878ca7e3fb7a90a937afdbe080c055877b4c6334a9589d27e092fd6737a0716f

Resubmissions

23-12-2024 20:58

241223-zskw6s1lfs 8

23-12-2024 20:49

241223-zl9lys1kbz 8

Analysis

max time kernel
240s
max time network
242s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 20:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

qbittorrent_5.0.3_x64_setup.exe
Size

37.5MB
MD5

83505c82e83bd2e61bd67dfcf30724cf
SHA1

5fbde5f904a7c0e1346b9bcef4a66a7a7dd7e5b9
SHA256

878ca7e3fb7a90a937afdbe080c055877b4c6334a9589d27e092fd6737a0716f
SHA512

87ead0cac1dd041f7929e68bfdf8b61ac50c9d05a74344ab951f9c624874452e22a30f678a6a059cc3e8906f92189c39cfe7bba6552681140d610edb1b529833
SSDEEP

786432:7nvRa6b9c7DLVZhxGjtYO9NByxgyXXbFTUgCe4Oa0eMe6NwRI/gWfe+C:7paO9c7VZejf3OBbFTU3U+6NxIV+C

Score

8^/10

discovery phishing

Malware Config

Signatures

Contacts a large (919) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing

Executes dropped EXE 1 IoCs

pid	Process
3488	qbittorrent.exe

Loads dropped DLL 7 IoCs

pid	Process
1016	qbittorrent_5.0.3_x64_setup.exe
1016	qbittorrent_5.0.3_x64_setup.exe
1016	qbittorrent_5.0.3_x64_setup.exe
1016	qbittorrent_5.0.3_x64_setup.exe
1016	qbittorrent_5.0.3_x64_setup.exe
1016	qbittorrent_5.0.3_x64_setup.exe
1016	qbittorrent_5.0.3_x64_setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
116	yandex.com
118	yandex.com
119	yandex.com
120	yandex.com

Drops file in Program Files directory 39 IoCs

description	ioc	Process
File created	C:\Program Files\qBittorrent\translations\qtbase_de.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_gd.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_hu.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_it.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_nl.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_nn.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_pt_BR.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_zh_CN.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qt_pt_PT.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ar.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_lv.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_zh_TW.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\uninst.exe	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qt_gl.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_bg.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_fi.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_hr.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_pl.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ru.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\qbittorrent.exe	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qt_sv.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_he.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ka.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ko.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_tr.qm	qbittorrent_5.0.3_x64_setup.exe
File opened for modification	C:\Program Files\qBittorrent\qbittorrent.exe	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\qbittorrent.pdb	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_da.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_es.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ja.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_sk.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\qt.conf	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qt_lt.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_fr.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_uk.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qt_sl.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ca.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_cs.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_fa.qm	qbittorrent_5.0.3_x64_setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qbittorrent_5.0.3_x64_setup.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies registry class 27 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent.Url.Magnet	qbittorrent_5.0.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\Content Type = "application/x-magnet"	qbittorrent_5.0.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\DefaultIcon\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\",1"	qbittorrent_5.0.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\shell\open\command\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\" \"%1\""	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet\ = "Magnet URI"	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet\shell\open\command	qbittorrent_5.0.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\ = "URL:Magnet URI"	qbittorrent_5.0.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\ = "Torrent File"	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent.File.Torrent\DefaultIcon	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\shell\open\command	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet\shell\open	qbittorrent_5.0.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet\shell\open\command\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\" \"%1\""	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\magnet	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent.File.Torrent	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.torrent	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent.Url.Magnet\DefaultIcon	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet\shell	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent.File.Torrent\shell\open\command	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\shell	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\shell\open	qbittorrent_5.0.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet\DefaultIcon\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\",1"	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent.Url.Magnet\shell\open\command	qbittorrent_5.0.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.torrent\Content Type = "application/x-bittorrent"	qbittorrent_5.0.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\URL Protocol	qbittorrent_5.0.3_x64_setup.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3488	qbittorrent.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1016	qbittorrent_5.0.3_x64_setup.exe
1016	qbittorrent_5.0.3_x64_setup.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3488	qbittorrent.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3884	firefox.exe
Token: SeDebugPrivilege	3884	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe
3488	qbittorrent.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 3884	2176	firefox.exe	94
PID 2176 wrote to memory of 3884	2176	firefox.exe	94
PID 2176 wrote to memory of 3884	2176	firefox.exe	94
PID 2176 wrote to memory of 3884	2176	firefox.exe	94
PID 2176 wrote to memory of 3884	2176	firefox.exe	94
PID 2176 wrote to memory of 3884	2176	firefox.exe	94
PID 2176 wrote to memory of 3884	2176	firefox.exe	94
PID 2176 wrote to memory of 3884	2176	firefox.exe	94
PID 2176 wrote to memory of 3884	2176	firefox.exe	94
PID 2176 wrote to memory of 3884	2176	firefox.exe	94
PID 2176 wrote to memory of 3884	2176	firefox.exe	94
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4480	3884	firefox.exe	95
PID 3884 wrote to memory of 4956	3884	firefox.exe	96
PID 3884 wrote to memory of 4956	3884	firefox.exe	96
PID 3884 wrote to memory of 4956	3884	firefox.exe	96
PID 3884 wrote to memory of 4956	3884	firefox.exe	96
PID 3884 wrote to memory of 4956	3884	firefox.exe	96
PID 3884 wrote to memory of 4956	3884	firefox.exe	96
PID 3884 wrote to memory of 4956	3884	firefox.exe	96
PID 3884 wrote to memory of 4956	3884	firefox.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\qbittorrent_5.0.3_x64_setup.exe
"C:\Users\Admin\AppData\Local\Temp\qbittorrent_5.0.3_x64_setup.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1016

