5513812584a5ba7810b812db7ceec2d0e9cb214cef95a2580e29927cf4fe9921

Analysis

max time kernel
206s
max time network
212s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
15/11/2024, 04:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

qbittorrent_5.0.1_x64_setup.exe
Size

37.4MB
MD5

fd6ea4e1d7b3adb820908ec26b729ea7
SHA1

485b31d0f8394efdaa860c0d4a54227033f40579
SHA256

5513812584a5ba7810b812db7ceec2d0e9cb214cef95a2580e29927cf4fe9921
SHA512

e587c67bd4da787226187918206acfdb9ef4192e884b41e0680cf96458799eeeabde97376dbdfdd89c7de12839a062bd8f8da50b9e6a49c33018461783535c66
SSDEEP

786432:7fFBmZOcw9i54tPYrFrQAEODhrbt+Fn1/Zo2NCILF5Iud3gIwmbN:79BH1e+sFspIteZtQILFDdQIwm5

Score

8^/10

discovery execution

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
3032	qbittorrent.exe
4744	is-JN8V9.tmp
4452	bommixpro.exe
2264	gzrBhxYzCo6.exe

Loads dropped DLL 15 IoCs

pid	Process
1772	qbittorrent_5.0.1_x64_setup.exe
1772	qbittorrent_5.0.1_x64_setup.exe
1772	qbittorrent_5.0.1_x64_setup.exe
1772	qbittorrent_5.0.1_x64_setup.exe
1772	qbittorrent_5.0.1_x64_setup.exe
1772	qbittorrent_5.0.1_x64_setup.exe
1772	qbittorrent_5.0.1_x64_setup.exe
4744	is-JN8V9.tmp
4452	bommixpro.exe
2264	gzrBhxYzCo6.exe
2264	gzrBhxYzCo6.exe
2264	gzrBhxYzCo6.exe
2264	gzrBhxYzCo6.exe
2264	gzrBhxYzCo6.exe
2264	gzrBhxYzCo6.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 39 IoCs

description	ioc	Process
File created	C:\Program Files\qBittorrent\translations\qtbase_ar.qm	qbittorrent_5.0.1_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_fr.qm	qbittorrent_5.0.1_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ru.qm	qbittorrent_5.0.1_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_zh_TW.qm	qbittorrent_5.0.1_x64_setup.exe
File created	C:\Program Files\qBittorrent\uninst.exe	qbittorrent_5.0.1_x64_setup.exe
File created	C:\Program Files\qBittorrent\qt.conf	qbittorrent_5.0.1_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ca.qm	qbittorrent_5.0.1_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_es.qm	qbittorrent_5.0.1_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_fi.qm	qbittorrent_5.0.1_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_sk.qm	qbittorrent_5.0.1_x64_setup.exe
File created	C:\Program Files\qBittorrent\qbittorrent.exe	qbittorrent_5.0.1_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_gd.qm	qbittorrent_5.0.1_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_he.qm	qbittorrent_5.0.1_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_hu.qm	qbittorrent_5.0.1_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_uk.qm	qbittorrent_5.0.1_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_bg.qm	qbittorrent_5.0.1_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_fa.qm	qbittorrent_5.0.1_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_nn.qm	qbittorrent_5.0.1_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_it.qm	qbittorrent_5.0.1_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_pl.qm	qbittorrent_5.0.1_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_tr.qm	qbittorrent_5.0.1_x64_setup.exe
File opened for modification	C:\Program Files\qBittorrent\qbittorrent.exe	qbittorrent_5.0.1_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qt_gl.qm	qbittorrent_5.0.1_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_de.qm	qbittorrent_5.0.1_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ja.qm	qbittorrent_5.0.1_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_lv.qm	qbittorrent_5.0.1_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_pt_BR.qm	qbittorrent_5.0.1_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qt_pt_PT.qm	qbittorrent_5.0.1_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qt_sl.qm	qbittorrent_5.0.1_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_cs.qm	qbittorrent_5.0.1_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ko.qm	qbittorrent_5.0.1_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_zh_CN.qm	qbittorrent_5.0.1_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_nl.qm	qbittorrent_5.0.1_x64_setup.exe
File created	C:\Program Files\qBittorrent\qbittorrent.pdb	qbittorrent_5.0.1_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qt_lt.qm	qbittorrent_5.0.1_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qt_sv.qm	qbittorrent_5.0.1_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_da.qm	qbittorrent_5.0.1_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_hr.qm	qbittorrent_5.0.1_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ka.qm	qbittorrent_5.0.1_x64_setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4172	powershell.exe
1680	powershell.exe
820	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 44 IoCs

pid	pid_target	Process	procid_target
4436	4452	WerFault.exe	119
4104	4452	WerFault.exe	119
240	4452	WerFault.exe	119
4988	4452	WerFault.exe	119
3996	4452	WerFault.exe	119
2888	4452	WerFault.exe	119
4840	4452	WerFault.exe	119
4912	4452	WerFault.exe	119
3276	4452	WerFault.exe	119
3396	4452	WerFault.exe	119
4976	4452	WerFault.exe	119
848	4452	WerFault.exe	119
3568	4452	WerFault.exe	119
2140	4452	WerFault.exe	119
4372	4452	WerFault.exe	119
4832	4452	WerFault.exe	119
2548	4452	WerFault.exe	119
2264	4452	WerFault.exe	119
1656	4452	WerFault.exe	119
3364	4452	WerFault.exe	119
32	4452	WerFault.exe	119
2040	4452	WerFault.exe	119
1404	4452	WerFault.exe	119
3004	4452	WerFault.exe	119
3460	4452	WerFault.exe	119
1440	4452	WerFault.exe	119
2632	4452	WerFault.exe	119
2116	4452	WerFault.exe	119
4144	4452	WerFault.exe	119
900	4452	WerFault.exe	119
2792	4452	WerFault.exe	119
2712	4452	WerFault.exe	119
4196	4452	WerFault.exe	119
1352	4452	WerFault.exe	119
1336	4452	WerFault.exe	119
3000	4452	WerFault.exe	119
2456	4452	WerFault.exe	119
2564	4452	WerFault.exe	119
2792	4452	WerFault.exe	119
1444	4452	WerFault.exe	119
4104	4452	WerFault.exe	119
2732	4452	WerFault.exe	119
3364	4452	WerFault.exe	119
3848	4452	WerFault.exe	119

