878ca7e3fb7a90a937afdbe080c055877b4c6334a9589d27e092fd6737a0716f

Analysis

max time kernel
380s
max time network
385s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
26-12-2024 17:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

qbittorrent_5.0.3_x64_setup.exe
Size

37.5MB
MD5

83505c82e83bd2e61bd67dfcf30724cf
SHA1

5fbde5f904a7c0e1346b9bcef4a66a7a7dd7e5b9
SHA256

878ca7e3fb7a90a937afdbe080c055877b4c6334a9589d27e092fd6737a0716f
SHA512

87ead0cac1dd041f7929e68bfdf8b61ac50c9d05a74344ab951f9c624874452e22a30f678a6a059cc3e8906f92189c39cfe7bba6552681140d610edb1b529833
SSDEEP

786432:7nvRa6b9c7DLVZhxGjtYO9NByxgyXXbFTUgCe4Oa0eMe6NwRI/gWfe+C:7paO9c7VZejf3OBbFTU3U+6NxIV+C

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 9 IoCs

pid	Process
5600	qbittorrent.exe
3696	Ages_of_Conflict_World_War_Simulator_v3.1.1_setup.exe
5576	Ages_of_Conflict_World_War_Simulator_v3.1.1_setup.tmp
2636	Ages of Conflict.exe
5556	UnityCrashHandler64.exe
5188	UnityCrashHandler64.exe
3568	Ages of Conflict.exe
1408	UnityCrashHandler64.exe
1436	UnityCrashHandler64.exe

Loads dropped DLL 20 IoCs

pid	Process
3984	qbittorrent_5.0.3_x64_setup.exe
3984	qbittorrent_5.0.3_x64_setup.exe
3984	qbittorrent_5.0.3_x64_setup.exe
3984	qbittorrent_5.0.3_x64_setup.exe
3984	qbittorrent_5.0.3_x64_setup.exe
3984	qbittorrent_5.0.3_x64_setup.exe
3984	qbittorrent_5.0.3_x64_setup.exe
5576	Ages_of_Conflict_World_War_Simulator_v3.1.1_setup.tmp
5576	Ages_of_Conflict_World_War_Simulator_v3.1.1_setup.tmp
5576	Ages_of_Conflict_World_War_Simulator_v3.1.1_setup.tmp
2636	Ages of Conflict.exe
2636	Ages of Conflict.exe
2636	Ages of Conflict.exe
2636	Ages of Conflict.exe
5556	UnityCrashHandler64.exe
3568	Ages of Conflict.exe
3568	Ages of Conflict.exe
3568	Ages of Conflict.exe
3568	Ages of Conflict.exe
1408	UnityCrashHandler64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\audioses.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\gpapi.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\ntdll.pdb	Ages of Conflict.exe
File opened for modification	C:\Windows\system32\symbols\dll\fastprox.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\imm32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\ntdll.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\sechost.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\ole32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\devobj.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\DXCore.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\propsys.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\mono-2.0-bdwgc.pdb	Ages of Conflict.exe
File opened for modification	C:\Windows\system32\symbols\dll\msvcp_win.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\XInput9_1_0.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\mono-2.0-bdwgc.pdb	Ages of Conflict.exe
File opened for modification	C:\Windows\system32\user32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\shcore.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\d3d10warp.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\WindowsPlayer_player_Master_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\shcore.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\iphlpapi.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\XInput9_1_0.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\msvcp_win.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\UxTheme.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\WinTypes.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dhcpcsvc6.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\sspicli.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\dxgi.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\msasn1.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\DLL\cryptbase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\msvcrt.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\steam_api64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\winmm.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dxgi.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\shlwapi.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\rsaenh.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\sspicli.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\Amsi.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\glu32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\ole32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\opengl32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\advapi32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\crypt32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\mono-2.0-bdwgc.pdb	Ages of Conflict.exe
File opened for modification	C:\Windows\system32\dll\gdi32full.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\rpcrt4.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\dwmapi.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\WinTypes.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\dcomp.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\ResourcePolicyClient.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\DLL\hid.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\ResourcePolicyClient.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\propsys.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dcomp.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\Windows.Storage.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\d3d10warp.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\exe\WindowsPlayer_player_Master_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\wbemprox.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\MMDevAPI.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\WLDP.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\winhttp.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\bcryptprimitives.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\Amsi.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\win32u.pdb	UnityCrashHandler64.exe

Drops file in Program Files directory 39 IoCs

description	ioc	Process
File created	C:\Program Files\qBittorrent\translations\qtbase_ka.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_pl.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ru.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\qt.conf	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ja.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_uk.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_cs.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_lv.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_zh_TW.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\uninst.exe	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\qbittorrent.pdb	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qt_sv.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ca.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_es.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_fr.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_nn.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\qbittorrent.exe	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ar.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_bg.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_it.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qt_pt_PT.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_fa.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_fi.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_he.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_hu.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_tr.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_zh_CN.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qt_sl.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_da.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_de.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_nl.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_pt_BR.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qt_lt.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_hr.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ko.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_sk.qm	qbittorrent_5.0.3_x64_setup.exe
File opened for modification	C:\Program Files\qBittorrent\qbittorrent.exe	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qt_gl.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_gd.qm	qbittorrent_5.0.3_x64_setup.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\gdi32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\ws2_32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\glu32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\steam_api64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\shcore.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\propsys.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\bcrypt.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\fwpuclnt.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\kernelbase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\shlwapi.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\WrpYGF74DrEm.ini	Ages_of_Conflict_World_War_Simulator_v3.1.1_setup.tmp
File opened for modification	C:\Windows\symbols\exe\WindowsPlayer_player_Master_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\MpOAV.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\msasn1.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\steam_api64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\nsi.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\MMDevAPI.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\mono-2.0-bdwgc.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dcomp.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\dnsapi.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\ucrtbase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dnsapi.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\wbemcomn.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\mono-2.0-bdwgc.pdb	Ages of Conflict.exe
File opened for modification	C:\Windows\shlwapi.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\DLL\cryptbase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\ole32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\bcryptprimitives.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\kernelbase.pdb	Ages of Conflict.exe
File opened for modification	C:\Windows\dll\MpOAV.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\propsys.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\TextInputFramework.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\cfgmgr32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\rpcrt4.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\opengl32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\profapi.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\MpOAV.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\wintrust.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\d3d10warp.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\powrprof.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\dnsapi.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\winmm.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\WLDP.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\dwmapi.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\d3d11.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\wbemprox.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\ntdll.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\mono-2.0-bdwgc.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\propsys.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\wbemsvc.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\DLL\audioses.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\msasn1.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\msctf.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\DLL\cryptbase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\rpcrt4.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\version.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\wintrust.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\setupapi.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\d3d10warp.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\glu32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\discord_game_sdk.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\crypt32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\sechost.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\UMPDC.pdb	UnityCrashHandler64.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Ages_of_Conflict_World_War_Simulator_v3.1.1\Ages_of_Conflict_World_War_Simulator_v3.1.1_setup.exe:Zone.Identifier	qbittorrent.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ages_of_Conflict_World_War_Simulator_v3.1.1_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ages_of_Conflict_World_War_Simulator_v3.1.1_setup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qbittorrent_5.0.3_x64_setup.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Ages of Conflict.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Ages of Conflict.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Ages of Conflict.exe
Key opened	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Ages of Conflict.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Ages of Conflict.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Ages of Conflict.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Ages of Conflict.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Ages of Conflict.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\.torrent	qbittorrent_5.0.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\ = "URL:Magnet URI"	qbittorrent_5.0.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\URL Protocol	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings	qbittorrent.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent.File.Torrent	qbittorrent_5.0.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\ = "Torrent File"	qbittorrent_5.0.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\shell\open\command\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\" \"%1\""	qbittorrent_5.0.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet\DefaultIcon\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\",1"	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\magnet	qbittorrent_5.0.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\Content Type = "application/x-magnet"	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent.File.Torrent\DefaultIcon	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\shell\open	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent.Url.Magnet	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent.Url.Magnet\DefaultIcon	qbittorrent_5.0.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.torrent\Content Type = "application/x-bittorrent"	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent.Url.Magnet\shell\open\command	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\shell	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet\shell\open	qbittorrent_5.0.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\DefaultIcon\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\",1"	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent.File.Torrent\shell\open\command	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\shell\open\command	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet\shell\open\command	qbittorrent_5.0.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet\ = "Magnet URI"	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet\shell	qbittorrent_5.0.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet\shell\open\command\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\" \"%1\""	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Ages_of_Conflict_World_War_Simulator_v3.1.1.torrent:Zone.Identifier	firefox.exe
File opened for modification	C:\Users\Admin\Downloads\Ages_of_Conflict_World_War_Simulator_v3.1.1\Ages_of_Conflict_World_War_Simulator_v3.1.1_setup.exe:Zone.Identifier	qbittorrent.exe

