 wrote to memory of 4740	4692	firefox.exe	89
PID 4692 wrote to memory of 4740	4692	firefox.exe	89
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 752	4692	firefox.exe	90
PID 4692 wrote to memory of 3444	4692	firefox.exe	91
PID 4692 wrote to memory of 3444	4692	firefox.exe	91
PID 4692 wrote to memory of 3444	4692	firefox.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\qbittorrent_4.6.4_x64_setup.exe
"C:\Users\Admin\AppData\Local\Temp\qbittorrent_4.6.4_x64_setup.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3136
- C:\Program Files\qBittorrent\qbittorrent.exe
  "C:\Program Files\qBittorrent\qbittorrent.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3372

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4692.0.1564848303\322507313" -parentBuildID 20221007134813 -prefsHandle 1868 -prefMapHandle 1860 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fb649853-01c3-4ec0-98be-1e48aaa439a6} 4692 "\\.\pipe\gecko-crash-server-pipe.4692" 1960 141c1cd5e58 gpu
    3⤵
    PID:4740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4692.1.168923506\2092556568" -parentBuildID 20221007134813 -prefsHandle 2404 -prefMapHandle 2392 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {41beb500-0238-49f3-b1ca-0354af754b95} 4692 "\\.\pipe\gecko-crash-server-pipe.4692" 2416 141c1437658 socket
    3⤵
    - Checks processor information in registry
    PID:752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4692.2.2117224020\1422700974" -childID 1 -isForBrowser -prefsHandle 3112 -prefMapHandle 3108 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1120 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {20f1a6ee-66cd-41c1-818c-8c492cb54b50} 4692 "\\.\pipe\gecko-crash-server-pipe.4692" 3124 141c1c5f758 tab
    3⤵
    PID:3444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4692.3.850718768\1852426587" -childID 2 -isForBrowser -prefsHandle 3444 -prefMapHandle 3440 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1120 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cef24c6f-28e7-4ae0-a7b9-9c62874678b2} 4692 "\\.\pipe\gecko-crash-server-pipe.4692" 3456 141c4413858 tab
    3⤵
    PID:4168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4692.4.1303008145\301489599" -childID 3 -isForBrowser -prefsHandle 4424 -prefMapHandle 4416 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1120 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c6fc9f2-2485-486a-89a0-f9852f169384} 4692 "\\.\pipe\gecko-crash-server-pipe.4692" 4436 141c6ae9258 tab
    3⤵
    PID:4624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4692.5.213246706\1847355748" -childID 4 -isForBrowser -prefsHandle 5072 -prefMapHandle 5076 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1120 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e87ffeee-c5b9-4f32-aae4-775c75bc5473} 4692 "\\.\pipe\gecko-crash-server-pipe.4692" 5096 141c7a54158 tab
    3⤵
    PID:1056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4692.6.276722372\351686851" -childID 5 -isForBrowser -prefsHandle 5184 -prefMapHandle 5188 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1120 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e9f75930-c52a-4103-a365-27cea6d71d1b} 4692 "\\.\pipe\gecko-crash-server-pipe.4692" 5272 141c7a55058 tab
    3⤵
    PID:4952
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4692.7.534201751\1716554128" -childID 6 -isForBrowser -prefsHandle 5248 -prefMapHandle 5264 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1120 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fae48fa5-75f3-4915-84fe-d197620493c8} 4692 "\\.\pipe\gecko-crash-server-pipe.4692" 5240 141c7a55c58 tab
    3⤵
    PID:2464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4692.8.684845700\1496586351" -childID 7 -isForBrowser -prefsHandle 5264 -prefMapHandle 5440 -prefsLen 26285 -prefMapSize 233444 -jsInitHandle 1120 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {45d414f6-c98e-4bc9-abc6-5cbacbd88575} 4692 "\\.\pipe\gecko-crash-server-pipe.4692" 4436 141c8f30c58 tab
    3⤵
    PID:5936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4692.9.1312601545\1221619572" -childID 8 -isForBrowser -prefsHandle 5900 -prefMapHandle 5912 -prefsLen 26460 -prefMapSize 233444 -jsInitHandle 1120 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {408edc27-6e3a-4f5b-93b9-83ca37b86e39} 4692 "\\.\pipe\gecko-crash-server-pipe.4692" 6004 141c93ba858 tab
    3⤵
    PID:5536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4692.10.1305677351\1843228373" -parentBuildID 20221007134813 -prefsHandle 6312 -prefMapHandle 6300 -prefsLen 26460 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {644c94a8-8136-402a-8889-62a45c1195c1} 4692 "\\.\pipe\gecko-crash-server-pipe.4692" 6316 141c995f358 rdd
    3⤵
    PID:5732