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qbittorrent_5.0.1_x64_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	the-longing-codex_lFWtfVRChW.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gzrBhxYzCo6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	is-JN8V9.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bommixpro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x0068000000025a30-870.dat	nsis_installer_1
behavioral1/files/0x0068000000025a30-870.dat	nsis_installer_2

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 28 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\DefaultIcon\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\",1"	qbittorrent_5.0.1_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\shell	qbittorrent_5.0.1_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.torrent\Content Type = "application/x-bittorrent"	qbittorrent_5.0.1_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\Content Type = "application/x-magnet"	qbittorrent_5.0.1_x64_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\ = "Torrent File"	qbittorrent_5.0.1_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent	qbittorrent_5.0.1_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\shell\open	qbittorrent_5.0.1_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent.Url.Magnet\DefaultIcon	qbittorrent_5.0.1_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent.File.Torrent	qbittorrent_5.0.1_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\shell\open\command\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\" \"%1\""	qbittorrent_5.0.1_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\shell\open\command	qbittorrent_5.0.1_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet\DefaultIcon\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\",1"	qbittorrent_5.0.1_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\magnet	qbittorrent_5.0.1_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\ = "URL:Magnet URI"	qbittorrent_5.0.1_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent.Url.Magnet	qbittorrent_5.0.1_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet	qbittorrent_5.0.1_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet\shell\open\command	qbittorrent_5.0.1_x64_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings	bommixpro.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent.File.Torrent\DefaultIcon	qbittorrent_5.0.1_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet\shell	qbittorrent_5.0.1_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet\shell\open\command\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\" \"%1\""	qbittorrent_5.0.1_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent.File.Torrent\shell\open\command	qbittorrent_5.0.1_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet\ = "Magnet URI"	qbittorrent_5.0.1_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent.Url.Magnet\shell\open\command	qbittorrent_5.0.1_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet\shell\open	qbittorrent_5.0.1_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.torrent	qbittorrent_5.0.1_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\URL Protocol	qbittorrent_5.0.1_x64_setup.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\the-longing-codex_lFWtfVRChW.zip:Zone.Identifier	msedge.exe

Runs net.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3032	qbittorrent.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
1772	qbittorrent_5.0.1_x64_setup.exe
1772	qbittorrent_5.0.1_x64_setup.exe
4884	msedge.exe
4884	msedge.exe
228	msedge.exe
228	msedge.exe
4632	identity_helper.exe
4632	identity_helper.exe
668	msedge.exe
668	msedge.exe
2788	msedge.exe
2788	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4452	bommixpro.exe
4452	bommixpro.exe
4452	bommixpro.exe
4452	bommixpro.exe
1680	powershell.exe
1680	powershell.exe
820	powershell.exe
820	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1680	powershell.exe
Token: SeDebugPrivilege	820	powershell.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 4112	4884	msedge.exe	80
PID 4884 wrote to memory of 4112	4884	msedge.exe	80
PID 4884 wrote to memory of 744	4884	msedge.exe	81
PID 4884 wrote to memory of 744	4884	msedge.exe	81
PID 4884 wrote to memory of 744	4884	msedge.exe	81
PID 4884 wrote to memory of 744	4884	msedge.exe	81
PID 4884 wrote to memory of 744	4884	msedge.exe	81
PID 4884 wrote to memory of 744	4884	msedge.exe	81
PID 4884 wrote to memory of 744	4884	msedge.exe	81
PID 4884 wrote to memory of 744	4884	msedge.exe	81
PID 4884 wrote to memory of 744	4884	msedge.exe	81
PID 4884 wrote to memory of 744	4884	msedge.exe	81
PID 4884 wrote to memory of 744	4884	msedge.exe	81
PID 4884 wrote to memory of 744	4884	msedge.exe	81
PID 4884 wrote to memory of 744	4884	msedge.exe	81
PID 4884 wrote to memory of 744	4884	msedge.exe	81
PID 4884 wrote to memory of 744	4884	msedge.exe	81
PID 4884 wrote to memory of 744	4884	msedge.exe	81
PID 4884 wrote to memory of 744	4884	msedge.exe	81
PID 4884 wrote to memory of 744	4884	msedge.exe	81
PID 4884 wrote to memory of 744	4884	msedge.exe	81
PID 4884 wrote to memory of 744	4884	msedge.exe	81
PID 4884 wrote to memory of 744	4884	msedge.exe	81
PID 4884 wrote to memory of 744	4884	msedge.exe	81
PID 4884 wrote to memory of 744	4884	msedge.exe	81
PID 4884 wrote to memory of 744	4884	msedge.exe	81
PID 4884 wrote to memory of 744	4884	msedge.exe	81
PID 4884 wrote to memory of 744	4884	msedge.exe	81
PID 4884 wrote to memory of 744	4884	msedge.exe	81
PID 4884 wrote to memory of 744	4884	msedge.exe	81
PID 4884 wrote to memory of 744	4884	msedge.exe	81
PID 4884 wrote to memory of 744	4884	msedge.exe	81
PID 4884 wrote to memory of 744	4884	msedge.exe	81
PID 4884 wrote to memory of 744	4884	msedge.exe	81
PID 4884 wrote to memory of 744	4884	msedge.exe	81
PID 4884 wrote to memory of 744	4884	msedge.exe	81
PID 4884 wrote to memory of 744	4884	msedge.exe	81
PID 4884 wrote to memory of 744	4884	msedge.exe	81
PID 4884 wrote to memory of 744	4884	msedge.exe	81
PID 4884 wrote to memory of 744	4884	msedge.exe	81
PID 4884 wrote to memory of 744	4884	msedge.exe	81
PID 4884 wrote to memory of 744	4884	msedge.exe	81
PID 4884 wrote to memory of 228	4884	msedge.exe	82
PID 4884 wrote to memory of 228	4884	msedge.exe	82
PID 4884 wrote to memory of 2360	4884	msedge.exe	83
PID 4884 wrote to memory of 2360	4884	msedge.exe	83
PID 4884 wrote to memory of 2360	4884	msedge.exe	83
PID 4884 wrote to memory of 2360	4884	msedge.exe	83
PID 4884 wrote to memory of 2360	4884	msedge.exe	83
PID 4884 wrote to memory of 2360	4884	msedge.exe	83
PID 4884 wrote to memory of 2360	4884	msedge.exe	83
PID 4884 wrote to memory of 2360	4884	msedge.exe	83
PID 4884 wrote to memory of 2360	4884	msedge.exe	83
PID 4884 wrote to memory of 2360	4884	msedge.exe	83
PID 4884 wrote to memory of 2360	4884	msedge.exe	83
PID 4884 wrote to memory of 2360	4884	msedge.exe	83
PID 4884 wrote to memory of 2360	4884	msedge.exe	83
PID 4884 wrote to memory of 2360	4884	msedge.exe	83
PID 4884 wrote to memory of 2360	4884	msedge.exe	83
PID 4884 wrote to memory of 2360	4884	msedge.exe	83
PID 4884 wrote to memory of 2360	4884	msedge.exe	83
PID 4884 wrote to memory of 2360	4884	msedge.exe	83
PID 4884 wrote to memory of 2360	4884	msedge.exe	83
PID 4884 wrote to memory of 2360	4884	msedge.exe	83

