878ca7e3fb7a90a937afdbe080c055877b4c6334a9589d27e092fd6737a0716f

Analysis

max time kernel
592s
max time network
595s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
26-12-2024 15:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

qbittorrent_5.0.3_x64_setup.exe
Size

37.5MB
MD5

83505c82e83bd2e61bd67dfcf30724cf
SHA1

5fbde5f904a7c0e1346b9bcef4a66a7a7dd7e5b9
SHA256

878ca7e3fb7a90a937afdbe080c055877b4c6334a9589d27e092fd6737a0716f
SHA512

87ead0cac1dd041f7929e68bfdf8b61ac50c9d05a74344ab951f9c624874452e22a30f678a6a059cc3e8906f92189c39cfe7bba6552681140d610edb1b529833
SSDEEP

786432:7nvRa6b9c7DLVZhxGjtYO9NByxgyXXbFTUgCe4Oa0eMe6NwRI/gWfe+C:7paO9c7VZejf3OBbFTU3U+6NxIV+C

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000\Control Panel\International\Geo\Nation	qbittorrent_5.0.3_x64_setup.exe

Executes dropped EXE 3 IoCs

pid	Process
2104	qbittorrent.exe
5388	qbittorrent.exe
2540	qbittorrent.exe

Loads dropped DLL 7 IoCs

pid	Process
2976	qbittorrent_5.0.3_x64_setup.exe
2976	qbittorrent_5.0.3_x64_setup.exe
2976	qbittorrent_5.0.3_x64_setup.exe
2976	qbittorrent_5.0.3_x64_setup.exe
2976	qbittorrent_5.0.3_x64_setup.exe
2976	qbittorrent_5.0.3_x64_setup.exe
2976	qbittorrent_5.0.3_x64_setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 39 IoCs

description	ioc	Process
File created	C:\Program Files\qBittorrent\qt.conf	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_hr.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ka.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_nn.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qt_lt.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ar.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_fa.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ja.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ru.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\qbittorrent.exe	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_de.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_hu.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_pl.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_zh_CN.qm	qbittorrent_5.0.3_x64_setup.exe
File opened for modification	C:\Program Files\qBittorrent\qbittorrent.exe	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_bg.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_fi.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_he.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ko.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_sk.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_uk.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qt_pt_PT.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_it.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_zh_TW.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\uninst.exe	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_fr.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_lv.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_pt_BR.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\qbittorrent.pdb	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qt_gl.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qt_sl.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ca.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_da.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_es.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_nl.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qt_sv.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_cs.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_gd.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_tr.qm	qbittorrent_5.0.3_x64_setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qbittorrent_5.0.3_x64_setup.exe

Checks processor information in registry 2 TTPs 14 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 28 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.torrent\Content Type = "application/x-bittorrent"	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\shell\open\command	qbittorrent_5.0.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\shell\open\command\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\" \"%1\""	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent.Url.Magnet\DefaultIcon	qbittorrent_5.0.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet\DefaultIcon\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\",1"	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent.Url.Magnet\shell\open\command	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet\shell	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet\shell\open	qbittorrent_5.0.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet\shell\open\command\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\" \"%1\""	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.torrent	qbittorrent_5.0.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\ = "Torrent File"	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\shell\open	qbittorrent_5.0.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet\ = "Magnet URI"	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent.File.Torrent	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent.Url.Magnet	qbittorrent_5.0.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\DefaultIcon\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\",1"	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet\shell\open\command	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\magnet	qbittorrent_5.0.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\Content Type = "application/x-magnet"	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent.File.Torrent\DefaultIcon	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent.File.Torrent\shell\open\command	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\shell	qbittorrent_5.0.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\ = "URL:Magnet URI"	qbittorrent_5.0.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\URL Protocol	qbittorrent_5.0.3_x64_setup.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\[FreeTP.Org]GoreBox_v1.15.1.6_by_Pioneer.torrent:Zone.Identifier	firefox.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
2104	qbittorrent.exe
5388	qbittorrent.exe
2540	qbittorrent.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2976	qbittorrent_5.0.3_x64_setup.exe
2976	qbittorrent_5.0.3_x64_setup.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2104	qbittorrent.exe
2540	qbittorrent.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3424	firefox.exe
Token: SeDebugPrivilege	3424	firefox.exe
Token: 33	5376	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5376	AUDIODG.EXE
Token: SeDebugPrivilege	3424	firefox.exe
Token: SeManageVolumePrivilege	2104	qbittorrent.exe
Token: SeManageVolumePrivilege	2540	qbittorrent.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
2104	qbittorrent.exe
2104	qbittorrent.exe
2104	qbittorrent.exe
2104	qbittorrent.exe
2104	qbittorrent.exe
2104	qbittorrent.exe
2104	qbittorrent.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
2540	qbittorrent.exe
2540	qbittorrent.exe
2540	qbittorrent.exe
2540	qbittorrent.exe
2540	qbittorrent.exe
2540	qbittorrent.exe
2540	qbittorrent.exe
2540	qbittorrent.exe
2540	qbittorrent.exe