C:\Program Files\qBittorrent\qbittorrent.exe
"C:\Program Files\qBittorrent\qbittorrent.exe" "C:\Users\Admin\Downloads\cyberpunk-2077-by-xatab.torrent"
1⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
PID:1376

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\d77683a5632d4c82ad1802452a56fd93 /t 1060 /p 3372
1⤵
PID:4684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault1a2d0084hdb73h42f1hbacbhd9aa936fc804
1⤵
PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffd43b046f8,0x7ffd43b04708,0x7ffd43b04718
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,5677786568099039715,2032240543360784367,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,5677786568099039715,2032240543360784367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2584 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,5677786568099039715,2032240543360784367,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:1516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1268

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5396

C:\Program Files\qBittorrent\qbittorrent.exe
"C:\Program Files\qBittorrent\qbittorrent.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\qBittorrent\qbittorrent.exe

Filesize
30.8MB

MD5
b9dfd00c5fbb9cfaa2c4e1b3f9e218bf

SHA1
4dad2d51c73dffdd2cfc4d17146ac0253d74e3bf

SHA256
1fac780feaa2e263dbd0ee2103d1815d97b4d6a676f5b83e9320120dc15ee6bb

SHA512
baec0664acfb41b96939f6462df5b9390f6cec16e71960f77ead222ad2bdf7f5f8bc4cb1937413472d4abe1ff6053eb8e89a9a6291c7b979138272dac780ab6c

Download Submit
C:\Program Files\qBittorrent\qt.conf

Filesize
84B

MD5
af7f56a63958401da8bea1f5e419b2af

SHA1
f66ee8779ca6d570dea22fe34ef8600e5d3c5f38

SHA256
fdb8fa58a6ffc14771ca2b1ef6438061a6cba638594d76d9021b91e755d030d3

SHA512
02f70ca7f1291b25402989be74408eb82343ab500e15e4ac22fbc7162eb9230cd7061eaa7e34acf69962b57ed0827f51ceaf0fa63da3154b53469c7b7511d23d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9f44d6f922f830d04d7463189045a5a3

SHA1
2e9ae7188ab8f88078e83ba7f42a11a2c421cb1c

SHA256
0ae5cf8b49bc34fafe9f86734c8121b631bad52a1424c1dd2caa05781032334a

SHA512
7c1825eaefcc7b97bae31eeff031899300b175222de14000283e296e9b44680c8b3885a4ed5d78fd8dfee93333cd7289347b95a62bf11f751c4ca47772cf987d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8c432801012295edc69ae0f7cca9afa4

SHA1
a7c05716d3edbd1f3c1896e843c5b5312d726981

SHA256
2c1473b92874d9abf5a587a3a47f97778bfc35d4ba87b4593f380a1f3a8b08db

SHA512
1043355abf6c932980271dcc0abc2c53de8e34bd5276c190f3995c91f3f08de9837b49e9377fd799019c42035e795123d205327559bbdfa30b4011b77bf22f91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
3bfe4eb3c51e2e2a49d610db92e4fa0d

SHA1
9283082b30d09e9d8d513f38b8b24d1a836aa4d9

SHA256
8642b45dc88e21be198979bc6d13cedb61fecc2b45a21b6f6294ee91341ca3c6

SHA512
ae8586daf99d60b387554d2688c06d31debc8f2158a765df545b9bdfa31872e87a404569356e2ccfee6c4edb2f3ed1a2d60dc2a58b7be76aaed7044986ae2d67

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg4AC6.tmp\FindProcDLL.dll

Filesize
3KB

MD5
b4faf654de4284a89eaf7d073e4e1e63

SHA1
8efcfd1ca648e942cbffd27af429784b7fcf514b

SHA256
c0948b2ec36a69f82c08935fac4b212238b6792694f009b93b4bdb478c4f26e3

SHA512
eef31e332be859cf2a64c928bf3b96442f36fe51f1a372c5628264a0d4b2fc7b3e670323c8fb5ffa72db995b8924da2555198e7de7b4f549d9e0f9e6dbb6b388