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2024 -parentBuildID 20240401114208 -prefsHandle 1940 -prefMapHandle 1924 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6d826967-ca01-4691-96eb-e348ba56fbbc} 3884 "\\.\pipe\gecko-crash-server-pipe.3884" gpu
    3⤵
    PID:4480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2440 -parentBuildID 20240401114208 -prefsHandle 2432 -prefMapHandle 2428 -prefsLen 23716 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c073da44-3943-4d8d-a7c4-6fa9002ecc7e} 3884 "\\.\pipe\gecko-crash-server-pipe.3884" socket
    3⤵
    - Checks processor information in registry
    PID:4956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3124 -childID 1 -isForBrowser -prefsHandle 3128 -prefMapHandle 3012 -prefsLen 23857 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {833cf6f6-6aa3-40c0-8b73-51988643ff20} 3884 "\\.\pipe\gecko-crash-server-pipe.3884" tab
    3⤵
    PID:3772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4128 -childID 2 -isForBrowser -prefsHandle 4120 -prefMapHandle 4116 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {db3a30b6-4fb7-445b-b5e5-b2f7c1657c0e} 3884 "\\.\pipe\gecko-crash-server-pipe.3884" tab
    3⤵
    PID:3168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5080 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 5072 -prefMapHandle 5068 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d094dfab-a187-4232-9801-ecdb42c42578} 3884 "\\.\pipe\gecko-crash-server-pipe.3884" utility
    3⤵
    - Checks processor information in registry
    PID:5436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5432 -childID 3 -isForBrowser -prefsHandle 5424 -prefMapHandle 5304 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a361cdba-965b-45d7-80ec-1fe84d7b9832} 3884 "\\.\pipe\gecko-crash-server-pipe.3884" tab
    3⤵
    PID:5864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5660 -childID 4 -isForBrowser -prefsHandle 5580 -prefMapHandle 5588 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac290b11-b57e-4343-9142-c75f297c6c9a} 3884 "\\.\pipe\gecko-crash-server-pipe.3884" tab
    3⤵
    PID:5876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5552 -childID 5 -isForBrowser -prefsHandle 5800 -prefMapHandle 5808 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b4ceabad-1811-437c-bfbc-14451e8aed56} 3884 "\\.\pipe\gecko-crash-server-pipe.3884" tab
    3⤵
    PID:5888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6264 -childID 6 -isForBrowser -prefsHandle 6224 -prefMapHandle 6216 -prefsLen 30981 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {794bd6ee-d2b8-4ab6-8831-58774a339f0a} 3884 "\\.\pipe\gecko-crash-server-pipe.3884" tab
    3⤵
    PID:5340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6492 -childID 7 -isForBrowser -prefsHandle 6656 -prefMapHandle 6652 -prefsLen 31023 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b89b5b15-1dd2-40d2-84b9-6cb324207256} 3884 "\\.\pipe\gecko-crash-server-pipe.3884" tab
    3⤵
    PID:5416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6452 -childID 8 -isForBrowser -prefsHandle 6784 -prefMapHandle 6656 -prefsLen 31023 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8b2f0cf2-48a1-4769-83ea-06ac7b5960e4} 3884 "\\.\pipe\gecko-crash-server-pipe.3884" tab
    3⤵
    PID:5424