Suspicious use of SendNotifyMessage 46 IoCs

pid	Process
2104	qbittorrent.exe
2104	qbittorrent.exe
2104	qbittorrent.exe
2104	qbittorrent.exe
2104	qbittorrent.exe
2104	qbittorrent.exe
2104	qbittorrent.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
2540	qbittorrent.exe
2540	qbittorrent.exe
2540	qbittorrent.exe
2540	qbittorrent.exe
2540	qbittorrent.exe
2540	qbittorrent.exe
2540	qbittorrent.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3424	firefox.exe
3268	OpenWith.exe
3268	OpenWith.exe
3268	OpenWith.exe
3268	OpenWith.exe
3268	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2104	2976	qbittorrent_5.0.3_x64_setup.exe	91
PID 2976 wrote to memory of 2104	2976	qbittorrent_5.0.3_x64_setup.exe	91
PID 3656 wrote to memory of 3424	3656	firefox.exe	95
PID 3656 wrote to memory of 3424	3656	firefox.exe	95
PID 3656 wrote to memory of 3424	3656	firefox.exe	95
PID 3656 wrote to memory of 3424	3656	firefox.exe	95
PID 3656 wrote to memory of 3424	3656	firefox.exe	95
PID 3656 wrote to memory of 3424	3656	firefox.exe	95
PID 3656 wrote to memory of 3424	3656	firefox.exe	95
PID 3656 wrote to memory of 3424	3656	firefox.exe	95
PID 3656 wrote to memory of 3424	3656	firefox.exe	95
PID 3656 wrote to memory of 3424	3656	firefox.exe	95
PID 3656 wrote to memory of 3424	3656	firefox.exe	95
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 3176	3424	firefox.exe	96
PID 3424 wrote to memory of 4872	3424	firefox.exe	97
PID 3424 wrote to memory of 4872	3424	firefox.exe	97
PID 3424 wrote to memory of 4872	3424	firefox.exe	97
PID 3424 wrote to memory of 4872	3424	firefox.exe	97
PID 3424 wrote to memory of 4872	3424	firefox.exe	97
PID 3424 wrote to memory of 4872	3424	firefox.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\qbittorrent_5.0.3_x64_setup.exe
"C:\Users\Admin\AppData\Local\Temp\qbittorrent_5.0.3_x64_setup.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Program Files\qBittorrent\qbittorrent.exe
  "C:\Program Files\qBittorrent\qbittorrent.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2104