C:\Users\Admin\AppData\Local\Temp\qbittorrent_5.0.1_x64_setup.exe
"C:\Users\Admin\AppData\Local\Temp\qbittorrent_5.0.1_x64_setup.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1772
- C:\Program Files\qBittorrent\qbittorrent.exe
  "C:\Program Files\qBittorrent\qbittorrent.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  PID:3032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffd48733cb8,0x7ffd48733cc8,0x7ffd48733cd8
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1860,15710948837844579484,12184550603853023724,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1852 /prefetch:2
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1860,15710948837844579484,12184550603853023724,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1860,15710948837844579484,12184550603853023724,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2288 /prefetch:8
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,15710948837844579484,12184550603853023724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2828 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,15710948837844579484,12184550603853023724,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2836 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,15710948837844579484,12184550603853023724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,15710948837844579484,12184550603853023724,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1860,15710948837844579484,12184550603853023724,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3704 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1860,15710948837844579484,12184550603853023724,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4672 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,15710948837844579484,12184550603853023724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,15710948837844579484,12184550603853023724,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,15710948837844579484,12184550603853023724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,15710948837844579484,12184550603853023724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,15710948837844579484,12184550603853023724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,15710948837844579484,12184550603853023724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,15710948837844579484,12184550603853023724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,15710948837844579484,12184550603853023724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,15710948837844579484,12184550603853023724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,15710948837844579484,12184550603853023724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,15710948837844579484,12184550603853023724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,15710948837844579484,12184550603853023724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,15710948837844579484,12184550603853023724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,15710948837844579484,12184550603853023724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7136 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,15710948837844579484,12184550603853023724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6828 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1860,15710948837844579484,12184550603853023724,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4828 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1860,15710948837844579484,12184550603853023724,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5504 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1860,15710948837844579484,12184550603853023724,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6984 /prefetch:8
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,15710948837844579484,12184550603853023724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:4016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2944

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4400

C:\Users\Admin\Downloads\the-longing-codex_lFWtfVRChW\the-longing-codex_lFWtfVRChW.exe
"C:\Users\Admin\Downloads\the-longing-codex_lFWtfVRChW\the-longing-codex_lFWtfVRChW.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:716
- C:\Users\Admin\AppData\Local\Temp\is-JFOBN.tmp\is-JN8V9.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-JFOBN.tmp\is-JN8V9.tmp" /SL4 $3035E "C:\Users\Admin\Downloads\the-longing-codex_lFWtfVRChW\the-longing-codex_lFWtfVRChW.exe" 6641876 52224
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4744
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /Delete /F /TN "bom_mix_pro_11151"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1108
- - C:\Users\Admin\AppData\Local\BOM Mix Pro 2.0.5.4\bommixpro.exe
    "C:\Users\Admin\AppData\Local\BOM Mix Pro 2.0.5.4\bommixpro.exe" 0f7fae5ee28520c8380c8232de9a726a
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:4452
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 860
      4⤵
      Program crash
      PID:4436
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 868
      4⤵
      Program crash
      PID:4104
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 924
      4⤵
      Program crash
      PID:240
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 1056
      4⤵
      Program crash
      PID:4988
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 1096
      4⤵
      Program crash
      PID:3996
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 1108
      4⤵
      Program crash
      PID:2888
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 1108
      4⤵
      Program crash
      PID:4840
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 1092
      4⤵
      Program crash
      PID:4912
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 1152
      4⤵
      Program crash
      PID:3276
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 984
      4⤵
      Program crash
      PID:3396
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 992
      4⤵
      Program crash
      PID:4976
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 1576
      4⤵
      Program crash
      PID:848
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 860
      4⤵
      Program crash
      PID:3568
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 1656
      4⤵
      Program crash
      PID:2140
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 1676
      4⤵
      Program crash
      PID:4372
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 1812
      4⤵
      Program crash
      PID:4832
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 1636
      4⤵
      Program crash
      PID:2548
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 1820
      4⤵
      Program crash
      PID:2264
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 1680
      4⤵
      Program crash
      PID:1656
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 1864
      4⤵
      Program crash
      PID:3364
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 1820
      4⤵
      Program crash
      PID:32
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 1964
      4⤵
      Program crash
      PID:2040
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 1800
      4⤵
      Program crash
      PID:1404
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 1996
      4⤵
      Program crash
      PID:3004
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 2004
      4⤵
      Program crash
      PID:3460
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 2020
      4⤵
      Program crash
      PID:1440
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 2040
      4⤵
      Program crash
      PID:2632
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 2036
      4⤵
      Program crash
      PID:2116
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 2064
      4⤵
      Program crash
      PID:4144
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 2044
      4⤵
      Program crash
      PID:900
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 2024
      4⤵
      Program crash
      PID:2792
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 1992
      4⤵
      Program crash
      PID:2712
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 2072
      4⤵
      Program crash
      PID:4196
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 2056
      4⤵
      Program crash
      PID:1352
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 2120
      4⤵
      Program crash
      PID:1336
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\4CSP3sto\gzrBhxYzCo6.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2908
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\4CSP3sto\gzrBhxYzCo6.exe"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1680
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\nO3AtAqJ\L7srPqcuTEuwYUQXA.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1792
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\nO3AtAqJ\L7srPqcuTEuwYUQXA.exe"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:820
  - - C:\Users\Admin\AppData\Local\Temp\4CSP3sto\gzrBhxYzCo6.exe
      C:\Users\Admin\AppData\Local\Temp\4CSP3sto\gzrBhxYzCo6.exe /sid=3 /pid=224
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2264
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 2196
      4⤵
      Program crash
      PID:3000
  - - C:\Users\Admin\AppData\Local\Temp\nO3AtAqJ\L7srPqcuTEuwYUQXA.exe
      C:\Users\Admin\AppData\Local\Temp\nO3AtAqJ\L7srPqcuTEuwYUQXA.exe
      4⤵
      PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\is-EC1ML.tmp\L7srPqcuTEuwYUQXA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-EC1ML.tmp\L7srPqcuTEuwYUQXA.tmp" /SL5="$40472,5349763,721408,C:\Users\Admin\AppData\Local\Temp\nO3AtAqJ\L7srPqcuTEuwYUQXA.exe"
        5⤵
        