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	850	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	860	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	862	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5600	qbittorrent.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3984	qbittorrent_5.0.3_x64_setup.exe
3984	qbittorrent_5.0.3_x64_setup.exe
5576	Ages_of_Conflict_World_War_Simulator_v3.1.1_setup.tmp
5576	Ages_of_Conflict_World_War_Simulator_v3.1.1_setup.tmp
2636	Ages of Conflict.exe
2636	Ages of Conflict.exe
5556	UnityCrashHandler64.exe
5556	UnityCrashHandler64.exe
5556	UnityCrashHandler64.exe
5556	UnityCrashHandler64.exe
3568	Ages of Conflict.exe
3568	Ages of Conflict.exe
1408	UnityCrashHandler64.exe
1408	UnityCrashHandler64.exe
1408	UnityCrashHandler64.exe
1408	UnityCrashHandler64.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5600	qbittorrent.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	4456	firefox.exe
Token: SeDebugPrivilege	4456	firefox.exe
Token: SeDebugPrivilege	4456	firefox.exe
Token: SeDebugPrivilege	4456	firefox.exe
Token: SeDebugPrivilege	4456	firefox.exe
Token: SeDebugPrivilege	4456	firefox.exe
Token: SeManageVolumePrivilege	5600	qbittorrent.exe
Token: 33	4544	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4544	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
5600	qbittorrent.exe
5600	qbittorrent.exe
5600	qbittorrent.exe
5600	qbittorrent.exe
5600	qbittorrent.exe
5600	qbittorrent.exe
5600	qbittorrent.exe
5600	qbittorrent.exe
5600	qbittorrent.exe
5600	qbittorrent.exe
5600	qbittorrent.exe
5600	qbittorrent.exe
5600	qbittorrent.exe
5600	qbittorrent.exe
5600	qbittorrent.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
5600	qbittorrent.exe
5600	qbittorrent.exe
5600	qbittorrent.exe
5600	qbittorrent.exe
5600	qbittorrent.exe
5600	qbittorrent.exe
5600	qbittorrent.exe
5600	qbittorrent.exe
5600	qbittorrent.exe
5600	qbittorrent.exe
5600	qbittorrent.exe
5600	qbittorrent.exe
5600	qbittorrent.exe
5600	qbittorrent.exe
5600	qbittorrent.exe
5600	qbittorrent.exe

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
4456	firefox.exe
5652	OpenWith.exe
5652	OpenWith.exe
5652	OpenWith.exe
5652	OpenWith.exe
5652	OpenWith.exe
5652	OpenWith.exe
5652	OpenWith.exe
2636	Ages of Conflict.exe
3568	Ages of Conflict.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 4456	4812	firefox.exe	85
PID 4812 wrote to memory of 4456	4812	firefox.exe	85
PID 4812 wrote to memory of 4456	4812	firefox.exe	85
PID 4812 wrote to memory of 4456	4812	firefox.exe	85
PID 4812 wrote to memory of 4456	4812	firefox.exe	85
PID 4812 wrote to memory of 4456	4812	firefox.exe	85
PID 4812 wrote to memory of 4456	4812	firefox.exe	85
PID 4812 wrote to memory of 4456	4812	firefox.exe	85
PID 4812 wrote to memory of 4456	4812	firefox.exe	85
PID 4812 wrote to memory of 4456	4812	firefox.exe	85
PID 4812 wrote to memory of 4456	4812	firefox.exe	85
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 2124	4456	firefox.exe	86
PID 4456 wrote to memory of 4296	4456	firefox.exe	87
PID 4456 wrote to memory of 4296	4456	firefox.exe	87
PID 4456 wrote to memory of 4296	4456	firefox.exe	87
PID 4456 wrote to memory of 4296	4456	firefox.exe	87
PID 4456 wrote to memory of 4296	4456	firefox.exe	87
PID 4456 wrote to memory of 4296	4456	firefox.exe	87
PID 4456 wrote to memory of 4296	4456	firefox.exe	87
PID 4456 wrote to memory of 4296	4456	firefox.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\qbittorrent_5.0.3_x64_setup.exe
"C:\Users\Admin\AppData\Local\Temp\qbittorrent_5.0.3_x64_setup.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3984

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1952 -parentBuildID 20240401114208 -prefsHandle 1868 -prefMapHandle 1860 -prefsLen 23681 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {be6fc25f-af87-4b5b-b81d-de70b75216ba} 4456 "\\.\pipe\gecko-crash-server-pipe.4456" gpu
    3⤵
    PID:2124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2344 -parentBuildID 20240401114208 -prefsHandle 2336 -prefMapHandle 2324 -prefsLen 23717 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d999b11-fe33-47aa-be3e-2cc5965c0403} 4456 "\\.\pipe\gecko-crash-server-pipe.4456" socket
    3⤵
    - Checks processor information in registry
    PID:4296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2968 -childID 1 -isForBrowser -prefsHandle 2996 -prefMapHandle 2852 -prefsLen 23858 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {355725a6-f141-4c7f-8a75-7a310ba3caee} 4456 "\\.\pipe\gecko-crash-server-pipe.4456" tab
    3⤵
    PID:1228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2876 -childID 2 -isForBrowser -prefsHandle 3812 -prefMapHandle 2992 -prefsLen 29091 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {47a3995b-9c03-496e-b2e4-c7e13cbc74e1} 4456 "\\.\pipe\gecko-crash-server-pipe.4456" tab
    3⤵
    PID:760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4244 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4232 -prefMapHandle 4300 -prefsLen 29091 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bc9b019e-01af-4999-9295-170452189862} 4456 "\\.\pipe\gecko-crash-server-pipe.4456" utility
    3⤵
    - Checks processor information in registry
    PID:4984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5300 -childID 3 -isForBrowser -prefsHandle 3728 -prefMapHandle 5456 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b3752f6-4bf2-44b2-805a-46f1d1d0661e} 4456 "\\.\pipe\gecko-crash-server-pipe.4456" tab
    3⤵
    PID:2040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5716 -childID 4 -isForBrowser -prefsHandle 5708 -prefMapHandle 5704 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {857c3909-999b-4b63-926b-4fd27fa76086} 4456 "\\.\pipe\gecko-crash-server-pipe.4456" tab
    3⤵
    PID:996
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5616 -childID 5 -isForBrowser -prefsHandle 5844 -prefMapHandle 5848 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {35ebcaa4-b2f0-4f7f-997a-5cda94756c54} 4456 "\\.\pipe\gecko-crash-server-pipe.4456" tab
    3⤵
    PID:3120
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4332 -childID 6 -isForBrowser -prefsHandle 4336 -prefMapHandle 4348 -prefsLen 27823 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {99f32333-786c-45fc-bd51-259b6682f05d} 4456 "\\.\pipe\gecko-crash-server-pipe.4456" tab
    3⤵
    PID:4548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6544 -childID 7 -isForBrowser -prefsHandle 5300 -prefMapHandle 6444 -prefsLen 28086 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {75a719cb-f244-42c5-b51b-cf0e99c93d4e} 4456 "\\.\pipe\gecko-crash-server-pipe.4456" tab
    3⤵
    PID:5464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6736 -childID 8 -isForBrowser -prefsHandle 6424 -prefMapHandle 6468 -prefsLen 28086 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {76156e03-1b4a-44a3-96a0-bc2ff12a03d2} 4456 "\\.\pipe\gecko-crash-server-pipe.4456" tab
    3⤵
    PID:3852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5748 -childID 9 -isForBrowser -prefsHandle 5772 -prefMapHandle 5784 -prefsLen 28086 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c198036-0cae-42f4-9d2f-afaa52814356} 4456 "\\.\pipe\gecko-crash-server-pipe.4456" tab
    3⤵
    PID:5732