C:\Program Files\qBittorrent\qbittorrent.exe
"C:\Program Files\qBittorrent\qbittorrent.exe" "magnet:?xt=urn:btih:D4FEB0B237B8A3F109C3191E06E53B22C1E7FAD7&tr=http%3A%2F%2Fbt3.t-ru.org%2Fann%3Fmagnet&dn=Adobe%20Photoshop%202023%2024.7.0.643%20%2B%20Firefly%20AI%2025.0.0.2254%20%2B%2025.0.0.2265%20by%20m0nkrus%20%5B2023%2C%20Multi%20%2B%20RUS%5D"
1⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\qBittorrent\qbittorrent.exe

Filesize
35.0MB

MD5
7a47d50bdb7a84a1fa58653f55eb2697

SHA1
fd767a6225bfdcca0537043b8f647d6ce33f7d1c

SHA256
6864e1a85198efb8ecf5f26564f7565d4d4e93f1ba7e4359bc05910ad74e83f0

SHA512
8c292a2a0bd6be2dac30e0f2cefe9bfd73aaff96e0cbb1301bba283fa8eabf378bbbc2c45667ec0cb0092e92d54bc02f054fb74b51eaa9068839225c3915d753

Download Submit
C:\Program Files\qBittorrent\qt.conf

Filesize
84B

MD5
af7f56a63958401da8bea1f5e419b2af

SHA1
f66ee8779ca6d570dea22fe34ef8600e5d3c5f38

SHA256
fdb8fa58a6ffc14771ca2b1ef6438061a6cba638594d76d9021b91e755d030d3

SHA512
02f70ca7f1291b25402989be74408eb82343ab500e15e4ac22fbc7162eb9230cd7061eaa7e34acf69962b57ed0827f51ceaf0fa63da3154b53469c7b7511d23d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85mw8mk9.default-release\activity-stream.discovery_stream.json

Filesize
19KB

MD5
51db9d1d5ffba12fa893192e0e47799b

SHA1
2da0a10d95dd610d16df7de4bbe09d3291e6106f

SHA256
a6a23ba82a5739dae8cfde47945a05ce572bf3c7e38e12cf1797cbcc59d556db

SHA512
0a5984b77802fbe2f525aff5a827a84914607582ff698e02ccf05123c230b3c69ac167e491657bc94a8d973e03c609f604657b900fd3e1f8f0a28f0afdb453d4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85mw8mk9.default-release\cache2\entries\6653BC7BE242C21AA1988A4A42D1DEDA18231C31

Filesize
13KB

MD5
26d81d68bf5ef3db92da6f197d259d8e

SHA1
08ae81f842432ef27d95aab34b2ff3d074464aa6

SHA256
7f63f7283c0c415f00208ce916fa5a8d06de9a9f03154642e89dccaa56b7144d

SHA512
064fb046c4e397be624052b3333e6876ef96af9e54618b93d6773c6b0ad0552c3ff1d6bf6d72afbd47ba2ff0a294af7b0bba0e0f4ee00250164977bfabdd21c8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85mw8mk9.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Temp\nscA5F6.tmp\FindProcDLL.dll