        PID:1232
      - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\system32\net.exe" pause shine-encoder_11151
        6⤵
        
        PID:2764
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 pause shine-encoder_11151
        7⤵
        
        PID:3956
      - C:\Users\Admin\AppData\Local\Shine Encoder 3.5.4\shineencoder.exe
        
        "C:\Users\Admin\AppData\Local\Shine Encoder 3.5.4\shineencoder.exe" -i
        6⤵
        
        PID:856
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 2160
      4⤵
      Program crash
      PID:2456
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 2208
      4⤵
      Program crash
      PID:2564
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 2160
      4⤵
      Program crash
      PID:2792
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\Gn00npyw\nXQerycmzfc1u22muMW.exe"
      4⤵
      PID:792
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\Gn00npyw\nXQerycmzfc1u22muMW.exe"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4172
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 2096
      4⤵
      Program crash
      PID:1444
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 2144
      4⤵
      Program crash
      PID:4104
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 2212
      4⤵
      Program crash
      PID:2732
  - - C:\Users\Admin\AppData\Local\Temp\Gn00npyw\nXQerycmzfc1u22muMW.exe
      C:\Users\Admin\AppData\Local\Temp\Gn00npyw\nXQerycmzfc1u22muMW.exe --silent --allusers=0
      4⤵
      PID:2452
    - - C:\Users\Admin\AppData\Local\Temp\7zS499CDCFA\setup.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS499CDCFA\setup.exe --silent --allusers=0 --server-tracking-blob=M2E3ZTAyYzUwYWRkOGUxMTQwODZkODYzZDBhYWIwOWVkNjY4NzA5YzZmYzlmZjY3MGE1Y2Y2NjEyNmFlZWQxNDp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yLz91dG1fc291cmNlPU9GVCZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1vZ3gmJnV0bV9jb250ZW50PTM1MzE4IiwidGltZXN0YW1wIjoiMTczMTY0NjQyNC42NjcxIiwidXNlcmFnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExOC4wLjAuMCBTYWZhcmkvNTM3LjM2IiwidXRtIjp7ImNhbXBhaWduIjoib2d4IiwiY29udGVudCI6IjM1MzE4IiwibWVkaXVtIjoicGIiLCJzb3VyY2UiOiJPRlQifSwidXVpZCI6IjMzZjcyZGE5LWNhMWYtNDNhNi1hYjZiLTU3ZjE4MmUxZTkzNCJ9
        5⤵
        
        PID:2516
      - C:\Users\Admin\AppData\Local\Temp\7zS499CDCFA\setup.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS499CDCFA\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.202 --initial-client-data=0x33c,0x340,0x344,0x318,0x348,0x724a8c5c,0x724a8c68,0x724a8c74
        6⤵
        
        PID:1992
      - C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe" --version
        6⤵
        
        PID:1404
      - C:\Users\Admin\AppData\Local\Temp\7zS499CDCFA\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS499CDCFA\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --vought_browser=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=2516 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_20241115045350" --session-guid=c35de55b-627c-456d-b1e1-33e19be3cce8 --server-tracking-blob=NjNjYWQyMWFkMDhhZWJiZWRjZjA3MTY0NTJkZjA4Mzg3OGNmNjQ0NjY3NDNmNzIxZjhiOTQ2YTAzMzNkYWQ2Mzp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yLz91dG1fc291cmNlPU9GVCZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1vZ3gmJnV0bV9jb250ZW50PTM1MzE4Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzMxNjQ2NDI0LjY2NzEiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTE4LjAuMC4wIFNhZmFyaS81MzcuMzYiLCJ1dG0iOnsiY2FtcGFpZ24iOiJvZ3giLCJjb250ZW50IjoiMzUzMTgiLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6Ik9GVCJ9LCJ1dWlkIjoiMzNmNzJkYTktY2ExZi00M2E2LWFiNmItNTdmMTgyZTFlOTM0In0= --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=BC04000000000000
        6⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\7zS499CDCFA\setup.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS499CDCFA\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.202 --initial-client-data=0x32c,0x330,0x334,0x308,0x338,0x715e8c5c,0x715e8c68,0x715e8c74
        7⤵
        
        PID:3360
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 2240
      4⤵
      Program crash
      PID:3364
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 2228
      4⤵
      Program crash
      PID:3848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4452 -ip 4452
1⤵
PID:2040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4452 -ip 4452
1⤵
PID:848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4452 -ip 4452
1⤵
PID:2012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4452 -ip 4452
1⤵
PID:1916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4452 -ip 4452
1⤵
PID:2028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4452 -ip 4452
1⤵
PID:2420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4452 -ip 4452
1⤵
PID:3200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4452 -ip 4452
1⤵
PID:2416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4452 -ip 4452
1⤵
PID:1556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4452 -ip 4452
1⤵
PID:1492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4452 -ip 4452
1⤵
PID:3172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4452 -ip 4452
1⤵
PID:4436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4452 -ip 4452
1⤵
PID:4104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4452 -ip 4452
1⤵
PID:3308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4452 -ip 4452
1⤵
PID:1792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4452 -ip 4452
1⤵
PID:604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4452 -ip 4452
1⤵
PID:1900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 4452 -ip 4452
1⤵
PID:652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4452 -ip 4452
1⤵
PID:2044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4452 -ip 4452
1⤵
PID:2596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4452 -ip 4452
1⤵
PID:3872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4452 -ip 4452
1⤵
PID:4756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4452 -ip 4452
1⤵
PID:2068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4452 -ip 4452
1⤵
PID:5016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4452 -ip 4452
1⤵
PID:4688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4452 -ip 4452
1⤵
PID:4188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 4452 -ip 4452
1⤵
PID:2564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4452 -ip 4452
1⤵
PID:2808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4452 -ip 4452
1⤵
PID:4788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4452 -ip 4452
1⤵
PID:4480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4452 -ip 4452
1⤵
PID:1788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4452 -ip 4452
1⤵
PID:4284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4452 -ip 4452
1⤵
PID:3700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4452 -ip 4452
1⤵
PID:3956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4452 -ip 4452
1⤵
PID:5020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4452 -ip 4452
1⤵
PID:400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 4452 -ip 4452
1⤵
PID:2520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4452 -ip 4452
1⤵
PID:1604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4452 -ip 4452
1⤵
PID:228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4452 -ip 4452
1⤵
PID:3172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4452 -ip 4452
1⤵
PID:3416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4452 -ip 4452
1⤵
PID:932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4452 -ip 4452
1⤵
PID:2044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4452 -ip 4452
1⤵
PID:2996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4452 -ip 4452
1⤵
PID:3748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\qBittorrent\qbittorrent.exe