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5092

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5652
- C:\Program Files\qBittorrent\qbittorrent.exe
  "C:\Program Files\qBittorrent\qbittorrent.exe" "C:\Users\Admin\Downloads\Ages_of_Conflict_World_War_Simulator_v3.1.1.torrent"
  2⤵
  - Executes dropped EXE
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:5600

C:\Users\Admin\Downloads\Ages_of_Conflict_World_War_Simulator_v3.1.1\Ages_of_Conflict_World_War_Simulator_v3.1.1_setup.exe
"C:\Users\Admin\Downloads\Ages_of_Conflict_World_War_Simulator_v3.1.1\Ages_of_Conflict_World_War_Simulator_v3.1.1_setup.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3696
- C:\Users\Admin\AppData\Local\Temp\is-4PPET.tmp\Ages_of_Conflict_World_War_Simulator_v3.1.1_setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-4PPET.tmp\Ages_of_Conflict_World_War_Simulator_v3.1.1_setup.tmp" /SL5="$1034E,107411231,1047040,C:\Users\Admin\Downloads\Ages_of_Conflict_World_War_Simulator_v3.1.1\Ages_of_Conflict_World_War_Simulator_v3.1.1_setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5576

C:\Games\Ages of Conflict World War Simulator v3.1.1\Ages of Conflict.exe
"C:\Games\Ages of Conflict World War Simulator v3.1.1\Ages of Conflict.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2636
- C:\Games\Ages of Conflict World War Simulator v3.1.1\UnityCrashHandler64.exe
  "C:\Games\Ages of Conflict World War Simulator v3.1.1\UnityCrashHandler64.exe" --attach 2636 1983913463808
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:5556
- - C:\Games\Ages of Conflict World War Simulator v3.1.1\UnityCrashHandler64.exe
    "C:\Games\Ages of Conflict World War Simulator v3.1.1\UnityCrashHandler64.exe" "2636" "1983913463808"
    3⤵
    - Executes dropped EXE
    PID:5188

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3c4 0x2ec
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4544

C:\Games\Ages of Conflict World War Simulator v3.1.1\Ages of Conflict.exe
"C:\Games\Ages of Conflict World War Simulator v3.1.1\Ages of Conflict.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3568
- C:\Games\Ages of Conflict World War Simulator v3.1.1\UnityCrashHandler64.exe
  "C:\Games\Ages of Conflict World War Simulator v3.1.1\UnityCrashHandler64.exe" --attach 3568 2100302843904
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1408
- - C:\Games\Ages of Conflict World War Simulator v3.1.1\UnityCrashHandler64.exe
    "C:\Games\Ages of Conflict World War Simulator v3.1.1\UnityCrashHandler64.exe" "3568" "2100302843904"
    3⤵
    - Executes dropped EXE
    PID:1436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Games\Ages of Conflict World War Simulator v3.1.1\Ages of Conflict.exe

Filesize
639KB

MD5
a0fbb5eaf8d59306caab48a71cbe1a7f

SHA1
e75c19c7968cc8d2a24bbafe1507413a7aa6140e

SHA256
da191a4f2c14d2ea8506618d437fb86fcf30e571aafbac31984edbdc063c05bd

SHA512
4637ff4de464d3326c09e418d8d4994693118cf71b42ec1d8776226c85bbccd1daf9fdd2dfb65ba88993be5fe7e2ac6a478d7e4025c9ea7c11d9264335fc771a

Download Submit
C:\Games\Ages of Conflict World War Simulator v3.1.1\Ages of Conflict_Data\Managed\UnityEngine.AIModule.dll

Filesize
10KB

MD5
5441a8bdbf7e7995429dbb3f08f91737

SHA1
9a469a372dcff9d204d9d1c18bb1f536a385bc5a

SHA256
2617ae89873fdbc881703895f6a51b4dd721572b9bba3d27d1e88887e6a27e4e

SHA512
6971b673552f26b0c84fcce82067f43dc2e47632ff59a5ead7fa3ae5c94003ea622f0ca945375ce59628e38846bd4b7d0bcb563dcc635f0c640b9552960d3734

Download Submit
C:\Games\Ages of Conflict World War Simulator v3.1.1\Ages of Conflict_Data\Managed\UnityEngine.AndroidJNIModule.dll

Filesize
38KB

MD5
807741e7a5f2d56212e063b8aa294878

SHA1
99ce108a4cd98fdb64cfc0d3b59de3c9bcff941b

SHA256
bb693b0948b0adfbf42d09b357f385bc6384b507ce35e3b9c1dc50633b2f39af

SHA512
c10c39bc6217ec5b5f4bd2300c5d7254e37eb7ef45262d85adaa88b5077d52da0b8294ad2b49ba37ea1af92824add2b70c02cb18f182abad9f309d989f11d179

Download Submit
C:\Games\Ages of Conflict World War Simulator v3.1.1\Ages of Conflict_Data\Managed\UnityEngine.AnimationModule.dll

Filesize
21KB

MD5
df19cc429cf6565868792468871c9b4b

SHA1
e30a2059e47c479017821017d99a27c5a0cb147e

SHA256
c725fb252751f2fb907c014b6d6549593be4e8e2cd2615c25de88bb8081f6645

SHA512
5df89b4be4c1a4efd3044df3c496d1e3433e9db127954e4618c637159459c15a35db0e80a5f0d687be80bdbff3f5fc12d2b504b144eceaad056efa937812da09

Download Submit
C:\Games\Ages of Conflict World War Simulator v3.1.1\Ages of Conflict_Data\Managed\UnityEngine.AssetBundleModule.dll

Filesize
9KB

MD5
048d9e9a4e21bd4c5b6f81b65b8030c6

SHA1
303c763cba8eb5101d4319fe07ffb5a7cfdcd8dd

SHA256
d25cb68e4a34337514b636d5fafd23c67aaa70e83de599c76150a374583e0a3d

SHA512
a2357ac9af877edd7911599b8dc641d9041163e28b07e756403033ac373c88aa803d2c399723a40d59fb19276c2f6d466e04be5399ca51fd64d47b5abd56bb71

Download Submit
C:\Games\Ages of Conflict World War Simulator v3.1.1\Ages of Conflict_Data\Managed\UnityEngine.AudioModule.dll

Filesize
14KB

MD5
861061deabc743db00994cc1b40a19d9

SHA1
5d4502b3c774c3cbd9765c84e7d52f8b430aab02

SHA256
5cdcafcf9a821f9a35f469d452fac58fdeebfbacf7703fec2be92eaecac4eba1

SHA512
b98298a38770e398433e7d110edd191ed29be1fd7132b33044d58d6430329e191438cf3a621e061356d1d436f570fa320db78148b5be384f29234b7fd9f895e7

Download Submit
C:\Games\Ages of Conflict World War Simulator v3.1.1\Ages of Conflict_Data\Managed\UnityEngine.CoreModule.dll

Filesize
498KB

MD5
1798076d0f2c2b28060e59b0d680b2e2

SHA1
adc718402b2885e619656ae355f4f345576c7f38

SHA256
31a8f16854c10731af24f196268ffcaafe77e827d002c87d31bbc6ebf9be53d1

SHA512
a64d039ab9babc5a93d9cdeaa8831d09c0e733f6512dd9cd6bc3bee54c6c81ab690c739871ed646fb83fea5bf9491b507763e7f4b5221f8716c94841b87031c6

Download Submit
C:\Games\Ages of Conflict World War Simulator v3.1.1\Ages of Conflict_Data\Managed\UnityEngine.DirectorModule.dll

Filesize
10KB

MD5
f67ede82b3adc2c64db5641cbbfefe6b

SHA1
959fdd00869a7bd11029fc330d30e61a7a57136a

SHA256
606b3c5ef33a0b64a65b8b8a2343ebb813406fab93505352f4b14831b0a55b7c

SHA512
88181d377a66be05165736c55048abf5b54fb90eed046f87c64e6c7babba7a4aa2d2115a149fa216f20d3ea50b454823d2cf9d69cec0051e12c086472d57e2f1

Download Submit
C:\Games\Ages of Conflict World War Simulator v3.1.1\Ages of Conflict_Data\Managed\UnityEngine.GridModule.dll