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1972 -parentBuildID 20240401114208 -prefsHandle 1900 -prefMapHandle 1892 -prefsLen 23839 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6b7d4017-7d74-4df2-bde6-c96d435da649} 3424 "\\.\pipe\gecko-crash-server-pipe.3424" gpu
    3⤵
    PID:3176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2380 -parentBuildID 20240401114208 -prefsHandle 2372 -prefMapHandle 2360 -prefsLen 23717 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {881a7dca-0a95-4fa0-a1c0-f66bba294cbe} 3424 "\\.\pipe\gecko-crash-server-pipe.3424" socket
    3⤵
    - Checks processor information in registry
    PID:4872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2948 -childID 1 -isForBrowser -prefsHandle 2952 -prefMapHandle 2936 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 920 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e36d2fb-bc77-4277-8f39-2b02a35be8e8} 3424 "\\.\pipe\gecko-crash-server-pipe.3424" tab
    3⤵
    PID:4520
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3284 -childID 2 -isForBrowser -prefsHandle 3460 -prefMapHandle 3264 -prefsLen 29091 -prefMapSize 244658 -jsInitHandle 920 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2334d14b-47ee-4cf3-af5c-6a21889c6391} 3424 "\\.\pipe\gecko-crash-server-pipe.3424" tab
    3⤵
    PID:2632
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4924 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4916 -prefMapHandle 4912 -prefsLen 29091 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c3bc06a4-fed7-4cfb-94fd-d4c56c8fa4d4} 3424 "\\.\pipe\gecko-crash-server-pipe.3424" utility
    3⤵
    - Checks processor information in registry
    PID:5468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5372 -childID 3 -isForBrowser -prefsHandle 5356 -prefMapHandle 2604 -prefsLen 26998 -prefMapSize 244658 -jsInitHandle 920 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8e92feb6-5e24-4461-bedb-282ccd9ec9b5} 3424 "\\.\pipe\gecko-crash-server-pipe.3424" tab
    3⤵
    PID:5912
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5360 -childID 4 -isForBrowser -prefsHandle 5596 -prefMapHandle 5592 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 920 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1da870d2-223b-4c57-8c47-cd2e440e3fcd} 3424 "\\.\pipe\gecko-crash-server-pipe.3424" tab
    3⤵
    PID:5948
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5356 -childID 5 -isForBrowser -prefsHandle 5360 -prefMapHandle 5612 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 920 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {74de546f-775d-4b06-9ca6-a244a1e2d477} 3424 "\\.\pipe\gecko-crash-server-pipe.3424" tab
    3⤵
    PID:5972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6164 -childID 6 -isForBrowser -prefsHandle 6156 -prefMapHandle 6128 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 920 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {51ac86f4-d7fd-4edf-afe4-f981bb6b3df9} 3424 "\\.\pipe\gecko-crash-server-pipe.3424" tab
    3⤵
    PID:5260
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6112 -childID 7 -isForBrowser -prefsHandle 4432 -prefMapHandle 2580 -prefsLen 28134 -prefMapSize 244658 -jsInitHandle 920 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6dfbdef7-264c-4c5c-b627-ae2a1a0a6d81} 3424 "\\.\pipe\gecko-crash-server-pipe.3424" tab
    3⤵
    PID:4400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6772 -childID 8 -isForBrowser -prefsHandle 6784 -prefMapHandle 6808 -prefsLen 28176 -prefMapSize 244658 -jsInitHandle 920 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e8c41c65-5b3a-4917-a667-d2bdaa9b35ff} 3424 "\\.\pipe\gecko-crash-server-pipe.3424" tab
    3⤵
    PID:5724
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6880 -childID 9 -isForBrowser -prefsHandle 6888 -prefMapHandle 6612 -prefsLen 28176 -prefMapSize 244658 -jsInitHandle 920 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {805ec015-b90c-423d-862d-ede212265fbb} 3424 "\\.\pipe\gecko-crash-server-pipe.3424" tab
    3⤵
    PID:5736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7080 -childID 10 -isForBrowser -prefsHandle 7156 -prefMapHandle 7152 -prefsLen 28176 -prefMapSize 244658 -jsInitHandle 920 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3906444-892a-41f8-8b92-3f9e3d7bc694} 3424 "\\.\pipe\gecko-crash-server-pipe.3424" tab
    3⤵
    PID:5708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7156 -parentBuildID 20240401114208 -prefsHandle 6936 -prefMapHandle 6940 -prefsLen 34566 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d4be9f7-7460-42b7-acb9-b9aee3044f9f} 3424 "\\.\pipe\gecko-crash-server-pipe.3424" rdd
    3⤵
    PID:1268
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6936 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 6904 -prefMapHandle 7128 -prefsLen 34566 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {65b355d3-be0e-479b-959f-fc46b9b0c342} 3424 "\\.\pipe\gecko-crash-server-pipe.3424" utility
    3⤵
    - Checks processor information in registry
    PID:3864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6200 -childID 11 -isForBrowser -prefsHandle 6484 -prefMapHandle 6468 -prefsLen 28176 -prefMapSize 244658 -jsInitHandle 920 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c2d86189-1f97-4b2a-aa2f-3209f17c4ee4} 3424 "\\.\pipe\gecko-crash-server-pipe.3424" tab
    3⤵
    PID:5384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7916 -childID 12 -isForBrowser -prefsHandle 7908 -prefMapHandle 7852 -prefsLen 28176 -prefMapSize 244658 -jsInitHandle 920 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8d87dd52-d4fb-4704-bd54-3b55708e9002} 3424 "\\.\pipe\gecko-crash-server-pipe.3424" tab
    3⤵
    PID:3120