Filesize
34.9MB

MD5
bebf18e9f646943cfe8067ab60b3ad9e

SHA1
d9dd3bb1190e70bcb338ffd713fd0c906b29d2c1

SHA256
c8169df564f2b6bc12b0e0c1d8f628f5e7daafac5b94c5d92211ed631b68a551

SHA512
531e0d546b02b1946010ca4b4ba8a26f34648efc315f75ba48d7ac534a7656c6c05d2c1a23e5a0ca80ffdc78ec133f4ba6601bb3ab6ce8392a88a8ec93093acb

Download Submit
C:\Program Files\qBittorrent\qt.conf

Filesize
84B

MD5
af7f56a63958401da8bea1f5e419b2af

SHA1
f66ee8779ca6d570dea22fe34ef8600e5d3c5f38

SHA256
fdb8fa58a6ffc14771ca2b1ef6438061a6cba638594d76d9021b91e755d030d3

SHA512
02f70ca7f1291b25402989be74408eb82343ab500e15e4ac22fbc7162eb9230cd7061eaa7e34acf69962b57ed0827f51ceaf0fa63da3154b53469c7b7511d23d

Download Submit
C:\Users\Admin\AppData\Local\BOM Mix Pro 2.0.5.4\bommixpro.exe

Filesize
3.7MB

MD5
8b9c6e0ba4512eaec159936e4c275968

SHA1
d1a8844733157fe0bdf7fe332b18f35d7c2232f9

SHA256
07a5c84c76e3766c1bce75493f5763788d6e7d1060a028bf51a91d40fb2c3ece

SHA512
3c1ad7df71ff07516282fda695f51bcf4ebf0c248d650f2fe538ff9593cb341debba740cb54df5f85fb6f5e9bba6fcae9613c2b4d400df01fcaa93064af0ce82

Download Submit
C:\Users\Admin\AppData\Local\BOM Mix Pro 2.0.5.4\sqlite3.dll

Filesize
630KB

MD5
e477a96c8f2b18d6b5c27bde49c990bf

SHA1
e980c9bf41330d1e5bd04556db4646a0210f7409

SHA256
16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

SHA512
335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
c0636f2d138baca01dbb2eedb99bf3d5

SHA1
3b927899db0f3e2cb510782592887dc02fc3e400

SHA256
10973e727e5b0eb3f12aba60a682d66e79dfd86e4b6cfc454fd8df70c6e1fa8a

SHA512
0187a6ccb6428fb24ad4bc4ca14e7ce6f40ae6ca4f352f8e86a15288deb05cb4dd317ef8e9d04dc9ffb24407ecf0924af2c7910830c79366f7e4e48cb4b82b1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
051a939f60dced99602add88b5b71f58

SHA1
a71acd61be911ff6ff7e5a9e5965597c8c7c0765

SHA256
2cff121889a0a77f49cdc4564bdd1320cf588c9dcd36012dbc3669cf73015d10

SHA512
a9c72ed43b895089a9e036aba6da96213fedd2f05f0a69ae8d1fa07851ac8263e58af86c7103ce4b4f9cfe92f9c9d0a46085c066a54ce825ef53505fdb988d1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
003b92b33b2eb97e6c1a0929121829b8

SHA1
6f18e96c7a2e07fb5a80acb3c9916748fd48827a

SHA256
8001f251d5932a62bfe17b0ba3686ce255ecf9adb95a06ecb954faa096be3e54

SHA512
18005c6c07475e6dd1ec310fe511353381cf0f15d086cf20dc6ed8825c872944185c767f80306e56fec9380804933aa37a8f12c720398b4b3b42cb216b41cf77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
215KB

MD5
e579aca9a74ae76669750d8879e16bf3

SHA1
0b8f462b46ec2b2dbaa728bea79d611411bae752

SHA256
6e51c7866705bf0098febfaf05cf4652f96e69ac806c837bfb1199b6e21e6aaf

SHA512
df22f1dff74631bc14433499d1f61609de71e425410067fd08ec193d100b70d98672228906081c309a06bcba03c097ace885240a3ce71e0da4fdb8a022fc9640

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000029

Filesize
41KB

MD5
503766d5e5838b4fcadf8c3f72e43605

SHA1
6c8b2fa17150d77929b7dc183d8363f12ff81f59

SHA256
c53b8a39416067f4d70c21be02ca9c84724b1c525d34e7910482b64d8e301cf9

SHA512
5ead599ae1410a5c0e09ee73d0fdf8e8a75864ab6ce12f0777b2938fd54df62993767249f5121af97aa629d8f7c5eae182214b6f67117476e1e2b9a72f34e0b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
6d580d9d7177f10774edb22b538e13d8

SHA1
ed358eea54fea58297558dafe1a5698026f6f503

SHA256
f6043e1eb6d4b9db7d9cb80f91694da7cbaae564d30ec1d64062448e521de938

SHA512
952268d85f40b4c776dfdc9f078df40469a253166e10911dff38f60692ea34b31aa8a471f66f09455666b7fc1ebb4593ce8ac3ba95a782f0e05f68682d8d5d67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e870a1603f8fa767545669a926a2ca84

SHA1
043adf29bf65884a85ac001bbfa076e5961a7ff3

SHA256
91dc20ca639d021d165bff23474bc36930303c6e2eacfdd82ab370aed33f19a6

SHA512
562d61c1accea37d1af7a5cf27e9e3866db7d00e5a20414a5e57006d191216eb40ec873c7a1d1865f80ea5966a98ca41ead6c17fb76220621150627faf4c5f9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
c28ba93e0ad4e83aef3bcca1e2597133