Filesize
9KB

MD5
177099624fbe5936a60adc6efe5a3a65

SHA1
7a9328183b79534dac3d9203f684db58286ada3c

SHA256
227c6504d2b17a4fdd53209a88ef5ea58470380fec4c2053d8e7d8ff86b02923

SHA512
9b50c9d77431702fd70e9684837dc7c7d3525667104fd2cfc3c697115041e5c061b9b3800273783d545a89172beee0a7adb0a3fdb5e1fb32e951d3ff7a98bdc9

Download Submit
C:\Games\Ages of Conflict World War Simulator v3.1.1\Ages of Conflict_Data\Managed\UnityEngine.IMGUIModule.dll

Filesize
85KB

MD5
4a996e877fe2fbe1e944a860d0480a2c

SHA1
67a9ecff7f00b60cc0ed39824f260c3bbda8c1e0

SHA256
2707bce3edc5507724acc4aaaf5d8f6d3b108b471f01e444dd379c07c8a9e3bb

SHA512
a229ffc0cf8a7429a8a84098e0c1278685776a47b78d66bab1d714382a6e45382b76347b4d1c2b12d889640e011b768c564b3329890cacf7c07b005a7002cbc9

Download Submit
C:\Games\Ages of Conflict World War Simulator v3.1.1\Ages of Conflict_Data\Managed\UnityEngine.ImageConversionModule.dll

Filesize
10KB

MD5
f15077f6ef3e0c9c22d9ac90220e6272

SHA1
6c3ea16140f5442bd96b684da9efb9a810c344e7

SHA256
252972890659bdcac22e02189147fe8106888c94aaf4bd1c38f6d9c20aecc41e

SHA512
860e573a8e90abfbe9e2d7a0e1902b93b87e5c0b6a3d0af35672a26373b1ad216faed60faef44e58f1b82d294b37210c82fe367b4f1ad13d24a5ae83455b4ba4

Download Submit
C:\Games\Ages of Conflict World War Simulator v3.1.1\Ages of Conflict_Data\Managed\UnityEngine.InputLegacyModule.dll

Filesize
16KB

MD5
27bda8712f0bbe2b117d5a4e9b53e83f

SHA1
f08b01bd83d90c57c09c597a19c2b3b1f007539d

SHA256
28c3fbd1e6fdc8165fdc26a806b45c80d98aa3025ec9ca6979753927eb1f2010

SHA512
98818dc2f66ae249d02541b08ced26eaf247ea4edefdcf7a80cca48584a39ff24076d93818421ec2baa78b89d45ac1b1b18387d692dd696c46625d4ada55e5e3

Download Submit
C:\Games\Ages of Conflict World War Simulator v3.1.1\Ages of Conflict_Data\Managed\UnityEngine.InputModule.dll

Filesize
12KB

MD5
a49f6067983fc7f6606af9344f9287d4

SHA1
db504de014cb8d0af4623403aab010f1e04b9550

SHA256
9b93c32582ab11fbbb98c9377b1cd63ae596b01593dfab0a0a6d05aac23a94f8

SHA512
a88d4d4cf9a9e008d8c1a59c724203412da3b9023c43a1fdda1f45de6bae059fcec504fb1988522f531951d0010cf045ae0d219f1f18668eb9fc0a11b707aed3

Download Submit
C:\Games\Ages of Conflict World War Simulator v3.1.1\Ages of Conflict_Data\Managed\UnityEngine.JSONSerializeModule.dll

Filesize
10KB

MD5
586e4b8cb4b7628f73245ab45544b317

SHA1
17a1dfc2a98c9f8b040041abaeef85d676d2fe40

SHA256
5ec7615eedd40fa92e1cd57c1bffee27b1e0f810a08c0121c781ead079668c7f

SHA512
272eb5a4839c385a50b0e61aea03a6a9371f66ebc5b1a92c9da0cb7ee3acb4456cada927c33068133cc9bfde33e6ad4199877c11042d5fbbf668affab7859fa9

Download Submit
C:\Games\Ages of Conflict World War Simulator v3.1.1\Ages of Conflict_Data\Managed\UnityEngine.ParticleSystemModule.dll

Filesize
15KB

MD5
45212bb2954db53279ea160f810ecd88

SHA1
d11798651f2efa3a059b4e74405781a0ca12a2b3

SHA256
50f583300b47ad237807dbe465331ee5dce5b248adc5613be0c0e9488aa89e56

SHA512
8bd02ea6f43149c1db1088fc8d61512a1515d8788a1c4fcdc16252976355a5b2baae1fbb298673dee7d065ffe955e474997b2500ab0cc1e6f965dd096ef7cf72

Download Submit
C:\Games\Ages of Conflict World War Simulator v3.1.1\Ages of Conflict_Data\Managed\UnityEngine.Physics2DModule.dll

Filesize
17KB

MD5
0c19b565750d9d4da47c28e174acb836

SHA1
9c6e1a7efedc3968de5cf9547f5b60afdc520924

SHA256
6f625b2945abb3917322471fa5ea79add1afff4f64a715fc85ad1be5af14c9b8

SHA512
449dd79517c6e35320a4c0714d3acc8d95a569c617b6b4f28c4f8600e035448eb2a1320a9883a3fc44282007cca14d4b7098169616f38962f2976d2f6abfa0ca

Download Submit
C:\Games\Ages of Conflict World War Simulator v3.1.1\Ages of Conflict_Data\Managed\UnityEngine.PhysicsModule.dll

Filesize
18KB

MD5
5a5334e4a774a68c962d3edf1dd70e83

SHA1
d2d6149888f09ca933ead67775fb183e1d5bc173

SHA256
b5b0a1937d61bcfc6d2d9c48bf6beb35b4bf4762d2974a4bdc4702bd04999d8f

SHA512
33f5e48bc8d082a3a98bb78787645c0934628a6cb45d34c7023f8c986a4908d7789d3fdbb1c5d72bcbf52ebb1a6226df09605230c0b81d8dec1c5949dd53e10a

Download Submit
C:\Games\Ages of Conflict World War Simulator v3.1.1\Ages of Conflict_Data\Managed\UnityEngine.SharedInternalsModule.dll

Filesize
16KB

MD5
f97b70007d8a91fa80ceb9a48c63da24

SHA1
abd64545a44e54b097f0c4d9baeb4f9511572791

SHA256
af7e8dca264b8d144500baf4bff4b7cbb7fbc743f32056ae81a4436e3ad21c82

SHA512
a8d685d50c7de73de44b1a050de98cf7b7c9087e685e2300211d37fb65ceceee28b26adeca59489aa119a27eed33320700715d8ae15ccf1c803318c4dc08da2e

Download Submit
C:\Games\Ages of Conflict World War Simulator v3.1.1\Ages of Conflict_Data\Managed\UnityEngine.SpriteShapeModule.dll

Filesize
9KB

MD5
a211787e00753770feaf2e5b44d9e5af

SHA1
fdb9399cf116c5c0c75ffec873f3d0bdf2552abb

SHA256
8bde890ff525bb7395d6817fba78a11a4fd81f43ad8d4c920712afce2d27c509

SHA512
95bc45d03f7c36fe052f2e487308e5e60d50fe2f78e4975c90ba195993096091c1c52a658d46a472837f2b3be831b1c1d826f2ac4085aa8cabcc3735ce2e0d8d

Download Submit
C:\Games\Ages of Conflict World War Simulator v3.1.1\Ages of Conflict_Data\Managed\UnityEngine.SubsystemsModule.dll

Filesize
14KB

MD5
ca46ff4e7a6411dd84c5a16506219a6b

SHA1
41fac45548288853370064c7ff6cdb97a870b803

SHA256
c81f283fade999796303c2ca803b823d561a66bd9c1721529bd727fcce121f6c

SHA512
3372ab1da8edc992a3641ab89db396d53e7e41e2c83df89cdb52233a86557ed9f179cb5ae51147af2724f33a36de3921662d58a4df0f71adec5d54a894124d91

Download Submit
C:\Games\Ages of Conflict World War Simulator v3.1.1\Ages of Conflict_Data\Managed\UnityEngine.TerrainModule.dll

Filesize
17KB

MD5
fbb774fd45d491ade6c923f921472465

SHA1
26cb6a7b137c938f78f6d54eefc9717b4bbe2274

SHA256
c3c2f09972dbc773d3affce5f3ea2dffa7ae05eaf1ce17fd228ab13dcdd44c98

SHA512
cf4966292ad37e499ed5c6df278cbfbfc43854b5b9fe933c6282c53704df6efda051e69561ce9abe55e422e636ccc5b5b5c378c4755fb4f6edc23faf6cc7e08f

