878ca7e3fb7a90a937afdbe080c055877b4c6334a9589d27e092fd6737a0716f

Analysis

max time kernel
751s
max time network
756s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
03-01-2025 21:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

qbittorrent_5.0.3_x64_setup.exe
Size

37.5MB
MD5

83505c82e83bd2e61bd67dfcf30724cf
SHA1

5fbde5f904a7c0e1346b9bcef4a66a7a7dd7e5b9
SHA256

878ca7e3fb7a90a937afdbe080c055877b4c6334a9589d27e092fd6737a0716f
SHA512

87ead0cac1dd041f7929e68bfdf8b61ac50c9d05a74344ab951f9c624874452e22a30f678a6a059cc3e8906f92189c39cfe7bba6552681140d610edb1b529833
SSDEEP

786432:7nvRa6b9c7DLVZhxGjtYO9NByxgyXXbFTUgCe4Oa0eMe6NwRI/gWfe+C:7paO9c7VZejf3OBbFTU3U+6NxIV+C

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Contacts a large (522) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000\Control Panel\International\Geo\Nation	qbittorrent_5.0.3_x64_setup.exe

Executes dropped EXE 11 IoCs

pid	Process
4084	qbittorrent.exe
1232	qbittorrent.exe
4572	qbittorrent.exe
3288	RimWorld_v1.5.4297_rev1078_setup.exe
5388	RimWorld_v1.5.4297_rev1078_setup.tmp
1736	RimWorldWin64.exe
3028	UnityCrashHandler64.exe
5832	UnityCrashHandler64.exe
976	RimWorldWin64.exe
4240	UnityCrashHandler64.exe
5160	UnityCrashHandler64.exe

Loads dropped DLL 15 IoCs

pid	Process
2024	qbittorrent_5.0.3_x64_setup.exe
2024	qbittorrent_5.0.3_x64_setup.exe
2024	qbittorrent_5.0.3_x64_setup.exe
2024	qbittorrent_5.0.3_x64_setup.exe
2024	qbittorrent_5.0.3_x64_setup.exe
2024	qbittorrent_5.0.3_x64_setup.exe
2024	qbittorrent_5.0.3_x64_setup.exe
5388	RimWorld_v1.5.4297_rev1078_setup.tmp
5388	RimWorld_v1.5.4297_rev1078_setup.tmp
1736	RimWorldWin64.exe
1736	RimWorldWin64.exe
1736	RimWorldWin64.exe
976	RimWorldWin64.exe
976	RimWorldWin64.exe
976	RimWorldWin64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
3300	GameBarPresenceWriter.exe
2656	GameBarPresenceWriter.exe

Drops file in Program Files directory 41 IoCs

description	ioc	Process
File created	C:\Program Files\qBittorrent\translations\qtbase_ar.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_fa.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_lv.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_nn.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ru.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qt_sv.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_zh_CN.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_zh_TW.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qt_gl.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qt_pt_PT.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_gd.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ko.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_uk.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qt_sl.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ja.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ka.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_nl.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\qbittorrent.exe	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\qt.conf	qbittorrent_5.0.3_x64_setup.exe
File opened for modification	C:\Program Files\qBittorrent\qbittorrent.exe	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_da.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_it.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_tr.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\uninst.exe	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_es.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_pl.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_sk.qm	qbittorrent_5.0.3_x64_setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20250103212107.pma	setup.exe
File created	C:\Program Files\qBittorrent\qbittorrent.pdb	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ca.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_cs.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_hu.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_pt_BR.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\3b671ee1-4830-485e-a244-9398f0a13887.tmp	setup.exe
File created	C:\Program Files\qBittorrent\translations\qt_lt.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_bg.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_de.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_fi.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_fr.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_he.qm	qbittorrent_5.0.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_hr.qm	qbittorrent_5.0.3_x64_setup.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\WrpYGF74DrEm.ini	RimWorld_v1.5.4297_rev1078_setup.tmp
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\RimWorld_v1.5.4297_rev1078\RimWorld_v1.5.4297_rev1078_setup.exe:Zone.Identifier	qbittorrent.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RimWorld_v1.5.4297_rev1078_setup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qbittorrent_5.0.3_x64_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RimWorld_v1.5.4297_rev1078_setup.exe