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2b4 0x248
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5376

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3268
- C:\Program Files\qBittorrent\qbittorrent.exe
  "C:\Program Files\qBittorrent\qbittorrent.exe" "C:\Users\Admin\Downloads\[FreeTP.Org]GoreBox_v1.15.1.6_by_Pioneer.torrent"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  PID:5388

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\e2ac46424ff34b5192972023b1ce971f /t 4372 /p 2104
1⤵
PID:1488

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4008

C:\Program Files\qBittorrent\qbittorrent.exe
"C:\Program Files\qBittorrent\qbittorrent.exe" "C:\Users\Admin\Downloads\[FreeTP.Org]GoreBox_v1.15.1.6_by_Pioneer.torrent"
1⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\qBittorrent\qbittorrent.exe

Filesize
35.0MB

MD5
7a47d50bdb7a84a1fa58653f55eb2697

SHA1
fd767a6225bfdcca0537043b8f647d6ce33f7d1c

SHA256
6864e1a85198efb8ecf5f26564f7565d4d4e93f1ba7e4359bc05910ad74e83f0

SHA512
8c292a2a0bd6be2dac30e0f2cefe9bfd73aaff96e0cbb1301bba283fa8eabf378bbbc2c45667ec0cb0092e92d54bc02f054fb74b51eaa9068839225c3915d753

Download Submit
C:\Program Files\qBittorrent\qt.conf

Filesize
84B

MD5
af7f56a63958401da8bea1f5e419b2af

SHA1
f66ee8779ca6d570dea22fe34ef8600e5d3c5f38

SHA256
fdb8fa58a6ffc14771ca2b1ef6438061a6cba638594d76d9021b91e755d030d3

SHA512
02f70ca7f1291b25402989be74408eb82343ab500e15e4ac22fbc7162eb9230cd7061eaa7e34acf69962b57ed0827f51ceaf0fa63da3154b53469c7b7511d23d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kx4f0sbu.default-release\activity-stream.discovery_stream.json

Filesize
54KB

MD5
339d7f5dc05b799be29199229e31384c

SHA1
331f452d9cf5d5e11576386dcefd29d2a05b6141

SHA256
795b5f6908885b30fadb8834920d2d4d301e22e1843c736594148252ae21094f

SHA512
8416fbd624666a8c6648506b53a4651f6269a1704cc49a78970f9d466adcbbeb893dc419e10834e99fa1560954f4b4f7b0c7031b1e4c91f8a1cb551fbeeb1b37

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kx4f0sbu.default-release\cache2\doomed\30733

Filesize
2KB

MD5
b8a31574ea8801b5cab559adc7bf8540

SHA1
472bc26e6cccd1cfbe22df5d31b70dbf45d0ccc4

SHA256
642c756724d40301df1d1d8481e7d5df6e3314248fbf1666b4ea84cf6097d0f0

SHA512
93f998098e2282849f3972cd4c1406c4dd8fd85f2c2f30c26d95414fdf6c45aa792625eb60e0846e2e32762cc3cb82157097f0e90c597e06c28c3cb17828c44e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy5D54.tmp\FindProcDLL.dll