Download Submit
C:\Games\Ages of Conflict World War Simulator v3.1.1\Ages of Conflict_Data\Managed\UnityEngine.TextCoreFontEngineModule.dll

Filesize
25KB

MD5
bb75fb4f77b93c025390338c7ff46266

SHA1
f11b35976393d86a6e2e7e46db815f82d2da544d

SHA256
a186f0ff560f572f0568c49da896220d5a5bc4cb149a5174652203bb65840446

SHA512
539a0e45aca504a4ca1ba373f2f3a74153fcf99211be8d30b87c34b145b21fba868e77addcc8a829365c7ecde17fcaf23d18ca0fc499b1c127ce7b5832cc25a8

Download Submit
C:\Games\Ages of Conflict World War Simulator v3.1.1\Ages of Conflict_Data\Managed\UnityEngine.TextCoreTextEngineModule.dll

Filesize
162KB

MD5
6ea2048113a060efdecc5727c63f3668

SHA1
faf2cab3e2929138c3e975a75ac395c0f4d936f1

SHA256
1a3d6105acf820181ba4d62139bbb486f668a3a9a35828ef3446d74c318f72a0

SHA512
6b576ab25d96cdc1301c4e3d270ef3d8edc9c6e9e72335711c5cb128ed081b9f6e338013808c541671408d569a08d5ad3d3a4245a9c8aa5b007947c07adad3c9

Download Submit
C:\Games\Ages of Conflict World War Simulator v3.1.1\Ages of Conflict_Data\Managed\UnityEngine.TextRenderingModule.dll

Filesize
19KB

MD5
0de7f5dc8747129fd9a0f5a9252ad4f2

SHA1
2ae52798bd6c3b9fcaad642cacac11d0b15b53d2

SHA256
33869dd758db524daf8f0fb84ca1cd552f0a72c76fc97a79e0337cc14ab41503

SHA512
91de7857a34e25e1a98887012056c11dcc32c0e251787f1aac4ca7e427758f587fc0a6bff9a72dbcc7a0e4ddaa936d76c66eeae20d88fd2d968ed0fcee8ebdb8

Download Submit
C:\Games\Ages of Conflict World War Simulator v3.1.1\Ages of Conflict_Data\Managed\UnityEngine.TilemapModule.dll

Filesize
16KB

MD5
bddce2dee734352e8ccb301c2999f744

SHA1
b5a90062a1d4f13384bde112b262035079dc4a20

SHA256
69c607d3ee5d66dd030385c419e7857b578bfd6a5c7b908441cfa8d1b659331b

SHA512
4f694b02310f6a8b636d47ec96fe309c514d110ad3487221ffe0931ade56518600c192ab68ef4f92bcd6125884a863a981341f26b4629b5ae82ce9af19713241

Download Submit
C:\Games\Ages of Conflict World War Simulator v3.1.1\Ages of Conflict_Data\Managed\UnityEngine.UIElementsModule.dll

Filesize
900KB

MD5
1fdbe1634e873cab9771aee1e132e2ad

SHA1
84b76c225e07fba980783df0eb0ddea63b313be4

SHA256
31efcf59edc4db2173bc9928caf57562d1ab295a5236f5e978ebf8632f37e404

SHA512
2cc8d2ad2b08de241935cf06a4e68c95bf4a7dd74b03719c73800460c6040703aee6b12b4e52b261641dd40433485918c82dd4cb00b2de81c900914c6d3e9a2b

Download Submit
C:\Games\Ages of Conflict World War Simulator v3.1.1\Ages of Conflict_Data\Managed\UnityEngine.UIElementsNativeModule.dll

Filesize
33KB

MD5
42c2b11849faac97b75be578ac151ce4

SHA1
742a9a89e16e348508984567d76f1cbb4fbcf23f

SHA256
06cf3b3033cc95c2e4175c95c434e5a709365d2fd3ab92e353663d4d9e876e79

SHA512
36ea95b9856056ac36bbf18f86421560dcc0cf9e3be4036e746ea8de298ebc56cfc83a5c937ce6c4af866f2fb68c5eb234495d2a682ac08d10bc9e877c17e966

Download Submit
C:\Games\Ages of Conflict World War Simulator v3.1.1\Ages of Conflict_Data\Managed\UnityEngine.UIModule.dll

Filesize
20KB

MD5
870420982ffc879f2d8649c6ea688c5d

SHA1
36ec212dd057202d7e14219d8bf40d4d5c4ffcea

SHA256
3237d24de99d50a4ff3facb0d74cac1b0338bef92cbca64d4db71421bf172017

SHA512
1c2f1dfcd0049ea28d214f0d1d3df792877711b7512393cf85634958abc79359aabb001e1f8bb237c20eb8fad23d38a8e6e87fa5fa20b02b2c200be0d42a00bf

Download Submit
C:\Games\Ages of Conflict World War Simulator v3.1.1\Ages of Conflict_Data\Managed\UnityEngine.UnityAnalyticsModule.dll

Filesize
12KB

MD5
2218bea72cc7592091bc097dfc77a0b3

SHA1
e239328e8a32f35cace8649c588c5f52cff635d3

SHA256
260fac32a82551c60acf54786366130cd8229bee091d30791ddc4fd97fcfdcdf

SHA512
4e655dc048602a33908feb9281eb350e936b2a5036ecb945fde0ccabe1e4ce876bfe504293f42f6b98045c2505dcd36def7bdfaa6f3d31992b6a269c72b8c739

Download Submit
C:\Games\Ages of Conflict World War Simulator v3.1.1\Ages of Conflict_Data\Managed\UnityEngine.dll

Filesize
58KB

MD5
adcefd32bdd421d48bcd591ff202f2a6

SHA1
f0027ace67e46e782249d9b64e7cfdd4709548c7

SHA256
5d7c6f749faaff02c64d9a62823731f8ed75c2c68bde3a91d6522481e5f9fc49

SHA512
b3425e7de168ed3ae1041380553308a1ba42d6be56ff9dbbb59643d404677d1c175bcfd2dfd34986b6708428ddea70f58024574fb9e87e5aaceb9497965ac19c

Download Submit
C:\Games\Ages of Conflict World War Simulator v3.1.1\Ages of Conflict_Data\Managed\mscorlib.dll

Filesize
2.6MB

MD5
4f84f92cfb98d396f96e2f25a288d169

SHA1
a204d1f6441fd47736f50680b9587f8d8771a258

SHA256
3e2514bce5d3a5babd273a7f200d59cf3493d8729a55db9f3537cbed7e43ef69

SHA512
df23ab9cd28369976e4b0510351b3daf1139b453e8ed626886e2b7460fc2438a1679284184f176bb10ecc59ca7c7da601a9fc0416e00fbd5b0ec42d6e398ab42

Download Submit
C:\Games\Ages of Conflict World War Simulator v3.1.1\Ages of Conflict_Data\Resources\unity default resources

Filesize
4.6MB

MD5
30ca65ecdce3120adb3a7a4704ff4e9a

SHA1
d11141baa87537588009b24d5ffa842876acf674

SHA256
e8240f4deb637ae052b5ac8c735f7b0ccc6c8aeb32dbaed5e722520f6297b9d7

SHA512
3a3fa878028c0cddb8c77cc03565f9e5ac0844c30a95a32d28a57f1d08c27e02ec60a910730242f78dbba9d38bc140c31a953b88d159b8e9163f3860001d6e3a

Download Submit
C:\Games\Ages of Conflict World War Simulator v3.1.1\Ages of Conflict_Data\RuntimeInitializeOnLoads.json

Filesize
4KB

MD5
395fa54a914b01353f27b3b66f6c23c3

SHA1
8c75772864abeb29254ff230218fe91bca1c83ad

SHA256
0bca4a44c846433ffa6563eff69ef62540234613529416bff23592293e16b801

SHA512
729c2f7e0c841ddad621e2dc1864e908b52725b40e35a8ec9a58037a2359f52db323989d31c2ea0d073889cf2efc043bd03f4427b3a934f2202e64d8782fd0bc

Download Submit
C:\Games\Ages of Conflict World War Simulator v3.1.1\Ages of Conflict_Data\ScriptingAssemblies.json