SHA1
4bb545515f7a3d1230ff944169fd7bab4ba46f97

SHA256
87ca6555ec4ef7b5ee6fc5e55fe09782a3d44a2b217e19e3d5a9ef8823b6401f

SHA512
3da4209d3b7daa6c011a93ba943e097aeb360cb5960399484cc8d163e3113244295a6a1191fdc5379888a984b14a1ff46e1d9c9ce206bf181badbdc95aa080b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
8f536aec3386b22f4b436c12e53d8f3f

SHA1
f6517b3d86180b99a35741c6662810fb4394434f

SHA256
ca2c652839312524865195d1ca87a83318c9d04717ed208ddd5a5bd51f8c69e6

SHA512
7a386187cc9eeae93badea00f257d1e56cde32638fce11da36fddd04daea2dae0027e2bed2d6609c967215fbffed737a5e68d750bd98b175cc596f058b6d746f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
514B

MD5
8a4ae9ecd91b593a70b076fee4a01a32

SHA1
74f44c7af8c11df35a8c3e985f79b21d3ce22af7

SHA256
26272305c17f6368d19ea5df3fd14a2f5da0859a715966ee4a870f0ac6eb9c43

SHA512
ca6315e01076866e675de99585d595f4295d244bc599e9aea01e91bfac2ef860b1f751c23c7b51081a5012a43f5cc2f782dd51dc8a7872c064d2adf67554d430

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
02172e4a564183583ee03fe73ea6ebc2

SHA1
7aed797f915ee583a8cd421c29a84916b8c7cd4a

SHA256
7435b3e14c7aafdc793f8760235d90fd91644a79535958d6e26ba7caeca26583

SHA512
0b0b8bd69e8e04d24b1c8a261276427d36c3e4c2bacf00710ea3b2144a73ff28f44d2ccf13bcb5c9daadf628dde570a43f46f33c594758a3705c2f7cdf00445f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f0c042414e7bda67a15537d3e056f21b

SHA1
00fc8e1beab65380fb392ca1b4623750e1cdaf7a

SHA256
190561647430c34283a124d5813f4036dcf2e4fd340ddcc326f17792ffaa6b79

SHA512
f16fc40d1f629d21adfb2df77ee516f5ed5c1bcd381bdef96740fdea56c117840a182b9811ff98e8aeadfed907588fd1858ee678131578353cb91f2f9b3eaba1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
09f9937f569c7c70b117dc465d3b22b6

SHA1
8548d402cd4f99f48e80ffd972e90d7c7a49e757

SHA256
c11683d0c0df74f7f4e78812280bb440cc8995381d723fa35cbcd16d64b8ca6f

SHA512
1a2ff16ae4442b6dc041e2565f46c62dd7614fddac456e9ebcf24812a988b157ab59cdb6f8caae31ffca2abc2f449deb2f60d466487909da74face4a9229b37e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
54305e12791cee99795dc4a10c352266

SHA1
7f351822d14dbc2580c1becab37a5f9283c761c9

SHA256
519f550929a1b5dd82892121b7120ce8dabbf1510e512aadfd8e0fb9d8303d0a

SHA512
c94569510079e3ea5f3ef6f4ce8e3e42b2e3435653a6641b34ccca40bf2163cfd0b8718615749230b6a6d12fc57779b8666387679d7df07f1a8a84fbf5bd3cb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7c11b143766054ddae7fa5fb4d430a91

SHA1
198fcc294eb19222a1ddc1c580f04d4d589e68a7

SHA256
63ff4f7df8b568dec2caa4c627064a5fc092e15beaf72f0c939e5e7359ac37da

SHA512
340c5de7df2f4741798c10519675fac046480fabf91cc17e315cdf811c9facb0645dbd3d7b6040a083893e713d087e29688dd3eec73a18c31b26a9e0b97a601e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5fed4324cedacad1c8a1ed755c853ddf

SHA1
be502a2f4ed7f6e03a9953aaffdb9fb4ae9ab666

SHA256
4cb8d1fc0d05a56fa1fef53f321c8f18f11b0177f8843f2881a19c3abed3fb8a

SHA512
a02b679bfdfa94fd4d78479593ef1c2ec7c086be9750442ff23d3863eeea1ec75fada7d2e47c51d978160254d2b472641e8dbc92ba67518837391a54adf12dd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
9a41c68ccbe033c6d12833ad0bba9f02

SHA1
7f3ff8e53355d9ebcbd1becaccb0304c6786b0cc

SHA256
e98f048851ebc09553478e162771d16389c1348187c7a6a21dcd8ccbe576d073

SHA512
f984dc9874c8fdb6fcf83f6f718ae0954472863acc9a7518b669dc32d01511cdf40da6da1d3901992c5af94b4531e9d9ddd2274610ac2507da684f8453c09513

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1415df3ef61fcb7677bcd93a2a317590

SHA1
f668c2ae652e5dd028807e5dc76fd5ff5befba93

SHA256
0f54eb0fb160b89ecff14d93d81723a3c223629f0828a47d6230983e2defcfec

SHA512
00d7d7683cc914ca64e6bf19ba7f0bcae53ecb0ab6c163a6a74d85224254ed7e10a8ecbf4c2878321f12ed3478cc309b9c2c58c78f5a61c71aa7d82aae799e35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2565b884bfcfa76c0c3e99b5ba43808a

SHA1
efa0152c824e74784f0dec040fa5862e155a6c9d

SHA256
f3a0122c22bc7548f320ee1cea503c9e5c68b2901496c1112394eb69ce06fc7b

SHA512
b71ea05492bde9b9b611dcb0d4b341937129ff7c00786348d1bad145a2d285087d1d928bda4f80a3aba56620440739b397c3f4a96828f3a5ca64569ee73282cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe592c08.TMP

Filesize
1KB

MD5
7c6a228735ec489d475898e7a2899bc0

SHA1
731e25aa9af62ecb2fb0d4dee3c31c22cc3b72dc

SHA256
cecec619a6873434953f35fc3e16eaba87b2ae68cbb0d41645894b7467732f76

SHA512
66c9522df44c81d0dff5e1745fac2aaa3349d23e3e6a7752d053a2c84866b60aa73162357d78f7196ce14adc7f9cc7199879ae7c499bb69773051b72e6727243