Checks processor information in registry 2 TTPs 26 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = 0000000001000000ffffffff	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	qbittorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\ = "Torrent File"	qbittorrent_5.0.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\Content Type = "application/x-magnet"	qbittorrent_5.0.3_x64_setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\MRUListEx = ffffffff	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	qbittorrent.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent.File.Torrent	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\shell	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.torrent	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\magnet	qbittorrent_5.0.3_x64_setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	qbittorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet\ = "Magnet URI"	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616193"	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 02000000030000000100000000000000ffffffff	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	qbittorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet\shell\open\command	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe11000000e8c6ce27dd4bdb017a8cc92ae84bdb014351ce2ae84bdb0114000000	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = 0100000000000000ffffffff	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Generic"	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0	qbittorrent.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent.File.Torrent\shell\open\command	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet\shell	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet\shell\open	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 03000000020000000100000000000000ffffffff	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	qbittorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent	qbittorrent_5.0.3_x64_setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000be64cc27dd4bdb014da07bdde84bdb01da1f9d35245edb0114000000	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616193"	qbittorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\shell\open\command\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\" \"%1\""	qbittorrent_5.0.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.torrent\Content Type = "application/x-bittorrent"	qbittorrent_5.0.3_x64_setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\MRUListEx = ffffffff	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	qbittorrent.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent.Url.Magnet\shell\open\command	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet	qbittorrent_5.0.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet\shell\open\command\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\" \"%1\""	qbittorrent_5.0.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1798060429-1844192857-3165087720-1000\{CAC81F8B-C752-4E5C-8BA0-2892B732C857}	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1	qbittorrent.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\RimWorld_v1.5.4297_rev1078.torrent:Zone.Identifier	firefox.exe
File opened for modification	C:\Users\Admin\Downloads\RimWorld_v1.5.4297_rev1078\RimWorld_v1.5.4297_rev1078_setup.exe:Zone.Identifier	qbittorrent.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	1550	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
4084	qbittorrent.exe
1232	qbittorrent.exe
4572	qbittorrent.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2024	qbittorrent_5.0.3_x64_setup.exe
2024	qbittorrent_5.0.3_x64_setup.exe
5388	RimWorld_v1.5.4297_rev1078_setup.tmp
5388	RimWorld_v1.5.4297_rev1078_setup.tmp
5660	msedge.exe
5660	msedge.exe
1592	msedge.exe
1592	msedge.exe
4704	identity_helper.exe
4704	identity_helper.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4084	qbittorrent.exe
4572	qbittorrent.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	1344	firefox.exe
Token: SeDebugPrivilege	1344	firefox.exe
Token: SeDebugPrivilege	1344	firefox.exe
Token: SeManageVolumePrivilege	4084	qbittorrent.exe
Token: SeManageVolumePrivilege	4572	qbittorrent.exe
Token: 33	2144	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2144	AUDIODG.EXE
Token: SeDebugPrivilege	2716	firefox.exe
Token: SeDebugPrivilege	2716	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2024	qbittorrent_5.0.3_x64_setup.exe
4084	qbittorrent.exe
4084	qbittorrent.exe
4084	qbittorrent.exe
4084	qbittorrent.exe
4084	qbittorrent.exe
4084	qbittorrent.exe
4084	qbittorrent.exe
1344	firefox.exe
1344	firefox.exe
1344	firefox.exe
1344	firefox.exe
1344	firefox.exe
1344	firefox.exe
1344	firefox.exe
1344	firefox.exe
1344	firefox.exe
1344	firefox.exe
1344	firefox.exe
1344	firefox.exe
1344	firefox.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4084	qbittorrent.exe
4084	qbittorrent.exe
4084	qbittorrent.exe
4084	qbittorrent.exe
4084	qbittorrent.exe
4084	qbittorrent.exe
4084	qbittorrent.exe
1344	firefox.exe
1344	firefox.exe
1344	firefox.exe
1344	firefox.exe
1344	firefox.exe
1344	firefox.exe
1344	firefox.exe
1344	firefox.exe
1344	firefox.exe
1344	firefox.exe
1344	firefox.exe
1344	firefox.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe
4572	qbittorrent.exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
1344	firefox.exe
1344	firefox.exe
1344	firefox.exe
1344	firefox.exe
1344	firefox.exe
1344	firefox.exe
1344	firefox.exe
1344	firefox.exe
1344	firefox.exe
1344	firefox.exe
1716	OpenWith.exe
1716	OpenWith.exe
1716	OpenWith.exe
1716	OpenWith.exe
1716	OpenWith.exe
4572	qbittorrent.exe
1736	RimWorldWin64.exe
1316	OpenWith.exe
2716	firefox.exe
976	RimWorldWin64.exe
5784	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 4084	2024	qbittorrent_5.0.3_x64_setup.exe	107
PID 2024 wrote to memory of 4084	2024	qbittorrent_5.0.3_x64_setup.exe	107
PID 1172 wrote to memory of 1344	1172	firefox.exe	111
PID 1172 wrote to memory of 1344	1172	firefox.exe	111
PID 1172 wrote to memory of 1344	1172	firefox.exe	111
PID 1172 wrote to memory of 1344	1172	firefox.exe	111
PID 1172 wrote to memory of 1344	1172	firefox.exe	111
PID 1172 wrote to memory of 1344	1172	firefox.exe	111
PID 1172 wrote to memory of 1344	1172	firefox.exe	111
PID 1172 wrote to memory of 1344	1172	firefox.exe	111
PID 1172 wrote to memory of 1344	1172	firefox.exe	111
PID 1172 wrote to memory of 1344	1172	firefox.exe	111
PID 1172 wrote to memory of 1344	1172	firefox.exe	111
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 4368	1344	firefox.exe	112
PID 1344 wrote to memory of 3308	1344	firefox.exe	113
PID 1344 wrote to memory of 3308	1344	firefox.exe	113
PID 1344 wrote to memory of 3308	1344	firefox.exe	113
PID 1344 wrote to memory of 3308	1344	firefox.exe	113
PID 1344 wrote to memory of 3308	1344	firefox.exe	113
PID 1344 wrote to memory of 3308	1344	firefox.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\qbittorrent_5.0.3_x64_setup.exe
"C:\Users\Admin\AppData\Local\Temp\qbittorrent_5.0.3_x64_setup.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Program Files\qBittorrent\qbittorrent.exe
  "C:\Program Files\qBittorrent\qbittorrent.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4084