Filesize
4KB

MD5
101d9c60f931db943a12e74bce49b5cf

SHA1
ec6291e827aa080270be31292bab85c5b459d031

SHA256
08ac7ee66657147afface4c0ee7b28b4dacac11a33d053b461bcffa672e7deb1

SHA512
8334fe506c73d685ff1e6205ace36971a41cdb5964f84338cd3bcd26d2060b32f640a6dab06ab976f166efb1b8545e51eff17d28e49ab7d01cf1b484042a4d68

Download Submit
C:\Games\Ages of Conflict World War Simulator v3.1.1\Ages of Conflict_Data\app.info

Filesize
30B

MD5
b5732187a1f2e56e930374350e94b3e4

SHA1
566f0d53fc2f894d05d60773602131f37d707028

SHA256
51341f86b15fa41ad0f37cdd6a5c92ced640f7ef72ccf57cde2029b1e5ee9b3a

SHA512
225425b697fb82150f8f358817302611cfa6205b73c2c238c48b8e9d4e770eee5bedfe643f3136ed835da8b1231888b93801175e5e9c4a46a791360c4f0f5714

Download Submit
C:\Games\Ages of Conflict World War Simulator v3.1.1\Ages of Conflict_Data\boot.config

Filesize
69B

MD5
2b77119d737c1c2caf66bc03e37efed2

SHA1
07516483372e39b828f8a4d8a6f3e13f2a607b22

SHA256
25202c8f0caa8139d220c1db829ac0445de52047059b03c920c7d145ddfeb4ba

SHA512
53de04a485fc86e9327e39f6c2efce794f44295817f7106fc66e814e3f690209ee04c33b08c21dd951a15fbe472bf7b5a92acec465130319b85fa5ac09f9baf2

Download Submit
C:\Games\Ages of Conflict World War Simulator v3.1.1\Ages of Conflict_Data\data.unity3d

Filesize
6.1MB

MD5
8b8606155a0bbbe1278cd5bd5e053be2

SHA1
a4a8dc91fefbe681a0ec902ef60d7a9a794dba3d

SHA256
3872e3330c7a9f48709294205dfd30f2e52194fe34f9f0e2012bb9490c333338

SHA512
4cd743a32b3836b802e54fd39d6cbdd17464d48be8b3ba249ce3d7880c693444639f938c6b10e63c282f90731254f320b9f594c0eb08d3b7fb537dc86a16ef4f

Download Submit
C:\Games\Ages of Conflict World War Simulator v3.1.1\MonoBleedingEdge\EmbedRuntime\mono-2.0-bdwgc.dll

Filesize
7.4MB

MD5
7d3e278af1fcc72745463d74431a3643

SHA1
bdf3a23004b987a3db532676db0378755ce9f473

SHA256
749b8ce44e6aeb3d744dac957fa8b423ccf20e455889e25caa3f0746864c17e1

SHA512
97089ec3244052a44d88db1a1bae277d444879c28db3d5cd8af64f082f46c93d538054dfa5473308461a64a02780a13c59445a3cbb8024970fb2b8ca97675538

Download Submit
C:\Games\Ages of Conflict World War Simulator v3.1.1\MonoBleedingEdge\etc\mono\4.5\Browsers\is-UP19S.tmp

Filesize
1KB

MD5
0d831c1264b5b32a39fa347de368fe48

SHA1
187dff516f9448e63ea5078190b3347922c4b3eb

SHA256
8a1082057ac5681dcd4e9c227ed7fb8eb42ac1618963b5de3b65739dd77e2741

SHA512
4b7549eda1f8ed2c4533d056b62ca5030445393f9c6003e5ee47301ff7f44b4bd5022b74d54f571aa890b6e4593c6eded1a881500ac5ba2a720dc0ff280300af

Download Submit
C:\Games\Ages of Conflict World War Simulator v3.1.1\MonoBleedingEdge\etc\mono\4.5\is-R7SS7.tmp

Filesize
59KB

MD5
f7be9f1841ff92f9d4040aed832e0c79

SHA1
b3e4b508aab3cf201c06892713b43ddb0c43b7ae

SHA256
751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a

SHA512
380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5

Download Submit
C:\Games\Ages of Conflict World War Simulator v3.1.1\MonoBleedingEdge\etc\mono\config

Filesize
3KB

MD5
ced30438c7663df1f57af23bba624460

SHA1
e02a718d8e6efb74bd8bbf70a1d6bc644055f39f

SHA256
107b0d888b6169bb0e51205e967d88fa82899cc6f66bde54ef9b70169dc43b1d

SHA512
925d2b0c356d86a2a193de997daef501359445df226a386994716867f891255316165e3bfa4c9546a508f29c0b579dd78218a1d96cf4e891e76c74394838920c

Download Submit
C:\Games\Ages of Conflict World War Simulator v3.1.1\UnityCrashHandler64.exe

Filesize
1.1MB

MD5
e9bfb2a4bcd542fc9b528cdd4bc37719

SHA1
c48a09e946b3aa75ce8972d98ed58f92c69c76f8

SHA256
dd8c4f815e93e97e924fe3eae1bc09c238841f2167a07905b60e06ee6d97e51f

SHA512
0b021ed576fa567d1eed5e1e904c8992ec6c316b8db5c0e580cd0d5b656d96d83b823d505c701512971cf0f0db4c174f416a48ae9b3095cba90c581674504929

Download Submit
C:\Games\Ages of Conflict World War Simulator v3.1.1\UnityPlayer.dll

Filesize
27.7MB

MD5
1ac43df3d8cc386adf8ebbe61f8eff40

SHA1
936cbbf980cd95027d0cb2aaa8fb0e6bda3c24cf

SHA256
477c15a09d560e547d237596ad4ef1c55317c9dd049e38f62c24bb9bd4fb3331

SHA512
f9e1f9563260e56959bde6725d3b4ddaf44cb2cd10c23f8da7a244fe55b76cfeefd03c6e5606c7770fb75e17ec69a32bf3c430572b85c0de6a6f53efeb00b5ec

Download Submit
C:\Program Files\qBittorrent\qbittorrent.exe

Filesize
35.0MB

MD5
7a47d50bdb7a84a1fa58653f55eb2697

SHA1
fd767a6225bfdcca0537043b8f647d6ce33f7d1c

SHA256
6864e1a85198efb8ecf5f26564f7565d4d4e93f1ba7e4359bc05910ad74e83f0

SHA512
8c292a2a0bd6be2dac30e0f2cefe9bfd73aaff96e0cbb1301bba283fa8eabf378bbbc2c45667ec0cb0092e92d54bc02f054fb74b51eaa9068839225c3915d753

Download Submit
C:\Program Files\qBittorrent\qt.conf

Filesize
84B

MD5
af7f56a63958401da8bea1f5e419b2af

SHA1
f66ee8779ca6d570dea22fe34ef8600e5d3c5f38

SHA256
fdb8fa58a6ffc14771ca2b1ef6438061a6cba638594d76d9021b91e755d030d3

SHA512
02f70ca7f1291b25402989be74408eb82343ab500e15e4ac22fbc7162eb9230cd7061eaa7e34acf69962b57ed0827f51ceaf0fa63da3154b53469c7b7511d23d

Download Submit
C:\Users\Admin\AppData\LocalLow\JoySparkGames\Ages of Conflict\Unity\4bda70a2-ccda-495d-b444-bf3cb35f4178\Analytics\ArchivedEvents\173523586200000.716cc8df\g

Filesize
1B

MD5
c81e728d9d4c2f636f067f89cc14862c

SHA1
da4b9237bacccdf19c0760cab7aec4a8359010b0

SHA256
d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35

SHA512
40b244112641dd78dd4f93b6c9190dd46e0099194d5a44257b7efad6ef9ff4683da1eda0244448cb343aa688f5d3efd7314dafe580ac0bcbf115aeca9e8dc114

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\afyb4qvh.default-release\activity-stream.discovery_stream.json

Filesize
19KB

MD5
6dedf8abf7de132b0cced17ee912de57

SHA1
0376d298ae8c615b6730db95ed7232241247d662

SHA256
6256d42401232cb64be78ec9fc6a3c5df7889518df1c2dee703e6fda64231ebe

SHA512
c07552aaa9aa2142f6cd9a91bb0a423f71681a6d90967ccfabf94f67657e06877d58f2309050d51370ebd3ed8fcbdeeec56ea2e3e2c00185f0624159e00d3e18

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\afyb4qvh.default-release\cache2\entries\0C0E12ED83B149D6A68D87C705EAEF00394A7588