Filesize
3KB

MD5
b4faf654de4284a89eaf7d073e4e1e63

SHA1
8efcfd1ca648e942cbffd27af429784b7fcf514b

SHA256
c0948b2ec36a69f82c08935fac4b212238b6792694f009b93b4bdb478c4f26e3

SHA512
eef31e332be859cf2a64c928bf3b96442f36fe51f1a372c5628264a0d4b2fc7b3e670323c8fb5ffa72db995b8924da2555198e7de7b4f549d9e0f9e6dbb6b388

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy5D54.tmp\LangDLL.dll

Filesize
5KB

MD5
50016010fb0d8db2bc4cd258ceb43be5

SHA1
44ba95ee12e69da72478cf358c93533a9c7a01dc

SHA256
32230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e

SHA512
ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy5D54.tmp\System.dll

Filesize
12KB

MD5
4add245d4ba34b04f213409bfe504c07

SHA1
ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

SHA256
9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

SHA512
1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy5D54.tmp\UAC.dll

Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy5D54.tmp\modern-wizard.bmp

Filesize
25KB

MD5
cbe40fd2b1ec96daedc65da172d90022

SHA1
366c216220aa4329dff6c485fd0e9b0f4f0a7944

SHA256
3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2

SHA512
62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy5D54.tmp\nsDialogs.dll

Filesize
9KB

MD5
1d8f01a83ddd259bc339902c1d33c8f1

SHA1
9f7806af462c94c39e2ec6cc9c7ad05c44eba04e

SHA256
4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed

SHA512
28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy5D54.tmp\nsisFirewallW.dll

Filesize
8KB

MD5
f5bf81a102de52a4add21b8a367e54e0

SHA1
cf1e76ffe4a3ecd4dad453112afd33624f16751c

SHA256
53be5716ad80945cb99681d5dbda60492f5dfb206fbfdb776b769b3eeb18d2c2

SHA512
6e280a75f706474ad31b2ce770fa34f54cb598528fac4477c466200a608b79c0f9b84011545595d9ba94331ad08e2f51bd42de91f92379db27686a28ba351256

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Local\qBittorrent\GeoDB\dbip-country-lite.mmdb

Filesize
7.1MB

MD5
7f4cd930e541f29ac8e120aa8a43ee0b

SHA1
df85c812cad8512147c4f029634a36980b35ce6c

SHA256
d87b275016e23e2f913971b73c007cbfe5a1bde255a9c60cbdb16f622d8be850

SHA512
bc209113113c7092e9d5bc2d64e04a4f15b3343b6ae7a6c7172bfc670823c92c3f6ebaa0c132b7d785c29424170ad4e8328a635b0c8542e7d4912e702c0cdde9

Download Submit
C:\Users\Admin\AppData\Local\qBittorrent\logs\qbittorrent.log

Filesize
1KB

MD5
5dfc53a136576a768c21052696a41a6b

SHA1
b32e687bb159cb74041b8870831b405242ba6365

SHA256
3e932e02ec7713ff0cfbdfc41fd59ac666141499dd2669fa83fd33cbefbdd400

SHA512
9d23949553038e827552475807b61d82581eac44c8d2bb5194455d1ea344144af3a342c512b0219d7b11af06613061992e5dd5896194d4e01ab107366f7e209b

Download Submit
C:\Users\Admin\AppData\Local\qBittorrent\logs\qbittorrent.log

Filesize
2KB

MD5
f19a27d0c54ee89dfb1edb488161801c

SHA1
2fadda6c485cdae4e6635a66bf934c05c1bb7f11

SHA256
c8c1b53127d7770419c1cbc9cfd7188cbd09896a54443151ab29c921b2335fa1

SHA512
a7498fc8422d80f0891896ccb037f733eaa2e1683af7c8cd732efbda496bb896bf2e1b6f663d278593972181d0393799afc77f2ed06caba102468458863352b7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kx4f0sbu.default-release\AlternateServices.bin