Filesize
3KB

MD5
b4faf654de4284a89eaf7d073e4e1e63

SHA1
8efcfd1ca648e942cbffd27af429784b7fcf514b

SHA256
c0948b2ec36a69f82c08935fac4b212238b6792694f009b93b4bdb478c4f26e3

SHA512
eef31e332be859cf2a64c928bf3b96442f36fe51f1a372c5628264a0d4b2fc7b3e670323c8fb5ffa72db995b8924da2555198e7de7b4f549d9e0f9e6dbb6b388

Download Submit
C:\Users\Admin\AppData\Local\Temp\nscA5F6.tmp\LangDLL.dll

Filesize
5KB

MD5
50016010fb0d8db2bc4cd258ceb43be5

SHA1
44ba95ee12e69da72478cf358c93533a9c7a01dc

SHA256
32230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e

SHA512
ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233

Download Submit
C:\Users\Admin\AppData\Local\Temp\nscA5F6.tmp\System.dll

Filesize
12KB

MD5
4add245d4ba34b04f213409bfe504c07

SHA1
ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

SHA256
9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

SHA512
1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nscA5F6.tmp\UAC.dll

Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
C:\Users\Admin\AppData\Local\Temp\nscA5F6.tmp\modern-wizard.bmp

Filesize
25KB

MD5
cbe40fd2b1ec96daedc65da172d90022

SHA1
366c216220aa4329dff6c485fd0e9b0f4f0a7944

SHA256
3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2

SHA512
62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nscA5F6.tmp\nsDialogs.dll

Filesize
9KB

MD5
1d8f01a83ddd259bc339902c1d33c8f1

SHA1
9f7806af462c94c39e2ec6cc9c7ad05c44eba04e

SHA256
4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed

SHA512
28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567

Download Submit
C:\Users\Admin\AppData\Local\Temp\nscA5F6.tmp\nsisFirewallW.dll

Filesize
8KB

MD5
f5bf81a102de52a4add21b8a367e54e0

SHA1
cf1e76ffe4a3ecd4dad453112afd33624f16751c

SHA256
53be5716ad80945cb99681d5dbda60492f5dfb206fbfdb776b769b3eeb18d2c2

SHA512
6e280a75f706474ad31b2ce770fa34f54cb598528fac4477c466200a608b79c0f9b84011545595d9ba94331ad08e2f51bd42de91f92379db27686a28ba351256

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\AlternateServices.bin

Filesize
6KB

MD5
64c6a635c8f9fbe2c39b2d199836b0cc

SHA1
79e5a2c8818826af6dbf7abb008616d3ceb57b68

SHA256
45e0feac30713eb021d10defa7138f2ce24aaf225f4d11fcc0f86304d080fb4b

SHA512
4dd02b5b27106778b2d54b9d60c5f8a8e574d2e9bb469e4ad045b15736703a6fd3acb8ee5b11a00f6739097e037483a427900943b3ff20104a0cba3d7e9cc72e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\AlternateServices.bin

Filesize
11KB

MD5
8d0454f85f975fcd1831c7f6827098a2

SHA1
714dcfa831dd26d5a82922848e56577dd0e26061

SHA256
bc18723571f3d058f5a1101e058c9b961322637278983be264ff4f7ac9ccf7ff

SHA512
db6097f5f30686c5f730ffc3c617c24e0aa14a208e7af5318e716336d807c07a09e3982c0f74d0a71db951330fc1a6af03c794db8e6f56b0c1983cfd116e1865

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
670f7e9d926353da45d1181d9efda6aa

SHA1
ffda204dcf315a48090cf4a4688238ef5134ffb8

SHA256
a5d0c08a7de9bf55a9756b8602f27274cefc9311c53930c6e9e4ed89a6d08217

SHA512
e28b14766f1504eb5f4495fa4652d7a7e6b8b0923d8f7294854d25bcbacbe9f7acfc02316a60340e2e084a8106aee8f5c2b5650add1a18c2005eef2a044efc6b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp

Filesize
13KB

MD5
39d4a49e9e94e051d944402f456e0243

SHA1
968b7b2f76c8bffe4c5e1330766f93d8d9b8377b

SHA256
19fd4109d4a036cc0d528399221b5b9ba3556eb410b591c9c6d242a90a4d6c2e

SHA512
e74aa3f174ea4a080d3449be59d966930fe9b08e949634b99f5c67f7dcb05b653566ac441eaf31c32378f31c6129ea3a453e9723828a335869eea04323acc51d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp

Filesize
14KB

MD5
3178083e10dfd446ae40b09a862e1862

SHA1
3ce22d8777ecb84142b6f508f48b9b8c3d965591

SHA256
d9c0e3322008166e388bffaf87ece4bfcdd86c75c0a4eb76b8594ec8176479f3

SHA512
219cc31cb5609f787e4229f4eb9270336ae208b4ea7400a60f98c072afdd6dca3880c8f67f6d52a719cd972f691da64cca03e7b333b33d39871fa162f5683f34

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\pending_pings\11cf64f7-615e-4ba6-9f99-33305569030d

Filesize
982B

MD5
a1ea19b1d90fff3266d657f3def7ec5c

SHA1
bbcccc666bb47063a609437caf87d365031ce244

SHA256
29473fc74aed61a5b48879f3e913aef008496a5571a75c44e564b0645079ee35

SHA512
1ee4740d7cd73e89a900b3cb42cb13180fad25f05ce177305171390feb367679105b7231c1812656aede83cd6dfa2c8f7610d9f0098a688855c132b63c9ddef7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\pending_pings\5fc11c3f-698e-4496-8e26-9c430fc529a5

Filesize
671B

MD5
cd22d8904c3972e83b5e0edf7fe6a81b

SHA1
07dc607b95c08125d5c7dbbc9d93a9bea0193e91

SHA256
8d824002ea1ceb490bbb8e97134a9a4d2c79d946d4faee6cf2dd235a38bc2d1e

SHA512
9388428f57024685a9d4ee188e2696fb9bc9aa68d7ec1fe147b50b4ab2021c76faa0263107bbaa8ee7cdd19564e109e3fe5712fee8c7d00f7c76159703caec29

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\pending_pings\6fdd60ac-f03a-4c8b-a7d1-a5ec59cd6060

Filesize
24KB

MD5
b0c695b5566c9b96c11a5f368ba37d92

SHA1
9083129811ad8ebfddb4feda7556234a10042d0c

SHA256
eee7dfb4cd4503c3e4401f1c4dd927d2fd9a160a11891f976e1b6ca13ed82936

SHA512
44302ad6dd2c81ae0158ce1a0631522e699a398d8e873de9e00d0abd5593e409521402a59d7b19dcbe421bd05bcb164f995a1393ec4816bb69742e5106c04fb7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\pending_pings\aabe0994-7272-4ab0-84ff-fbfa36dbfc5a

Filesize
16KB

MD5
5898e8ffcabd9aec6d251325405e967f

SHA1
b7f19fcf9152e9423f9b9487213114964a01e011

SHA256
25a6489751a24c74ce4e040e4ae338dce85e58c60b43a6bf5b6bf97e3799d492

SHA512
cc77770aa1b3d5ef08600f7d1ca8f0422f2e4388e84ec5abcc68b806e0cf0e046e5ab98bff033aa2a856b6bf1571885ca7c9e336aeb2908eef5e92e4e649390b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs-1.js

Filesize
15KB

MD5
4f02c5052b3a0f7b17db1e6f98f3dfb9

SHA1
4f65ca445187cc28f6e5881fdc832b8f19fcf688

SHA256
755624846fc8a7cd490f4865734ea4fc78b09b8f489b492bf9a56da42247ba8c

SHA512
25d7c07042884a5ddbec6249f78d3678a5f274b5a2dc67666c030d8d557adc1fa69758d014b46f8d67c5e63cf0b980ad97823408d9e73ba764fa98a6f80954c1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs.js