Filesize
61KB

MD5
a63e6d2d366c54c6211f11ac1d84b1c2

SHA1
9d158a23553ee133a028cbeeed797d6e5a9843df

SHA256
6e84f251cbc1636463a101e726f3e7e0db7d830bab80019c9b75e4b5e4e37ea1

SHA512
f70d5a3f3bf175fb09db1b8e092034e6c94657d7387dd0000eeb7a1a4ccb2af4008d428f46f84886b4e37753063adf07a0e40b8f657ab093914f192510b6064f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\afyb4qvh.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-4PPET.tmp\Ages_of_Conflict_World_War_Simulator_v3.1.1_setup.tmp

Filesize
3.2MB

MD5
45e0e66b179be22b86b49e52768ee8a8

SHA1
1383ce7adfc1e8dbb3b56d90ce9fc9669ac39c15

SHA256
db7a332f128e680b0bdc7685fe5747907308d152310ae1d08d0ae46196377a15

SHA512
a19e475ba551082e6e22f43151dfddfa46ece612156f23558a34c8bcf947830c8d6d0bf820c222cb64cc3725954fa81e8bd9ed6103694f973489c7b07e236530

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-Q5SGA.tmp\botva2.dll

Filesize
41KB

MD5
ef899fa243c07b7b82b3a45f6ec36771

SHA1
4a86313cc8766dcad1c2b00c2b8f9bbe0cf8bbbe

SHA256
da7d0368712ee419952eb2640a65a7f24e39fb7872442ed4d2ee847ec4cfde77

SHA512
3f98b5ad9adfad2111ebd1d8cbab9ae423d624d1668cc64c0bfcdbfedf30c1ce3ea6bc6bcf70f7dd1b01172a4349e7c84fb75d395ee5af73866574c1d734c6e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-Q5SGA.tmp\idp.dll

Filesize
232KB

MD5
55c310c0319260d798757557ab3bf636

SHA1
0892eb7ed31d8bb20a56c6835990749011a2d8de

SHA256
54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed

SHA512
e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj782F.tmp\FindProcDLL.dll

Filesize
3KB

MD5
b4faf654de4284a89eaf7d073e4e1e63

SHA1
8efcfd1ca648e942cbffd27af429784b7fcf514b

SHA256
c0948b2ec36a69f82c08935fac4b212238b6792694f009b93b4bdb478c4f26e3

SHA512
eef31e332be859cf2a64c928bf3b96442f36fe51f1a372c5628264a0d4b2fc7b3e670323c8fb5ffa72db995b8924da2555198e7de7b4f549d9e0f9e6dbb6b388

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj782F.tmp\LangDLL.dll

Filesize
5KB

MD5
50016010fb0d8db2bc4cd258ceb43be5

SHA1
44ba95ee12e69da72478cf358c93533a9c7a01dc

SHA256
32230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e

SHA512
ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj782F.tmp\System.dll

Filesize
12KB

MD5
4add245d4ba34b04f213409bfe504c07

SHA1
ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

SHA256
9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

SHA512
1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj782F.tmp\UAC.dll

Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj782F.tmp\modern-wizard.bmp

Filesize
25KB

MD5
cbe40fd2b1ec96daedc65da172d90022

SHA1
366c216220aa4329dff6c485fd0e9b0f4f0a7944

SHA256
3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2

SHA512
62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj782F.tmp\nsDialogs.dll

Filesize
9KB

MD5
1d8f01a83ddd259bc339902c1d33c8f1

SHA1
9f7806af462c94c39e2ec6cc9c7ad05c44eba04e

SHA256
4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed

SHA512
28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj782F.tmp\nsisFirewallW.dll

Filesize
8KB

MD5
f5bf81a102de52a4add21b8a367e54e0

SHA1
cf1e76ffe4a3ecd4dad453112afd33624f16751c

SHA256
53be5716ad80945cb99681d5dbda60492f5dfb206fbfdb776b769b3eeb18d2c2

SHA512
6e280a75f706474ad31b2ce770fa34f54cb598528fac4477c466200a608b79c0f9b84011545595d9ba94331ad08e2f51bd42de91f92379db27686a28ba351256

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\AlternateServices.bin

Filesize
10KB

MD5
6be656ec29f7cd6d0fce0be2c873ecb9

SHA1
e471e9edb750fc07b55df2835b7614c73b3e3839

SHA256
ee50953f0e0eee24f7f129dc9239950713109857db84b2bdba89de1881e09cbe

SHA512
1ed9d10e9858dcd059d509ea406a37f9d5ba43be505d01eb1aff0d35f16f86d5bf392904b683def079975e92fa734cc8031c4494b9a52400aba4e76a624390b1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
babab7797e968681b1ed3c5d3c150c50

SHA1
366e7ee64aa8c9bbba1ef0676b35fe1bf805fa62

SHA256
342a83fc8e2d6ced66f9a18c8b3297b81da39056e8e640ca7b0b3ba1279e7a0a

SHA512
3f06e266ee4316d29f6a77e61cfdca420423ce63944ccffd0a532af38b9b341f78b58bf500f7f9150f1c6e9160b2432c9fba4093d47cba07fcc2dffaceb40644

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
c182697649349dc6292134aaa8ecc61f

SHA1
79ae7b39a8325804ddecff925b51462a55e5434a

SHA256
f98dd79c6622774209e21110dfca458a39feb53dc3ac1db3464fc1f1944b451b

SHA512
f66b70d6ee485df79e7ee15ee2caf31f306a693c2787fed888387d605ab15dcde52edc2ce1b7222288dae9f26fef6b2b22079c74bbc5a0b5a1624934b4fc9dc9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\datareporting\glean\db\data.safe.tmp

Filesize
26KB

MD5
95a288207019973c6f23de13d2a2a748

SHA1
7dfcc30b44a86a64ec32d0a9b72d91ec6526371c

SHA256
088ebeb38eb6fd8d71ddda8aefa08504d046a48e0e7d4133ef7c348abe21f160

SHA512
54dbe4479ebb6285b54646fa170db9f074c92ead2360c969151eaaa02d4341a6c5641d359ccd3e30b93ef691623c273597bb3bf46547795552b55d3a0163215f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\datareporting\glean\pending_pings\35dae469-d1b4-411d-aad5-72262a0dd11c

Filesize
982B

MD5
47af8cf7fb3cdf0b4704216b2b306971

SHA1
76ea22cd6bf70a9ebcbaef3300bd90a6323d3d9f

SHA256
ac965147adbd8461080bd4d326f70dce81c9cebdd53548e3f702b4cb1aedfed7

SHA512
bab16c20d2d7af6c5a1a9ba2dac8cb25631d1cea67acccf3db9a520b84089d09407526a467b4954900e87951193a13e145be9ab74d5de62993973f3e0c856dfc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\datareporting\glean\pending_pings\68e30036-230f-46a0-a2d7-fe30be27763d

Filesize
27KB

MD5
5a0055373672881a962a602fabf90cb9

SHA1
8635e589378954a45d6b74e501f160131fcc3b6b

SHA256
b46dd20b576705a00a98d8023f2d393df799d59f6b4723d4efc68936bb591c27

SHA512
6236599ea1f850306c4dc1cd9628a572793fba7a540a8c3942168d7e7ddc0acb427c24321d6abd9f04478bbcae8d2179eab944e82d3d03dc578d3b121bd7c98e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\datareporting\glean\pending_pings\9bc45899-a229-40c2-9878-9c11bc215294

Filesize
671B

MD5
92b8873ec17946d4aecbc626f8cb7c25

SHA1
2d8776a8445086d60f4a8fd7be417aad5b56e83a

SHA256
455a9155bda239a62262ac04ddca83a7aa200066c38af66eedbe66405ee5739b

SHA512
fd4b95e7ebe10be0cc168da48ff33be693438f0d0d7b05edc8c69b104b9faf5c02381127bc42de662e95534927e99089cdf800039aa387efac6b57bd1f789a36

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\datareporting\glean\pending_pings\ec09e94a-819d-4d69-a095-6443194ff9c6

Filesize
15KB

MD5
735ed70baf6addb0743008fa1964eb11

SHA1
25b43dd81f8832fdf360d478ee09cb74b5f6e3a3

SHA256
f61f34a1a29e3e0340b0c7c3a293e90b15eda2102f66eba5734483ae0de5cfaa

SHA512
120268920d8a586c16b516b1f235a6064bd41032fd14248366446f39b892f21c25370a24e13f7048d57ff971ea81f6da3d5ca590f4d1b4048d2186e38ba07881