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:1136

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:2192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:4256

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2004 -parentBuildID 20240401114208 -prefsHandle 1920 -prefMapHandle 1908 -prefsLen 23839 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ff012960-9ae5-48cd-8dc3-f0da177973be} 1344 "\\.\pipe\gecko-crash-server-pipe.1344" gpu
    3⤵
    PID:4368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2408 -prefMapHandle 2404 -prefsLen 23717 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6b5fc4b7-2388-4d66-b379-02ff2ae1a12f} 1344 "\\.\pipe\gecko-crash-server-pipe.1344" socket
    3⤵
    - Checks processor information in registry
    PID:3308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3008 -childID 1 -isForBrowser -prefsHandle 3064 -prefMapHandle 3060 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1364 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1614658b-1e6e-4c8d-99cd-e7b1b737833a} 1344 "\\.\pipe\gecko-crash-server-pipe.1344" tab
    3⤵
    PID:1812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3708 -childID 2 -isForBrowser -prefsHandle 3692 -prefMapHandle 2748 -prefsLen 29091 -prefMapSize 244658 -jsInitHandle 1364 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7e6c38bc-8f94-4504-9b22-786ce4ae1d0b} 1344 "\\.\pipe\gecko-crash-server-pipe.1344" tab
    3⤵
    PID:5264
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5000 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4992 -prefMapHandle 4980 -prefsLen 29091 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {89a9d896-673b-4d6c-a876-ab0fba9a8c76} 1344 "\\.\pipe\gecko-crash-server-pipe.1344" utility
    3⤵
    - Checks processor information in registry
    PID:2884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5412 -childID 3 -isForBrowser -prefsHandle 5404 -prefMapHandle 5400 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1364 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {76ca5432-aa66-4386-9a55-ddd6e2bc8097} 1344 "\\.\pipe\gecko-crash-server-pipe.1344" tab
    3⤵
    PID:5852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5548 -childID 4 -isForBrowser -prefsHandle 5556 -prefMapHandle 5560 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1364 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8b4c7dbf-465b-4bc6-a6fd-ccc14c6e0cc4} 1344 "\\.\pipe\gecko-crash-server-pipe.1344" tab
    3⤵
    PID:5864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5808 -childID 5 -isForBrowser -prefsHandle 5816 -prefMapHandle 5760 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1364 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0648c039-b6cf-4aa6-85d0-1078f0d429b3} 1344 "\\.\pipe\gecko-crash-server-pipe.1344" tab
    3⤵
    PID:5904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4788 -childID 6 -isForBrowser -prefsHandle 6208 -prefMapHandle 6216 -prefsLen 27299 -prefMapSize 244658 -jsInitHandle 1364 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {37fa0aab-486a-4780-83be-13bd1a7b8cf1} 1344 "\\.\pipe\gecko-crash-server-pipe.1344" tab
    3⤵
    PID:3596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6372 -childID 7 -isForBrowser -prefsHandle 6380 -prefMapHandle 6384 -prefsLen 27299 -prefMapSize 244658 -jsInitHandle 1364 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {909ce592-038d-4f77-ba31-d76b53ffbc4a} 1344 "\\.\pipe\gecko-crash-server-pipe.1344" tab
    3⤵
    PID:4216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5464 -childID 8 -isForBrowser -prefsHandle 5468 -prefMapHandle 5480 -prefsLen 27865 -prefMapSize 244658 -jsInitHandle 1364 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cad4fc7c-9e1e-4df7-8688-60cc5458100b} 1344 "\\.\pipe\gecko-crash-server-pipe.1344" tab
    3⤵
    PID:5764

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:976

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1716
- C:\Program Files\qBittorrent\qbittorrent.exe
  "C:\Program Files\qBittorrent\qbittorrent.exe" "C:\Users\Admin\Downloads\RimWorld_v1.5.4297_rev1078.torrent"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  PID:1232

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\5bb94b160bb44ee7bdd9871ff9f26cb3 /t 572 /p 4084
1⤵
PID:1384

C:\Program Files\qBittorrent\qbittorrent.exe
"C:\Program Files\qBittorrent\qbittorrent.exe"
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Modifies registry class
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4572