Filesize
8KB

MD5
10bd6a577e90b63e81bac78470d6b4de

SHA1
a8b9b424a5d31f5304894a572eeeaa08a4c8a827

SHA256
3dc427e04a391768ac30143cffebef3870cda417abb5f5ae65d9d5ebc5baab92

SHA512
860c025fa0ffee57517598c8979b7c46c29b399df4345314a833b1b36c46225f174e8572c0c5d3dbe18921259f401b4a5bbca48d425176e300da17963df1d09c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kx4f0sbu.default-release\AlternateServices.bin

Filesize
15KB

MD5
08053538f7deb9f1f156ca2c28c443cc

SHA1
8ecc5edb3f865b69f7de1395f7c4e83602c120f5

SHA256
77e82afcadef5daabce63de60c372bebc4244f6a63ee75c1cd855da7e39b09ca

SHA512
3ad0b8ec52224acf3d10c2889677d2ef553076bf0ba45d78ef879fe62c0ec18b8f3c97fcf9be442f3b3961eac8b82a7ecb97e45a8a802bec6d2a3f779b2a1b38

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kx4f0sbu.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
b8f47e1f2e48da37ffe0bc5f306b52a1

SHA1
378a4054cfc9a1547e507297d21c28bb4c0a202a

SHA256
1c2898f9bbe9d39adc1518bb88caa22ed536b28c6f815eca6f00438e8c810d99

SHA512
c511c2556d0eb2b37437cd948f203d4cbce33967cd0469d0ab9fc9a7889d99fc447b0d1694fa551f5ebe98c80e307a993ee8f6cc9e6ffe2b20bfd413ccabe89e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kx4f0sbu.default-release\datareporting\glean\db\data.safe.tmp

Filesize
39KB

MD5
a8e213bd08d9ed212c9159f142d487b7

SHA1
58250f47960af0475c4416372ccfa5195c4e1d7b

SHA256
5d6df1ae714cd37b1ba3f7a2eaf7f2f4d7f99da7dae95551988cdd1665cba8eb

SHA512
4cffc3238dbf2307692f1d632d1c9d07d379970a625960f66370c9a00ebdae37b79a4994f1f0d1a8fc24e3f05789620fac08b79d570654dc8946cbd84927f0fb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kx4f0sbu.default-release\datareporting\glean\pending_pings\033fed22-38f3-490b-a136-4aee62ed2a3f

Filesize
25KB

MD5
95302aa218b20d853300ada720ca0b93

SHA1
c9369c188115bf59e437167869a0c913ead50506

SHA256
44c93a19fbf1457fe60c14e726c83f871378badb1c258dc7ee586891b62de350

SHA512
cb1e479900ec88a677ab0d26bc139254bcb9bdd99b5336bd0079af9158afd42b3a2019777fe78702681662a2f39eedc39ea2db0b23cf5521cfd5045b2a47807c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kx4f0sbu.default-release\datareporting\glean\pending_pings\54a1477c-ef0e-4e30-983e-057dc5ba314b

Filesize
671B

MD5
ad7ca819b5e8d8237b825d0b1fd8b8d9

SHA1
fbf505af7953261ebc83a733451487b2596594d8

SHA256
ab68b5774119290136c3be5517e5e68793381747368d78274af9d6b075159a81

SHA512
fba353b45277f841d0d85f46101bb631d179e418cb05d0d9fb975153a0118ecadbf3f5f392a0bf65c92a05260428c31b438ed8b1c6450a3bfbc072f86bd9095c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kx4f0sbu.default-release\datareporting\glean\pending_pings\8bc277a7-96aa-4406-afea-208921d1960c

Filesize
982B

MD5
da10216fbd46fff08ccbd72c079c66d5

SHA1
c3ddb62c2e4df4ed800bbfe2b9f4aed74f64ff97

SHA256
5e4db1ff9943fc799294096aa2cb71a59475a169c66329ccf60da2e5eff10300

SHA512
bc680e7c46f156391c3ebc6939e8967fdb13c2ad0c5bf63de20f0e0e965ad196b309fb57f6fd1cd4a3de1c636b301f76661e6ffa3280b6e34a1e36eb3c177a6e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kx4f0sbu.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kx4f0sbu.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kx4f0sbu.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kx4f0sbu.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kx4f0sbu.default-release\prefs-1.js