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\prefs-1.js

Filesize
11KB

MD5
9f91c4a908d860db9e553b9bdd839e5f

SHA1
406034f22b06674d428caffe2bf9d5321a064173

SHA256
75c3286d8121b3a40e43481f9d1522a94b1112ba8b582bc2e04531472b7fab62

SHA512
83e02b723a8e7797ee1fc9b6c1ebdd457653657c05ca5e6ee122426cd10c92f41a8ae2cfd05b3fa0dcea776bb41949468a478ab1f167d322da2851a41d29b60b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\prefs-1.js

Filesize
10KB

MD5
45d60001382baf9f4661ea2267ef3adb

SHA1
920792ecd54341b69e77f43fc4fb141e84c98d3f

SHA256
cd33e88667cc81a75704c3e057c9af7b044dc8de370975f38027d205f7951ff4

SHA512
9717db01408bbedba0a4d6cbf0eb8bf9b58c23a00c8af0475de367f671d60087c4f7d2bc54774845a744ba2ab4a5cd79a2a4b0783fb76c4feaab1cdba0857482

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\prefs-1.js

Filesize
11KB

MD5
60dd7075ca789e0a0aefa19b826e8c48

SHA1
6d55e43707133d75c598e5ff2d3d2c93c4aca762

SHA256
d7e3bc947bf03c3391c8c63511e9eeaed0181b67f512be67d2b4d16a30f14436

SHA512
7a9d31d9d44fc59415566bccf4eb162dbeb3d214a65dc60be2dc53b5ea81f549239610065d8ee8bf9f4b10fd1cc0ccc79ec05d639595796ef2aca9b5b8511321

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\prefs.js

Filesize
10KB

MD5
ea5ea3bc5435a6dd9b763e5fd5448d81

SHA1
5358d034b6ac5278ff46ea2d0eb5c1ab9a79b5cc

SHA256
b1bc2000861a4318cbfee1371d9f9723251bf15c2382993050006e9be183f458

SHA512
f951e886f0595e71da8fbc995741a0e51e6dc20a7cc2096a78e25a4816f4a55defa88a829109a30ae884e34a70ff5dd2b055b1118ad9740da4e2893d96b4f264

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
e016938739e4b81a206f2af258751fa6

SHA1
af29bb383775ec2a7ce8d8e4e51668af0914879b

SHA256
74d8cbe8cedd3d64c9ffc23ccfd8d6a337a90b48b3fb3802fe468e6c521b6015

SHA512
6d6b71c636ba96540d31340d07dd6781514ef5a13c08927eafc1bfc5f83f5266741cc5162f3411fa6a127df55393a86d67850b8fe2e44c45f9853d7da24c32d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
13e68aa4eb57b885774d673a2ec4eb25

SHA1
fe2aabf88837211874694155af6ad3071fbbdb67

SHA256
fcf311a8fe4c13d55194fd4d36ebeb7137be128f2eab1fc433b03502aa5711e7

SHA512
3ac8040dfbd15f46a4a3e6fe33ce1370dba199f615ff0b3791d8d424a23c129f10448c1c81b44ddcae7cd96c47a5f7a5e38046c112149819364a353f8ad44b2b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
c6ebdd619e7698ae8869b55a4371619a

SHA1
52302765899dca0ed1b7a958ee6045a89f6083b2

SHA256
3ea70602732b58a8eb3d186b0b98afdbeabbff95a36548c3f1459db3874b4d96

SHA512
2f7cedfc554530248c21e9eb81e85ca231c818ed2c132b516ecbabc9e7e113d80dfabd647fe888164d910e28a86acd87e2ae42349f42d3b69592ea364de87b11

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\sessionstore-backups\recovery.baklz4

Filesize
2KB

MD5
f7c5f861e4b842302d22340b34042392

SHA1
cfb4b53216332fdf34d50d1d770457d5decaa12a

SHA256
fd421cc49fe874f06373969447044ff877968379d18efeeb457caa450e1377a7

SHA512
e7470721b0a310f6f02f549df921ac855fa0b2ec61395f3270e41f725b8fd568ec1df0b1fb16279b131420f92788aa773fe65daa9989fe2847d848348699db23

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
804d468f451754557d501b608781c491

SHA1
2cea198cd23b418b10284ebdc1bae6f079c469c5

SHA256
faa633293d33a069b85adcac6a27c8260fbd7404870f4393d6710a8db465ff01

SHA512
359ec3326a230d1d12a834ef76be88fcb12998d8086294673e6529b57e03b9911599aa44a102b49b54ee36ea5c0f3fefa3580437b849d536048bc4075f59b108

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
c4df54ed667b4ba30d3fb5332532f758

SHA1
7617867a5960530faf21bd0ce1d9af27d0f23f99

SHA256
465974eab0d6ce9cd4b7541c59f808cec77037c681e6396b6394c13def23686e

SHA512
12180ce4d18442dcad7d7d059d1a002abed187810171e02317c5eb3acbeb6f90ea23b8c02b8537d009f274a1510c68adde2707d77b3147f33f43d8eae4de23c6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
384KB

MD5
6feabc4689a5552f7b52a19ffab0eef9

SHA1
48234cadd8b6d454ec230fd332402fc55549d42b

SHA256
569b4ae7814718600a351b053f1992f6ff8fbed2e12c3e00276703e27e57deb1

SHA512
276eb8715572cded564a614522886cfe588f1ed43a0112dbfafdbda0a039be3c2e765dbdf5cefb78827a3c308df81cf74e0d98249b44b2349d87640b80b24f3e

Download Submit
C:\Users\Admin\AppData\Roaming\qBittorrent\qBittorrent_new.ini

Filesize
3KB

MD5
d341374b2f0a15616d077be5e4658224

SHA1
60127cb464e6dd2e14924281c5053a6073075597

SHA256
9aae0fc7ab4b43bf3fab4f4775b791930a4d78775df5ea368363025a90c12c2b

SHA512
18d5256e0ce6251b157cf544394bb96926d6a33db36f507f30f6b531618466ef830bc8b6292bb7c08e0a9e1aabda0ffdfb6b1a6e6fcd705839ec8cd9b2741fbb

Download Submit
C:\Users\Admin\AppData\Roaming\qBittorrent\qBittorrent_new.ini.lock

Filesize
64B

MD5
0cf776c9fea43356e5fde0f494b8e63d

SHA1
da913901f0688860d6dd9a457cfbc7b67bda4b49

SHA256
fe97fad2997b52ce716a99576c5ae980cbfac89a12d80ebc6cb13f25330a055c

SHA512
d9c367debaf9bc1a9920c604216cad272bc1c4175d543b5fdabac849308688df7aa73b61a9b6158d7e16c281b97adda3534ae2e98ceb7aaa08d1bff2d0bd3a7e

Download Submit
C:\Users\Admin\Downloads\LGAPgmK6.torrent.part

Filesize
9KB

MD5
362461c5c10b240e4387c63b091a8779

SHA1
87650f28db26b9abc7e964d5d0f7976eeaeede42

SHA256
caa6632c5a1caf08bb24565a9b56897c0c9038797af87f4989817b623be7934a

SHA512
66859079ce5589b732f1aae5faa1095da6759141f20d7864da54f225f4f198a08bb3fbb4dcac03b0e4777d1d897e84e9a5e52594ee4590b761835a9a88243ea0

Download Submit
memory/3696-1361-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/3696-1055-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/3696-1085-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/5576-1352-0x0000000000400000-0x0000000000748000-memory.dmp

Filesize
3.3MB

Download
memory/5576-1353-0x0000000007D40000-0x0000000007D4F000-memory.dmp

Filesize
60KB

Download
memory/5576-1087-0x0000000007D40000-0x0000000007D4F000-memory.dmp

Filesize
60KB

Download
memory/5576-1086-0x0000000000400000-0x0000000000748000-memory.dmp

Filesize
3.3MB

Download
memory/5576-1080-0x0000000007D40000-0x0000000007D4F000-memory.dmp

Filesize
60KB

Download
memory/5576-1360-0x0000000000400000-0x0000000000748000-memory.dmp

Filesize
3.3MB

Download