C:\Users\Admin\Downloads\RimWorld_v1.5.4297_rev1078\RimWorld_v1.5.4297_rev1078_setup.exe
"C:\Users\Admin\Downloads\RimWorld_v1.5.4297_rev1078\RimWorld_v1.5.4297_rev1078_setup.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3288
- C:\Users\Admin\AppData\Local\Temp\is-PGHSL.tmp\RimWorld_v1.5.4297_rev1078_setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-PGHSL.tmp\RimWorld_v1.5.4297_rev1078_setup.tmp" /SL5="$14004C,447505870,1060352,C:\Users\Admin\Downloads\RimWorld_v1.5.4297_rev1078\RimWorld_v1.5.4297_rev1078_setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gamestorrent.club/
    3⤵
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:1592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x140,0x144,0x148,0x11c,0x14c,0x7ffc7a6946f8,0x7ffc7a694708,0x7ffc7a694718
      4⤵
      PID:3268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,4682873344737702327,4451400664322838800,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
      4⤵
      PID:116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,4682873344737702327,4451400664322838800,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1896 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,4682873344737702327,4451400664322838800,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3068 /prefetch:8
      4⤵
      PID:4056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4682873344737702327,4451400664322838800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3704 /prefetch:1
      4⤵
      PID:4724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4682873344737702327,4451400664322838800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3712 /prefetch:1
      4⤵
      PID:3240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2136,4682873344737702327,4451400664322838800,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5480 /prefetch:8
      4⤵
      PID:5740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,4682873344737702327,4451400664322838800,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5668 /prefetch:8
      4⤵
      PID:5448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:4244
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x264,0x268,0x26c,0x240,0x270,0x7ff7695d5460,0x7ff7695d5470,0x7ff7695d5480
        5⤵
        
        PID:4540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,4682873344737702327,4451400664322838800,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5668 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4682873344737702327,4451400664322838800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4476 /prefetch:1
      4⤵
      PID:2436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4682873344737702327,4451400664322838800,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
      4⤵
      PID:5300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4682873344737702327,4451400664322838800,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
      4⤵
      PID:3964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2484

C:\Games\RimWorld v1.5.4297 rev1078\RimWorldWin64.exe
"C:\Games\RimWorld v1.5.4297 rev1078\RimWorldWin64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1736
- C:\Games\RimWorld v1.5.4297 rev1078\UnityCrashHandler64.exe
  "C:\Games\RimWorld v1.5.4297 rev1078\UnityCrashHandler64.exe" --attach 1736 2334649815040
  2⤵
  - Executes dropped EXE
  PID:3028
- - C:\Games\RimWorld v1.5.4297 rev1078\UnityCrashHandler64.exe
    "C:\Games\RimWorld v1.5.4297 rev1078\UnityCrashHandler64.exe" "1736" "2334649815040"
    3⤵
    - Executes dropped EXE
    PID:5832

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x524 0x518
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2144

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:3300

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:4680

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:4760
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1932 -parentBuildID 20240401114208 -prefsHandle 1848 -prefMapHandle 1840 -prefsLen 28504 -prefMapSize 245021 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e817321-3b94-4abd-a3a2-fa20525026c3} 2716 "\\.\pipe\gecko-crash-server-pipe.2716" gpu
    3⤵
    PID:5300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2288 -parentBuildID 20240401114208 -prefsHandle 2264 -prefMapHandle 2260 -prefsLen 28504 -prefMapSize 245021 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {914e71bc-e286-4e3c-bd8d-de8499e42280} 2716 "\\.\pipe\gecko-crash-server-pipe.2716" socket
    3⤵
    - Checks processor information in registry
    PID:3604
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3352 -childID 1 -isForBrowser -prefsHandle 2876 -prefMapHandle 3212 -prefsLen 29003 -prefMapSize 245021 -jsInitHandle 1396 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {79619264-f07e-4cc0-9ffe-5d8489852575} 2716 "\\.\pipe\gecko-crash-server-pipe.2716" tab
    3⤵
    PID:4508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3632 -childID 2 -isForBrowser -prefsHandle 3716 -prefMapHandle 3652 -prefsLen 34236 -prefMapSize 245021 -jsInitHandle 1396 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4978a009-7ecf-47d9-be3e-58388309bbb1} 2716 "\\.\pipe\gecko-crash-server-pipe.2716" tab
    3⤵
    PID:5432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4740 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4756 -prefMapHandle 4752 -prefsLen 34290 -prefMapSize 245021 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e103011c-bb2f-4ac2-83c8-1c62f7aa045d} 2716 "\\.\pipe\gecko-crash-server-pipe.2716" utility
    3⤵
    - Checks processor information in registry
    PID:4812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5272 -childID 3 -isForBrowser -prefsHandle 5200 -prefMapHandle 5232 -prefsLen 27767 -prefMapSize 245021 -jsInitHandle 1396 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e44410fc-2ca3-4254-b1c2-b0782a156bc9} 2716 "\\.\pipe\gecko-crash-server-pipe.2716" tab
    3⤵
    PID:2440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5500 -childID 4 -isForBrowser -prefsHandle 5420 -prefMapHandle 5424 -prefsLen 27767 -prefMapSize 245021 -jsInitHandle 1396 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {736123db-c23c-4fe7-aa1d-a1499f965c2f} 2716 "\\.\pipe\gecko-crash-server-pipe.2716" tab
    3⤵
    PID:2056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5700 -childID 5 -isForBrowser -prefsHandle 5620 -prefMapHandle 5628 -prefsLen 27767 -prefMapSize 245021 -jsInitHandle 1396 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {05130517-6352-41a7-ba7a-c81f98c9fc4e} 2716 "\\.\pipe\gecko-crash-server-pipe.2716" tab
    3⤵
    PID:4804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5432 -childID 6 -isForBrowser -prefsHandle 6108 -prefMapHandle 6104 -prefsLen 27767 -prefMapSize 245021 -jsInitHandle 1396 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {df116d74-6396-47fb-afe0-b65d7d43f9bd} 2716 "\\.\pipe\gecko-crash-server-pipe.2716" tab
    3⤵
    PID:5660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6344 -childID 7 -isForBrowser -prefsHandle 6336 -prefMapHandle 6332 -prefsLen 27767 -prefMapSize 245021 -jsInitHandle 1396 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dd5dac6a-732e-4492-af19-82416e34b805} 2716 "\\.\pipe\gecko-crash-server-pipe.2716" tab
    3⤵
    PID:1248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3540 -childID 8 -isForBrowser -prefsHandle 3556 -prefMapHandle 3552 -prefsLen 27767 -prefMapSize 245021 -jsInitHandle 1396 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f19b6111-f88b-4c45-823a-c1c6538444c8} 2716 "\\.\pipe\gecko-crash-server-pipe.2716" tab
    3⤵
    PID:4436