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg4AC6.tmp\LangDLL.dll

Filesize
5KB

MD5
50016010fb0d8db2bc4cd258ceb43be5

SHA1
44ba95ee12e69da72478cf358c93533a9c7a01dc

SHA256
32230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e

SHA512
ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg4AC6.tmp\System.dll

Filesize
12KB

MD5
4add245d4ba34b04f213409bfe504c07

SHA1
ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

SHA256
9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

SHA512
1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg4AC6.tmp\UAC.dll

Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg4AC6.tmp\modern-wizard.bmp

Filesize
25KB

MD5
cbe40fd2b1ec96daedc65da172d90022

SHA1
366c216220aa4329dff6c485fd0e9b0f4f0a7944

SHA256
3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2

SHA512
62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg4AC6.tmp\nsDialogs.dll

Filesize
9KB

MD5
1d8f01a83ddd259bc339902c1d33c8f1

SHA1
9f7806af462c94c39e2ec6cc9c7ad05c44eba04e

SHA256
4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed

SHA512
28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567

Download Submit
C:\Users\Admin\AppData\Local\qBittorrent\GeoDB\dbip-country-lite.mmdb

Filesize
7.0MB

MD5
fdd06285c7557b8826174f6bf7cce5e6

SHA1
0d1ac956ec7806c2f7b2d1391e99aad16f0b3642

SHA256
04ba9976deb4416a6257252d625d27d9074e754a041606bb6dbfa88e9011cda6

SHA512
62dd9ea6fba6eb15f686c65f40ce48ea62906345aadf5855107efa07b3f7f5b69461e923be9edb5a5b3de5524e8a12a2990ed435f72697cdb8c1d87cf1a64c3a

Download Submit
C:\Users\Admin\AppData\Local\qBittorrent\logs\qbittorrent.log

Filesize
1KB

MD5
ddbd896e1b44db110155570c59c08c23

SHA1
010c0cefa19991eebb5cdd42f8064e1492559923

SHA256
101d33d7b0ee709ec12c1e6510db4ac01d661fcf8602001baa622b8f01e10922

SHA512
88982a408c8f4dd7b85ebd2eb795d85eda9ad9fb449f93fc59962e2f2d88efc9faa3bd97095332de5dc53b89e3ea5214b2f65280c49268964f471c0a83ac265f

Download Submit
C:\Users\Admin\AppData\Local\qBittorrent\logs\qbittorrent.log

Filesize
2KB

MD5
e12e73f402f5c1c213b3be70357e1dbb

SHA1
2fdbec145469073c0173d8d4c5714860b0dcd93d

SHA256
cd21b1e4572946c6da9b47e4fadb025aa8480bc82475ce3300f0a1f1144d56ae

SHA512
298986ae4ca3d6d899bc3fa00240e27864b17faba3b8f4762f1748970b7547831ed047acd79aa136a185275ab28ca86fb8817571adf4fe2ca31ecfd14a294256

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
80f104d589aa5505fdd3fb45d02778b9

SHA1
bc938695e37c7cb9f8c95421d5a35828e8210513

SHA256
ed754ad4f8446ea0318aa157ca9b54da49745beca89400cb236f4b777158c3df

SHA512
8311f774718e797451ecd16fde43c373be734109a52006cbcc82b9984617172a07f36e944317c44cf36e5d4d18358ba7cd8f64972617dc14f1be7deecf444839

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\datareporting\glean\pending_pings\0779ab52-a2ec-4540-b8dc-0e36ef204ab9

Filesize
746B

MD5
bf09db660f1ea2cfca17135d33a049cc

SHA1
8ca24e150259f9f9ee92bfff69e6b4eaeee8aa26

SHA256
cc9e51bc661b22446652ec7f46d9b3c595550d1214986519e73b8b482e043878

SHA512
67cf044c08c5f0657dc921acd5b82217a3291535409b0d7e717a4191ad13b2826f1dc29b0d5f5ca891b33d09b5750b62e4251bab95e992115cefad50e2c7b13a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\datareporting\glean\pending_pings\860a24f9-4d6c-461e-8435-f2d9b09c7953

Filesize
10KB

MD5
18b79a4d3ee5468364069cb5aa83940b

SHA1
97e6ebd5c3aa34939ec31715b7b9674bef8b1cde

SHA256
25348dc9e6061016c19e0ae0d45ab1671dd40bb7e8fc0404e3b62320eaec169f

SHA512
2267308f29f8a3d2ea175756b4173305116e3c0b0f7e4c4bf1926944ff22a687f2bec7f2d363a3de7133a77eb6d260e993529d34390c915b64060881cbb1fc70