Filesize
11KB

MD5
e66bdd873cb47fc6fe23503f05b8555b

SHA1
867f7e146ca877d84764e830829280bb2f79f0d7

SHA256
3b8b87b9059317f457392cbb22cbce026f6621e7e70909444202509f4c45edf9

SHA512
2e2b2fa9eb9c57c6611028c92f8d2731263cbd97f1355dd26abe6bbca9e48079a1cf69ab4bfe94571fd13dbfed273396a083adeedf6bd92818c2cf57719d0c06

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kx4f0sbu.default-release\prefs-1.js

Filesize
10KB

MD5
85e2ab1ac2f16db7f50be94828d0d9d3

SHA1
bb9401adb3d8417314f2d422ff66ea34b1beb1bb

SHA256
7ce890899e661eb76922e3f5fa43752450adefaa2f106d2fc84a4de109d75f8a

SHA512
3cd01154fc4f5a605696f4f88b17bd6fb98c0aed8319334cdb40ad483449a6cbdc31f00e9a532f104f1d43821217226670acba98408d06caaa907f7ddb41bbd8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kx4f0sbu.default-release\prefs-1.js

Filesize
10KB

MD5
a890f0023d67a45b9b6b0e09a28b8bd5

SHA1
e6a192c39ad0af4f2e0c72406b9d02dbb91b1c8c

SHA256
2d1126c7cba04f88e4b1ac5698bc8f00ec3a87b8d4dffa4e9ff564ccc55be3b5

SHA512
a8e2d98714a129f0cc38d56fb61b3b12adb55fc8fb04e0e6fee159927899c8a83f192eb58ec6205340949c00f6eebc546f3c025d4ec075392c527c263e9d908e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kx4f0sbu.default-release\prefs.js

Filesize
10KB

MD5
c8058171b4ba28592bd7f994cf39ede9

SHA1
5c8f3191d93e4b0c570313bb4a758447240bf5ed

SHA256
ed591ff62fc205a9f494934bd9c4837910479ccae00a6db700016dd6d0dfe061

SHA512
0e66b91cec0ff4922b1642ea7a76c13646af6655a62dfaf94a8b827c71d777dc53afe533bc9fa62b5e7e53e364597e8860fa0b02ea909d1d7370b78e6fc39986

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kx4f0sbu.default-release\sessionCheckpoints.json.tmp

Filesize
259B

MD5
c8dc58eff0c029d381a67f5dca34a913

SHA1
3576807e793473bcbd3cf7d664b83948e3ec8f2d

SHA256
4c22e8a42797f14510228f9f4de8eea45c526228a869837bd43c0540092e5f17

SHA512
b8f7c4150326f617b63d6bc72953160804a3749f6dec0492779f6c72b3b09c8d1bd58f47d499205c9a0e716f55fe5f1503d7676a4c85d31d1c1e456898af77b4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kx4f0sbu.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
e6fac487ea120bbc09a736fdcd0db868

SHA1
433b69ed01833470e1131b5ccc2ed4524dc4abdb

SHA256
8cb6fcb67a587873de581283851ce45788da605751dd2f605c321126f64809a2

SHA512
fb90d4b0f2bd44ce145c993832b692a750129f45a24409b9bece632a747435fadb2b5750ebbf51ac720227fe926872f631f1b6541ed4a9e97359141dbdf4e9ad

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kx4f0sbu.default-release\sessionstore-backups\recovery.baklz4

Filesize
18KB

MD5
86e92bd3d53c75359de1a65c92982849

SHA1
d82c336d24deff655eda1474350a668c5f4de714

SHA256
293b59d8f430613bccbac7c94d9b681bea0b331741c6be084654bfc2a156288c

SHA512
42dafbcfb728ff3a67dfd6d8c96a01477e9ccc9e50847293075c15db39bdd3f7e7eac965451fbbe0beb366aac33de0524974c928c2312d919727bedac4527e80

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kx4f0sbu.default-release\sessionstore-backups\recovery.baklz4