Filesize
11KB

MD5
8e1e3f1082fcf7c1db11f69d7efdc14f

SHA1
fb78dc20bbe543c1c5c23db33c9b6bc09ef21ee4

SHA256
3f21da2d0bcf1109180bf1d87deb8f918433fac47463389e79657e85bd506c98

SHA512
906355065bc434a08bfa5bf7482128c2194f3e057355be8cd2e80b58ba1cf29cf15d81a6715205d9ba3be33733caa4712829b8b8b24b3e2bcb04dbb73f3461ff

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs.js

Filesize
10KB

MD5
28494d295ef6d1d1b6310751ba16a4a4

SHA1
834dfbef2f962ca11d5dfeba05e71babc15fad6c

SHA256
725b345be7b63110007bb49ec9ceb51abff520468b667df6d98bc164b56d4e13

SHA512
439667e45cac9d67669e8bbc3f48ff4eacd7316a7a943ebe7e149163a4be56dbc7266ffe1e866e557f43244803d0c84f75971d9ea41aaa6616b3ea2ddee4d40c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs.js

Filesize
12KB

MD5
f1c13c6e213a13245d4f8e4c15713480

SHA1
5bb761ca9c569d7a710363d9f4250a246b90ebd8

SHA256
0efdfcbe34e767df7acfeb361dc155e17bccd7378f5831fa5f598bf68a941795

SHA512
028f2ac5158b1d9061adc0cfc046a4c88f1179bb1e3449db455cfe5df88d265c27843d161083158f0dbed6ca28ab2eeb56f7f0e1c6e55a80a1fcf0d94a307413

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs.js

Filesize
10KB

MD5
220c4540689215d87e93358a539fe480

SHA1
19e690d426159ffdd66d074ebbcd86ece2e52114

SHA256
0aba69b09319d6a29fd118e268ae529a9e20329ce3839f3ec9c645f3983c94eb

SHA512
ec4938180db9a213a01a4b64d54d9c113ceb9e5ae64369522e1a909746a71703f1cf944451095e92bffdf5bb79fb53905020285186de8166869cb923dd5d7eb6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
4218c751195779f667d79a7a0a484709

SHA1
bc02c234a0668ac1489d882229c6e38dd45cc1ff

SHA256
48ca41626d9e16b4fa2e65df6d076b8fe78fa1c5a979040d2bce2d1843f7cee8

SHA512
4b06d231648b7aee2b43cc1067eb38d42d5d9e6edb4549594b0717b80ef54c4be64e9f6fdee70eb953a9d3aebb68d871d708206f4a6ba26a2cd49ace45284deb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
d21091363e10e4204d8eac16da92b647

SHA1
b90fc797b7c569b541e649714395022db4e53e30

SHA256
6c877a71f231d006d260ff4226ff93dbbe907a6b14bca7350921e6b54b201fe6

SHA512
1dd0c9fcb22c9c5ee19b888f05ecb993dfbd5cea3c436549b3fe265380a3d45b126e54c8841d4f8d5d715c9b311b2e8a1352054240e13de0e77be365f5dd7691

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\sessionstore-backups\recovery.baklz4

Filesize
2KB

MD5
ced8450b5672c5dee9ef6ff36304d6f3

SHA1
29cfb03fab696b1a32a9fec70c472f38a621a756

SHA256
4d7e60b3fd4e2283642b3d1f27ae8c6f0ae90cb01ea04c4f133c1f1dda16feaa

SHA512
c9da2af2230944f5d77ea8c5671782304880c1e8d4700476e8ceb2029aebf75046f79c6a69d7291b92678a7cbbc4ec58ac5adee900383a4f2ef9bd87793eee0f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\sessionstore-backups\recovery.baklz4

Filesize
6KB

MD5
6d2e059e80d188f5ac9326b3beceadd1

SHA1
758ba9891395fd7d599d3f43cb0e688e99858325

SHA256
e804d8ef93f2e3eff908feec23da7cef29fc9293e0902b91b55ab98e8ff945e4

SHA512
5906244c15dd0493311e888252ffe234e14c75d3b30885ca8fd21d3f8445af30d12a40abc359217a113f4cbc6daadcad6271b084a60b49d5050afe5b602fab2c

Download Submit