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1e60ea1aefad679a4bfc8d33158c1b8a

SHA1
54b2e8aa15a2ca2b392cf43e184b4ad58b5512e9

SHA256
87ca8fed4ab9da79df82fecbaa5e119e337c102c588ebb5341c3a034e4585750

SHA512
610559fb6c2fde902672074dfc15bd9a435cd22cef2de9381bc7c59d0f8c62902dc7630b42fe1e8d4d9533f9fb87a7fa08a6e50b76f7483df018e53aa986a7b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
687715d5eeeb55255cddf2bb462b2128

SHA1
7b48d94c680ce83dfb74251ef21ac00aa3812aee

SHA256
fcdb8292736d8837889b1b934efd562fe8e5f712d42ddb206163f9dae2d05576

SHA512
1fd65da514400058c973aa70170571467bf6940462ca51cd59cd02dbb7995362cf7a2d359beecd86085c58c58b5fd60008ef0652956169c3eee5aafb4adc1ede

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7609c956db586968185ce09ebc5ea8cc

SHA1
c9508101980db66beb36774e28a1d573fa0e94ee

SHA256
55988b54659ecd6f7017766f3abacc0a095f9b953d1c17e32969a71cec101c6b

SHA512
1a95619a2cf7add40beeecc6464f85df4e07f310717515f77c1d94ea0049233a0b507bc06ac0166fab779c9606474105ba3e534f601c66c0e9e3502870e8746d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
16KB

MD5
0816d9266892d2a241eb8682fe4a0bec

SHA1
bac4f44a602f1885eb4861bf24ae89ca0d65c64c

SHA256
be17ab684fc1e1415e7a0ac34f3efe179d577af121677175d2a767abcecc3906

SHA512
cec6931b97c454591d095092240b7ea05a917a59f0483c2b07abfd762ae4e89a0d7e38215899583506d1c082e445a5d58741607bb5e969cb734d1a6463a353a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe

Filesize
5.7MB

MD5
bbc9dde7f20c005a8ca5974e946a5663

SHA1
aa317defa9db6a3d33a3db9b4da1904077d83210

SHA256
a5d59d6f604d4d72bb2973b692c45491284d35138683032c83c15c1165b9e38b

SHA512
0a68847c93178524ecd59e819453f9c489d0237d3d7663cba39cbf9165b7f2534b61161d3e38c06ff59e53b8235761707d780eccc89df4f355b9dddb5a22324a

Download Submit
C:\Users\Admin\AppData\Local\Temp\4CSP3sto\gzrBhxYzCo6.exe

Filesize
136KB

MD5
107dfe0cf9d5a4a8d5e6a6cab6a18ac4

SHA1
84fc56014e90477bc26151f2e195bbd913404111

SHA256
529c719efd1944957da022b2b40b922e426f3a07a5cda53db6c508823c3e8193

SHA512
aa074ab9e0761bc452782decf07345607d9383d6f9054e8020380cdac3683942588d7ab3a787425d3e652d4000b5a0f59094bbdbd8aefecb0cda911d7688c4ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2411150453500431992.dll

Filesize
6.0MB

MD5
3d0b13763c6696221cd6e7524b974ca8

SHA1
eeb708cbcd0ccb345c73306eb878d4199f8ee85b

SHA256
528508786ad5fa13459642873f63d50b627b97f61af806ea3435c42551e1e368

SHA512
454277b795acc603c4c952962a41962d0f4ff879eaf1af664e6c65c577c410738bde6cff56eabc604304aa1b2e0e4c031d8236f5ba8821406fdeff60b7d09885

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1ibcvdqk.vm4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-EC1ML.tmp\L7srPqcuTEuwYUQXA.tmp

Filesize
2.4MB

MD5
a1236112cc75c8da0653011ce2cf2247

SHA1
b6c06478512173454080f9cb8d4b97235124e616

SHA256
956ae0793e263a493d2bddbec0ad3be08eb69f47b01f0886981994b4229f8468

SHA512
4449b9b185bdebdbd30a12d15c0e5c8b7b8a5f72475944529f822635f4fa7b1955dca4b6ea8e0f4d77eff3dc8355eb8eea71970d08e8f7dc2a342757bcac64e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-HS8JB.tmp\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-JFOBN.tmp\is-JN8V9.tmp

Filesize
643KB

MD5
a3df72bf1be6b620b284303c24499ffa

SHA1
7b375f32b24436077b74904dc9b5f1dc4495c23f

SHA256
c943f04be21e29e8a0e49df55fa4cef5fb881dfe3360d4be60dd29a1e434e3bf

SHA512
81419240b1954936e90b78046dc6b8441fff88cfcccfa14018578b2452d6504721104e34acb185084371fc4707f3574817ceb75c2c70c94d9aa8d76e3f275905

Download Submit
C:\Users\Admin\AppData\Local\Temp\nO3AtAqJ\L7srPqcuTEuwYUQXA.exe

Filesize
5.8MB

MD5
52f296e8b211e053e00749f107aae744

SHA1
b1c3bd026016e261add093a0279f3b5168ffdfb0

SHA256
7ce109b5e33c9067adfc1ef40e3be86f914100aee2a220e8f68a92c02723094a

SHA512
fc8610fce779038dbc920e14d01eae99804c82eae59b6f5cacc55559276d46a7de9974ee70069bfb4de13e060e7920680879b3e1428ef9bbf7c2fb578d9386fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8ADD.tmp\FindProcDLL.dll

Filesize
3KB

MD5
b4faf654de4284a89eaf7d073e4e1e63

SHA1
8efcfd1ca648e942cbffd27af429784b7fcf514b

SHA256
c0948b2ec36a69f82c08935fac4b212238b6792694f009b93b4bdb478c4f26e3

SHA512
eef31e332be859cf2a64c928bf3b96442f36fe51f1a372c5628264a0d4b2fc7b3e670323c8fb5ffa72db995b8924da2555198e7de7b4f549d9e0f9e6dbb6b388