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\prefs-1.js

Filesize
6KB

MD5
3c158586282ee5596ef20ef96370f0fe

SHA1
483239d74a1a9d5b2a751bc2d88f9888d7d0a757

SHA256
605717dc47eeb3c8d0ca3da11475ed0596b12e1e394641a6b2bb26dc86b1e828

SHA512
bf76cbff3b3e5d2c4c0f5a8e15e7570a63f77cb7ad1c3b1f0d0d9fbaae730f3fe02bc2cbe891fd9e8359112bcf1ffb861cb3529d13467035e086bbd077f318d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\prefs-1.js

Filesize
6KB

MD5
ddda4e480de93df1ede0f3aa01f97167

SHA1
4c9cabba49b36dd6a19495020fbe4e956f20b062

SHA256
245f454bb413e85309575210cc49f7c5aba876a382f278e6a7c6596975f3b438

SHA512
02192dc2a400d3df5d74969e190c8391d4229e8a259217daf81ca1705869bc58e41b58f24ec0d8a7c4ba958b63ea3f04b1fb410a9b6ff1a7e0e89609444277b8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\prefs-1.js

Filesize
6KB

MD5
99879443632476bb2f1444c3ae2f0e1d

SHA1
f4924afddf256f87490997769b44f08cb8e12de5

SHA256
76f3e130ab83ef691590a932a8cc0d0511b41901429ccf55ec1e0fbf24569a44

SHA512
fdcdcc6d0a53d8816684e334b42893370b4947b9aaef257a5f74ffa2a8d01e9be4070d33fdc1279708454e0e9e5fe897a312bd6e84756343186378f4906a2044

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
b63c9b4d21029a3e472906d9f9b4b884

SHA1
407f5a072d409152678cefe984d27e7846ff5688

SHA256
5c1b2cc9dfc97254968609adb7424c0326845c4a66a6e98a7484db4fab71cd09

SHA512
235ae6f8b29145d86c81e6523ea9a68733d78bf4887776a12feec859653f1ab90f75259e84237cf914097d49fdd1236d460eb3ff38859db184428a30ed0e17f9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
c6c1a89abe219fb26954295891a677e1

SHA1
1a6c85de07cb8c7ed10b5eacaa349950e0926104

SHA256
64db578ad8313d7ad36f031ccb9e1220f6c6551c8a6d4c766ee21137d27fc1b8

SHA512
e581fe27a5bc925d13d127bd0d88fcc7edcc660b9a3636eb7dedf72a76d7cc880263fcd50db14b453654f8256817f67b402deafaf315d14e7573a07027e69911

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
9400070bd2a297f79bf650452eee7db5

SHA1
51d1b631a394ff15baca4b298dc3dc89d5c3d68d

SHA256
e087713985267ecc4f12c09222c446acfeebb77b7d6ae9fa427a94fdf02d6769

SHA512
4f80fe26abf407e722f472d3dbaa0d6227eee9a721e5d19cf09ebb6798b2ed2f902b2dfb55034b10b37bd1708f86f9cae0b7edd7d06b4d0a9de3b32c53d8febc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
7f254afc035362a7d4b5e79068b6bba8

SHA1
62d0d27dc0a82dba072e87799567e4fed2d59368

SHA256
a39bcc9a9d69f1f0346c4b177661640bcb9ce708c526df57919c94fa4b8a1409

SHA512
0fb7cbb4a1e10fa5662ca170b630820b93fe4457c014fde49902ed0bb79759e651e0fc52e2b33c50b50ee0594f3610dcf1d8802258523c30c746c2cb00ce4901

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
dbbac03946a12b86db4805c8afc6e580

SHA1
453d143c143a2c2af9b970109dc692f46dc16351

SHA256
75b3135715badcfdba683d02c2c271b3a237ecf6f01853db408be816e7676881

SHA512
a315bafab1020ef83eee7b4ad0f8e1de2ec3835b2ee3a449b46307869d6dbe91d4f01ab7868d9e3019de89536e7ef8e074f3717169b93a99512ac2a64ee070cf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
7647c1205d892d78f33ee04cf1853597

SHA1
62c24cbb3075acd556764a20418062db26f92f7c

SHA256
4c04e5e0862614d502047fedf888fda3312d1577de449d46222657f71dcb4fe6

SHA512
a01542183f2cee24dea1e0d7fb989f56e7aff841fa409d1977685a0a5151e53034c2d0f097eb73103f8629aea10abb8c38cc0e823f624df40c01b202bb3286da