C:\Games\RimWorld v1.5.4297 rev1078\RimWorldWin64.exe
"C:\Games\RimWorld v1.5.4297 rev1078\RimWorldWin64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:976
- C:\Games\RimWorld v1.5.4297 rev1078\UnityCrashHandler64.exe
  "C:\Games\RimWorld v1.5.4297 rev1078\UnityCrashHandler64.exe" --attach 976 2633220820992
  2⤵
  - Executes dropped EXE
  PID:4240
- - C:\Games\RimWorld v1.5.4297 rev1078\UnityCrashHandler64.exe
    "C:\Games\RimWorld v1.5.4297 rev1078\UnityCrashHandler64.exe" "976" "2633220820992"
    3⤵
    - Executes dropped EXE
    PID:5160

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:2656

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
PID:1104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Games\RimWorld v1.5.4297 rev1078\MonoBleedingEdge\EmbedRuntime\mono-2.0-bdwgc.dll

Filesize
4.7MB

MD5
47591bf07b6856590b5a48c1a0065824

SHA1
85e57e65664d00332cdb0bee69b17bf0ad5d1197

SHA256
771e2d5589be6670ea0232f2cc41d433c6d9597db52024018ddab3af572be348

SHA512
91d1ee2c098a2a6aa865e05a5aa873651f9226e6b5bad53296233b81619541fd5e4725dbbfce8701272979ac6b3c91e1626f31800dbfd29098868c39192b21cb

Download Submit
C:\Games\RimWorld v1.5.4297 rev1078\MonoBleedingEdge\etc\mono\4.5\Browsers\is-IN5FJ.tmp

Filesize
1KB

MD5
0d831c1264b5b32a39fa347de368fe48

SHA1
187dff516f9448e63ea5078190b3347922c4b3eb

SHA256
8a1082057ac5681dcd4e9c227ed7fb8eb42ac1618963b5de3b65739dd77e2741

SHA512
4b7549eda1f8ed2c4533d056b62ca5030445393f9c6003e5ee47301ff7f44b4bd5022b74d54f571aa890b6e4593c6eded1a881500ac5ba2a720dc0ff280300af

Download Submit
C:\Games\RimWorld v1.5.4297 rev1078\MonoBleedingEdge\etc\mono\4.5\is-JFI0N.tmp

Filesize
59KB

MD5
f7be9f1841ff92f9d4040aed832e0c79

SHA1
b3e4b508aab3cf201c06892713b43ddb0c43b7ae

SHA256
751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a

SHA512
380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5

Download Submit
C:\Games\RimWorld v1.5.4297 rev1078\MonoBleedingEdge\etc\mono\config

Filesize
3KB

MD5
d9bc824737177af5792846f26507231c

SHA1
c44835e4881d95a97b597bebff5deba0233a5887

SHA256
60099cf91bb1a5717fc1f2d23cf36a61d3bfb70d9489fbb6f4bae98c560bf3d5

SHA512
f9558f9e985643d8205b5534998412a5896bb6f5712bce5d6cf27469200eed64f29efc01936ab00c4a93625b0fc573036fba00ba2c4eb1d1d7c47555608f11e8

Download Submit
C:\Games\RimWorld v1.5.4297 rev1078\RimWorldWin64.exe

Filesize
635KB

MD5
817a479a52e13815268e175e11d26d6e

SHA1
97ddbc8fb6e7da2ddeaed3bd59632d1138fa94a5

SHA256
5dc887feb501a22bc1694c5d76846765b7f4ffb25141f7c148b21dd552e48399

SHA512
117285c5920c199080d75a858ba072f018c8a7fa40a5b9212b6cbea55eac591a0d7768e8f115bad80a9931deabedc7b853178baa8e07eaba4d34813f838f3fbe