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8ADD.tmp\LangDLL.dll

Filesize
5KB

MD5
50016010fb0d8db2bc4cd258ceb43be5

SHA1
44ba95ee12e69da72478cf358c93533a9c7a01dc

SHA256
32230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e

SHA512
ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8ADD.tmp\System.dll

Filesize
12KB

MD5
4add245d4ba34b04f213409bfe504c07

SHA1
ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

SHA256
9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

SHA512
1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8ADD.tmp\UAC.dll

Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8ADD.tmp\modern-wizard.bmp

Filesize
25KB

MD5
cbe40fd2b1ec96daedc65da172d90022

SHA1
366c216220aa4329dff6c485fd0e9b0f4f0a7944

SHA256
3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2

SHA512
62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8ADD.tmp\nsDialogs.dll

Filesize
9KB

MD5
1d8f01a83ddd259bc339902c1d33c8f1

SHA1
9f7806af462c94c39e2ec6cc9c7ad05c44eba04e

SHA256
4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed

SHA512
28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8ADD.tmp\nsisFirewallW.dll

Filesize
8KB

MD5
f5bf81a102de52a4add21b8a367e54e0

SHA1
cf1e76ffe4a3ecd4dad453112afd33624f16751c

SHA256
53be5716ad80945cb99681d5dbda60492f5dfb206fbfdb776b769b3eeb18d2c2

SHA512
6e280a75f706474ad31b2ce770fa34f54cb598528fac4477c466200a608b79c0f9b84011545595d9ba94331ad08e2f51bd42de91f92379db27686a28ba351256

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshAC7F.tmp\INetC.dll

Filesize
21KB

MD5
92ec4dd8c0ddd8c4305ae1684ab65fb0

SHA1
d850013d582a62e502942f0dd282cc0c29c4310e

SHA256
5520208a33e6409c129b4ea1270771f741d95afe5b048c2a1e6a2cc2ad829934

SHA512
581351aef694f2489e1a0977ebca55c4d7268ca167127cefb217ed0d2098136c7eb433058469449f75be82b8e5d484c9e7b6cf0b32535063709272d7810ec651

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshAC7F.tmp\blowfish.dll

Filesize
22KB

MD5
5afd4a9b7e69e7c6e312b2ce4040394a

SHA1
fbd07adb3f02f866dc3a327a86b0f319d4a94502

SHA256
053b4487d22aacf8274bab448ae1d665fe7926102197b47bfba6c7ed5493b3ae

SHA512
f78efe9d1fa7d2ffc731d5f878f81e4dcbfaf0c561fdfbf4c133ba2ce1366c95c4672d67cae6a8bd8fcc7d04861a9da389d98361055ac46fc9793828d9776511

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshAC7F.tmp\nsProcess.dll

Filesize
4KB

MD5
faa7f034b38e729a983965c04cc70fc1

SHA1
df8bda55b498976ea47d25d8a77539b049dab55e

SHA256
579a034ff5ab9b732a318b1636c2902840f604e8e664f5b93c07a99253b3c9cf

SHA512
7868f9b437fcf829ad993ff57995f58836ad578458994361c72ae1bf1dfb74022f9f9e948b48afd3361ed3426c4f85b4bb0d595e38ee278fee5c4425c4491dbf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
12KB

MD5
394ebe81cbdfb10870d78057af0eda5c

SHA1
999a476a8e2459f7d087667bec634750ee2180b8

SHA256
56ff5c039b96c223855633c8b51009a9d5e48b677f1caf79da0affb96012be2b

SHA512
82ee26f4c53b30bbe715f5ca123a5aec2699136b17b60fe75bdee29dc7f52b973b7a2829ecc9479f479f03400f0318904336036bfe4993408fbab8221b444258

Download Submit
C:\Users\Admin\Downloads\the-longing-codex_lFWtfVRChW.zip

Filesize
6.6MB

MD5
1848fd9a9fe56cc4d23704a655000ede

SHA1
4d19670a1e7f854db17874c6cd5617f8a2ff4c35

SHA256
dde495807e394adf6ce0fa77dcd653569c68901f24d06ccec479d16b22c039a2

SHA512
3d1d6a58c1774b481e53c094bc4f5417d4cc3cdc85599b93c6a23b796fa7cb3a7c32ae71789f12e31a3da402cccab8283eb3958fa9d9cf8ee3719b85e7273b92

Download Submit
C:\Users\Admin\Downloads\the-longing-codex_lFWtfVRChW.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/716-653-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/716-832-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/856-968-0x0000000000400000-0x000000000071E000-memory.dmp

Filesize
3.1MB

Download
memory/856-970-0x0000000000400000-0x000000000071E000-memory.dmp

Filesize
3.1MB

Download
memory/1680-865-0x00000000073F0000-0x0000000007A6A000-memory.dmp

Filesize
6.5MB

Download
memory/1680-839-0x00000000028F0000-0x0000000002926000-memory.dmp

Filesize
216KB

Download
memory/1680-855-0x0000000005DC0000-0x0000000005DDE000-memory.dmp

Filesize
120KB

Download
memory/1680-866-0x00000000062F0000-0x000000000630A000-memory.dmp

Filesize
104KB

Download
memory/1680-852-0x00000000058C0000-0x0000000005C17000-memory.dmp

Filesize
3.3MB

Download
memory/1680-843-0x0000000005850000-0x00000000058B6000-memory.dmp

Filesize
408KB

Download
memory/1680-842-0x00000000057E0000-0x0000000005846000-memory.dmp

Filesize
408KB

Download
memory/1680-841-0x0000000004F10000-0x0000000004F32000-memory.dmp

Filesize
136KB

Download
memory/1680-840-0x0000000005140000-0x000000000576A000-memory.dmp

Filesize
6.2MB

Download
memory/1680-856-0x0000000005DE0000-0x0000000005E2C000-memory.dmp

Filesize
304KB

Download
memory/4172-979-0x00000000058D0000-0x0000000005C27000-memory.dmp

Filesize
3.3MB

Download
memory/4172-983-0x0000000005F70000-0x0000000005FBC000-memory.dmp

Filesize
304KB

Download
memory/4344-910-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/4452-835-0x0000000060900000-0x0000000060992000-memory.dmp

Filesize
584KB

Download
memory/4452-834-0x0000000000400000-0x0000000000BB7000-memory.dmp

Filesize
7.7MB

Download
memory/4452-836-0x0000000000400000-0x0000000000BB7000-memory.dmp

Filesize
7.7MB

Download
memory/4452-689-0x0000000000400000-0x0000000000BB7000-memory.dmp

Filesize
7.7MB

Download
memory/4452-688-0x0000000000400000-0x0000000000BB7000-memory.dmp

Filesize
7.7MB

Download
memory/4744-833-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download