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
fcb4c5a599158b879ee0e1cb117b6757

SHA1
091669ce79d2e9fca458efc91e5705235d88837e

SHA256
78702525c9c583bbe9697fb1472c7c873dfd513c1b9afe8e8ddfe06a02992d51

SHA512
4a5a4f4b851ff8c09f8ca5ebbc6f2aac151bed4e5302349b4046ccc5b7365c893c1ac0ed1311ee64a1f2ae3fc99c24dd4ae47d1d1a56514ffd4f26531985ba62

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\sessionstore.jsonlz4

Filesize
3KB

MD5
0dbc5cd8f7f7ad46b174e1b08e3afecf

SHA1
d2097c63e6d1780d82cb1d20ed7a1c9026fa96d1

SHA256
30915abeb75d74793ed75a34f89293dd07ab62f9b2d96b5c031e51f329a824f7

SHA512
ac1083227ad4db0cb66cdf30d10fe6349d80c34fc95483482081e15f83425ba21692f7ea95455528e4e1449966bbfbebe1467377a7c03d71b0d8fce2852fb733

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\storage\default\https+++www.youtube.com^partitionKey=%28https%2Cbyxatab.com%29\idb\1572623006LCo7g%sCD7a%tfa9b3abs.sqlite

Filesize
48KB

MD5
2a1f2a61d77a7c3c5aa03a56d6e564ef

SHA1
2e5457a2d82c60aa2c2e1e749ad5a0807664d1eb

SHA256
08a60fd923f4a7fae5a851e2e515b7db5db0ea4939083a0ee7e9de004a73d4a6

SHA512
befc41ea413320e3bff8d1b43a2b5460ac31e19e678f34dcecd0f2a708f58b495038a5c3782f586676d543893894888a8d1a4173890f020d969179a198f78672

Download Submit
C:\Users\Admin\AppData\Roaming\qBittorrent\qBittorrent.ini

Filesize
1KB

MD5
1b3b2453a9912a86945c54cd49e8e7c9

SHA1
f11c34db04a0172905d2d7ccd5e589724cf147ab

SHA256
f110227e6cb50d8596a0f906c7a28dffb4390694a9fb87a301f6ab69e1efb824

SHA512
8071409f784fde816394deab9496d45e7546d1634d41c3fa7c6a3c72e19e9286919ba9b47fdac799b52872c4d0d613fbf0d98ebdd61eee6bd335ad439975b89b

Download Submit
C:\Users\Admin\AppData\Roaming\qBittorrent\watched_folders.json.hcOTJb

Filesize
4B

MD5
5b76b0eef9af8a2300673e0553f609f9

SHA1
0b56d40c0630a74abec5398e01c6cd83263feddc

SHA256
d914176fd50bd7f565700006a31aa97b79d3ad17cee20c8e5ff2061d5cb74817

SHA512
cf06a50de1bf63b7052c19ad53766fa0d99a4d88db76a7cbc672e33276e3d423e4c5f5cb4a8ae188c5c0e17d93bb740eaab6f25753f0d26501c5f84aeded075d

Download Submit
C:\Users\Admin\Downloads\cyberpunk-2077-by-xatab.2iGiWChz.torrent.part

Filesize
248KB

MD5
fbb9292b3c16a8e80c0b674490c2377c

SHA1
ced0a76eb30aaee24c55c0aa7b151fb23a9c13ca

SHA256
c50611e8455067de2b291662b6664c04f2c4abf45e2cf0e33e2a0ed94f731fa6

SHA512
3a2836378cc21801afbf918a6ac5137a6da614b2695699197cba2afa8c2f8b1b35e228a9c1b90dc7f732d16884e73ae672bb0479ac4f24d5be0103987a0ae22b

Download Submit
memory/752-722-0x0000027EE5090000-0x0000027EE50A0000-memory.dmp

Filesize
64KB

Download
memory/752-753-0x0000027EE5090000-0x0000027EE50A0000-memory.dmp

Filesize
64KB

Download
memory/1376-570-0x000001BBAF910000-0x000001BBAF920000-memory.dmp

Filesize
64KB

Download
memory/3372-670-0x000001BF2BB10000-0x000001BF2BB20000-memory.dmp

Filesize
64KB

Download
memory/3372-531-0x000001BF2BB10000-0x000001BF2BB20000-memory.dmp

Filesize
64KB

Download