Download Submit
C:\Games\RimWorld v1.5.4297 rev1078\RimWorldWin64_Data\Managed\UnityEngine.AIModule.dll

Filesize
43KB

MD5
633d9e1bdd84eb2e481f73735b1ee590

SHA1
5a0f7431d42d1890a521d15d1903c9d558ac5f71

SHA256
d2e03f7378cf4cd77d5d161b2988992350bff321a8706199bf96368752dea21b

SHA512
cbec73bb88027ddd16e64cc16cc068444010d22cfabf227e2da463662415896948ecfc0eb6e75d17adb00de8fcd83793c886e749564bf8503db6e90015298c86

Download Submit
C:\Games\RimWorld v1.5.4297 rev1078\RimWorldWin64_Data\Managed\UnityEngine.ARModule.dll

Filesize
12KB

MD5
29dde4171e02eb83b0954a4de54eefc9

SHA1
accfed6301a87711cb6d6610ee2161fadfc35253

SHA256
224ffc2da15de67fb2139399af3bde237fa8556a4d5ddc2e5a45a97008e7b213

SHA512
522aaff972f2e8dc63a208d29bdc235fe21a85c94631005dd2b08601dc8fcc5488c1e4dec47558cdcdbbd6020467850747876daccb73844b4a341e251fd6fbc9

Download Submit
C:\Games\RimWorld v1.5.4297 rev1078\RimWorldWin64_Data\Managed\UnityEngine.AccessibilityModule.dll

Filesize
12KB

MD5
67170f387b094bc2687567ad1c603ba0

SHA1
6704b9ed3b8bc8936495d520299d6fc41b9c4c2e

SHA256
1e5f0b96c8b5dc10c37d2267e8e07b5d246ab7f09bbd3ebfcd527cd310dd64fd

SHA512
58676f9625665722a989cb875da36e635482e6c3a1ebdb202ee814eb5660d2ca6d8122a8710768341ab450735cf83e61ddc54b01d5ec77e57fe2560231db091a

Download Submit
C:\Games\RimWorld v1.5.4297 rev1078\RimWorldWin64_Data\Managed\UnityEngine.AndroidJNIModule.dll

Filesize
63KB

MD5
6f5dbeedad6c5b97b8302bf09e11da68

SHA1
863ed28b3a37955454ed937456be6c14999fa15a

SHA256
284ee011ae20e30e66ced114ddc238c583e819cf07f6467fccb0a808f6e00576

SHA512
a10aad72ef25500f58b5eb1d9af9643005ad30e78b1abf2b5f81bb1dc402cb8c6416c01d756a683cccbe118902740ac8e31a6f44a62988cfbbe0aa20b74cb9ce

Download Submit
C:\Games\RimWorld v1.5.4297 rev1078\RimWorldWin64_Data\Managed\UnityEngine.AnimationModule.dll

Filesize
142KB

MD5
3c7e9da9c88fed819ea677b1dc2d23ef

SHA1
f15a21e03c3fede6a3d43f21158159c0867b0f1c

SHA256
4043c95960b13d221c76c287e02e72b0e089400662b54c4ee578cfb6b7d581ce

SHA512
6e220c0955ebd693bb496931ab02501826aba2bbe0099fa63f0d08763432da0a885f12efb45a4ab86f9dfeb845c7c9eec067c578fa125bd4436933fa5dba7bb5

Download Submit
C:\Games\RimWorld v1.5.4297 rev1078\RimWorldWin64_Data\Managed\UnityEngine.AssetBundleModule.dll

Filesize
21KB

MD5
686152cce0c9be778259829ee926a24d

SHA1
a52a6a40189b1af823283b3a8ebb358f491705c4

SHA256
783651cbf1a9aeb49b2a0e1a4510ef853304b7f7de4440adab2de062754e6498

SHA512
7a36d25d0ef2b46ba48b3bc875b68ad9b1feac85088353d918e4e6e464619da16aa38b93a905504343915364d38226a47a8f1ea8da8532f92c0b431319bd5999

Download Submit
C:\Games\RimWorld v1.5.4297 rev1078\RimWorldWin64_Data\Managed\UnityEngine.AudioModule.dll

Filesize
56KB

MD5
0e20bbce7d1f3827ff84008e3f586974

SHA1
6868cd8f91f488809c35aab83c9a76abd125d76f

SHA256
5efd437ecde83296153a63172bfaf8a54729d6ef49cc1a90787c670b9c436a3a

SHA512
8f984e18eceb76d67dd595fc9e32a965f45177453dc509f2371147429391c1a0a0f68d81c3803c288cbfa55e4009b2566677668211161d012607b076a1196f65

Download Submit
C:\Games\RimWorld v1.5.4297 rev1078\RimWorldWin64_Data\Managed\UnityEngine.ClothModule.dll