Filesize
36KB

MD5
9857ed6a65be2fbefbf715f7eaf94ab9

SHA1
edeb079432258a354b04fc0208145f40c5b3bb81

SHA256
53face4c34087237d525529f076277686882998d3b74ecd9ff2bc7ac1e8380c0

SHA512
ac2efae1b28151df37792bb01fd2a5d751e9e76531a1f037d5f3ad7ee988ab317c933473622bb73f1b5e6b15b932632de637b3dee2e25199a2ae881fc2feeea8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kx4f0sbu.default-release\sessionstore-backups\recovery.baklz4

Filesize
17KB

MD5
ef997dc765fe359ecd04fa5b909757cc

SHA1
3cd78d1f8b6fea748b76e809a4edc95101cfb9b7

SHA256
e916514606b9108fdc4439e2592417288b24c13c3d60c6f1f1a36db3ad5b6672

SHA512
07794cdab9f1b0c618d4191cf3a2ad3919823bc758b93df94ebd90c666ee64e8b17f2f2153dcc42b8aa814620936b672e17006e7a7b88f71acfa7f98745d7110

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kx4f0sbu.default-release\sessionstore-backups\recovery.baklz4

Filesize
34KB

MD5
20b2c48650f6b0c8687e65f9880fd576

SHA1
1946a58ca70d1fe84351c75c1b097605a9e6a35d

SHA256
0032714f0e952562344f2157350d980e251327ee20e80b859e6abbcba126e47a

SHA512
637afbe34c100ba5effd60e985026e2e63ffcd16f818e31c11915ca6f2ad338c4399d17c5434ee9fde22a69c3f34f861649939b600143c4112109a015ea7f135

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kx4f0sbu.default-release\storage\default\https+++www.youtube.com^partitionKey=%28https%2Cfreetp.org%29\idb\2171031483YattIedMb.sqlite

Filesize
48KB

MD5
67bf0bf452115be365eb34ffe7d43ed9

SHA1
1fffb99bf76dfc5ba4c5c044214f069f9702d27f

SHA256
563e57942c9294ef3110f6f9fc47aa33e584c7b5010869202be63e547fe5b947

SHA512
c2ad29095803418e3287c5237b0f65768250cccd6b1854afa828a2de51c8f762fc134ee1cfdbb76be7bcda6eb647ab3e45ef3adc7b19ead291421d53f5337d5c

Download Submit
C:\Users\Admin\AppData\Roaming\qBittorrent\categories.json

Filesize
4B

MD5
5b76b0eef9af8a2300673e0553f609f9

SHA1
0b56d40c0630a74abec5398e01c6cd83263feddc

SHA256
d914176fd50bd7f565700006a31aa97b79d3ad17cee20c8e5ff2061d5cb74817

SHA512
cf06a50de1bf63b7052c19ad53766fa0d99a4d88db76a7cbc672e33276e3d423e4c5f5cb4a8ae188c5c0e17d93bb740eaab6f25753f0d26501c5f84aeded075d

Download Submit
C:\Users\Admin\AppData\Roaming\qBittorrent\qBittorrent.ini

Filesize
1KB

MD5
62de7096e229091072e54041796e2e6d

SHA1
afb89074cf391fe74494dc4d10c66baecf7c9875

SHA256
891df0e4eaeecb0cdd813d86f7ac8a9d9dcbd52af48f98e2f2aade752e61b49b

SHA512
c1e99db1df797e1be81a198e343692c41eec2c6faba8d4edd5393c52dd2a2a6557a79f76b61ba59a747bee9f13830cfd47b42a7d00cd972388bf9c582b65a4e5

Download Submit
C:\Users\Admin\Downloads\FoTpcDMO.torrent.part

Filesize
12KB

MD5
6319dd9a957b4fb6c7890e7fa1d0eedb

SHA1
ed7861e9a504426d60dfb4d68b8aec35660daad9

SHA256
523f8b4ba2a29f16215acb30bdc477d3d5c3b8a6c4954ac2d1b65544df0c5686

SHA512
b1ea647b77a3fa391499d44fd24548386768f2dbd53a57f1171bc05906443bad1fc16cb6632837ca187b4f06b56c1275ccb4e72f42fa9156251d292e0972b368

Download Submit