Filesize
15KB

MD5
fa93ee2c83c263ada2d105a507b902a7

SHA1
bc718b2365513ac4e0e59f1beb354d3b32688a56

SHA256
d2bf168458c90f4531f9a5468ac0b6064271ab701dad813a4fd1df93fb84f825

SHA512
32a36aa8d8000be9afc4ea716357edfa1d0653f2acf3d6254fb27663040bd9743202feda40379d75c298263cb0802803eb7eb2ff6a83ce66159b3db8ce86047f

Download Submit
C:\Games\RimWorld v1.5.4297 rev1078\RimWorldWin64_Data\Managed\UnityEngine.ClusterInputModule.dll

Filesize
10KB

MD5
12fd008f8770717fd6bfc3f63618b433

SHA1
b77b62f5d06cf05ab75d541e7335309e0b0f7e65

SHA256
5d22a99279aaf71f79d47c65e30936b8e6da3f354a5c34baff62266ff3fbe85d

SHA512
cfe17881bf9eeab81254f7d2a9579486a2c97a5649c3981035ff486120626879b0b1084a59588755b1e4b8d3c4e8e2b5a03c4f2b68c59d0f41789b6f73833345

Download Submit
C:\Games\RimWorld v1.5.4297 rev1078\RimWorldWin64_Data\Managed\UnityEngine.ClusterRendererModule.dll

Filesize
9KB

MD5
de7eb49ce4c01408dc2e73d5abf402f9

SHA1
eb9527d9dde55fa1114b2cc81d22de1da978d91b

SHA256
5b1cb68a9bfb1755d0a6c4d6446161f26128999a381a85c1286592298405ed6a

SHA512
ab45d92cb35c523f8db6bf63762141ee2be94ac5e0b84a96a778cb0309541caa8e74245c7eb1175eeebd1812fca1da340cbc9c69d385ded4c3b9463eead6d07e

Download Submit
C:\Games\RimWorld v1.5.4297 rev1078\RimWorldWin64_Data\Managed\UnityEngine.CoreModule.dll

Filesize
989KB

MD5
b95b8d58017e92801792165b47d88844

SHA1
bf0784e5353b051ece4f5b71a4f1588827fcfedc

SHA256
49a2fafc2ddbe59953200d0c72d7170cda9369b18b15022de16f6b9efaa786af

SHA512
29f6c1107e16e950d837737c37fce90d01001cedfc7cbf6c476489793ddf213a6f923748c1c5e6161589db105fc7ec6290e0d2312e518f742a6693ac4ac1ed50

Download Submit
C:\Games\RimWorld v1.5.4297 rev1078\RimWorldWin64_Data\Managed\UnityEngine.dll

Filesize
84KB

MD5
69c168bf692588e750a8aea0ec14ef0b

SHA1
a6882e2dcc5180dd8021fc0c3537cbe77e7deb12

SHA256
3b77d027238b284cb029db39439eb905a9c1a9fab8a62fe37859910a8d6dd486

SHA512
7cc00d728c7dd0144f0bf50ca8a80708889d647b1fa14812a10b95038f05e026d068a760c489abb6a6f443a585b76a0575e161b720a7efa3d7e6bfe07d958d00

Download Submit
C:\Games\RimWorld v1.5.4297 rev1078\RimWorldWin64_Data\Managed\mscorlib.dll

Filesize
3.9MB

MD5
459241930cb0aae5a2f6f09c8fff75cc

SHA1
4ee039a526a0a31238daaef020bfb3a813524b6a

SHA256
6b226d4b6bc520438f81a45cb478b0d13d2187ed679936bf9a2b82978198511c

SHA512
31d4ce4bdaa5073a315212febe03fbe121b6e598d2bdb9890d5cae68c9c554bca91d86f4f645eaa60488f13efb6c61721d9e5863bc80d5a487dfb4d2acd4d3c5

Download Submit
C:\Games\RimWorld v1.5.4297 rev1078\RimWorldWin64_Data\Resources\unity default resources

Filesize
3.7MB

MD5
535f7d69f0a3d1a1c7e8602e15594527

SHA1
19268d015998c2803c7d07582afd694788ba14ae

SHA256
bd8f68e6b030eda2b33279d0f759a98d7224c4ebefad2918a33f037f639b1c05

SHA512
a4a47e699f256e30137b1c85e9993627d930db3c50b046cf008e92eca6c0035d53826039ee3b955f3db632019938103c5e8a51ec3334e7301118f05c4be5aeac

Download Submit
C:\Games\RimWorld v1.5.4297 rev1078\RimWorldWin64_Data\app.info

Filesize
41B

MD5
bb0e069d0d0cb5a99505527efad56700

SHA1
13991b510d113faff41f827deb2e9bc0c7ca3de6

SHA256
0b5bf253a329ecebee0680f420050c9c5e07e667d93a4d56e24fd616f1cdf063

SHA512
916a294f39f4b5c6f3f55c83caa8c7173dd646f46a67bfb58c966234465736c3f81a4e904f35e05634501a7e3f0e68e67d7b9d08233ef1df19356884c97ab2bc

Download Submit
C:\Games\RimWorld v1.5.4297 rev1078\RimWorldWin64_Data\boot.config

Filesize
82B

MD5
3c40b942f981e5e0a54b37fdec15bcc3

SHA1
de141d86f7de6850087ee2551545d24542537724

SHA256
15f9d353f11c5a88eec9ed982e06a9a7ae3465d385b16b326aebfcc5c14f8a4c

SHA512
a02e0171ccbba8fbad8ec6ab2ca226c301274ee53b6def4a6e1f139d2a803b9477d41f7e3bae48b54066c46c1ab8131cf60fe63e37dca990e2ab5f0221794403

Download Submit
C:\Games\RimWorld v1.5.4297 rev1078\RimWorldWin64_Data\globalgamemanagers

Filesize
655KB

MD5
60b9c79812e3eecc208b69ba6906cb91

SHA1
709acdb1adeac70bc63588c99363a2830dc29cf3

SHA256
2fe8f9fcd9f33f2a2798cbfeffae338132cf5fb5712e3e92c92d84dbda05f609

SHA512
a2e6ccfc0933abc63313117e3702e1d308f789b0a3b890dd7287c42c0a62f535adc6af90e8e767f2cf1e06340ff837289f9795f52b9f1989cfdfabd9bba322c7

Download Submit
C:\Games\RimWorld v1.5.4297 rev1078\UnityCrashHandler64.exe

Filesize
1.0MB

MD5
da50e81dca440e587589396a1bffa841

SHA1
3f2a7f4f0bfe8576fb87f4acf74f2d0354ee646d

SHA256
b2748d1b54d8c7e1d88ed9e5256366a842af02c37c4000c64a2ec1f05e7b0019

SHA512
4427e0f40a9c4a886896c715c28e279ee3679b328a33d14b4718065a7e93e13467b799340f1720a341bbaaaa6cb330fa2b1ae87fc837e1ae5e5a09d4ceaf87fc

Download Submit
C:\Games\RimWorld v1.5.4297 rev1078\UnityPlayer.dll

Filesize
24.9MB

MD5
9c715b9756c8512d7223a1d508152fba

SHA1
46f54356c81d5323bb4e1e57cc4867771ce01499

SHA256
790cd1b937db9374656d637245d4da5b48149997f30d50f38da77500ec192728

SHA512
c0f3ce58df0010740b4d5c9c948ecd5d88f4825a0a83eadf77a6965839aed2cb96ebea1fac4235ec560dd1819d59d8da3aae6e2c5718e4cb3889df6779d80863

Download Submit
C:\Program Files\qBittorrent\qbittorrent.exe

Filesize
35.0MB

MD5
7a47d50bdb7a84a1fa58653f55eb2697

SHA1
fd767a6225bfdcca0537043b8f647d6ce33f7d1c

SHA256
6864e1a85198efb8ecf5f26564f7565d4d4e93f1ba7e4359bc05910ad74e83f0

SHA512
8c292a2a0bd6be2dac30e0f2cefe9bfd73aaff96e0cbb1301bba283fa8eabf378bbbc2c45667ec0cb0092e92d54bc02f054fb74b51eaa9068839225c3915d753

Download Submit
C:\Program Files\qBittorrent\qt.conf

Filesize
84B

MD5
af7f56a63958401da8bea1f5e419b2af

SHA1
f66ee8779ca6d570dea22fe34ef8600e5d3c5f38

SHA256
fdb8fa58a6ffc14771ca2b1ef6438061a6cba638594d76d9021b91e755d030d3

SHA512
02f70ca7f1291b25402989be74408eb82343ab500e15e4ac22fbc7162eb9230cd7061eaa7e34acf69962b57ed0827f51ceaf0fa63da3154b53469c7b7511d23d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
95ba0df0c4c417ae5a52c277e5f43b64

SHA1
7c3bf3447551678f742cc311cd4cf7b2a99ab3be

SHA256
fdaa82c65558793b81117a66acd5645d4072f6b71f164ed2717a17cab6e727ea

SHA512
fcb35a1949664f218ae40c25fd6eaefc4ba6417034a522f0800c50ee78e530c33080faa73ff9ea82f35749d404d6b9c94fc7e8e224689503e699a5ec2b0d5abb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b03d78ec6b6f6bfc8ce2f6e81cd88647

SHA1
014cb7dc4aa1bc5d2cb4ec25ec58470baf5b6741

SHA256
983928a84fcf0791614cc3d17d92d62ffbed0bf0f141d7544d0cc762977a3905

SHA512
4699916bdfa5776d72ad2643fad072a7a19783900608290bd1246a19624d61b58a1d80eceb74215b7198aaf04c526fa8703d38f3c5fdcc1add19b87508685ce0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
29KB

MD5
37d417677e2e1163a0ae341356b34cea

SHA1
0026cdbbb30ccf179c2e0552a0a2d63de1dd1a9e

SHA256
fc56ba252c46fd6f340e5f5b06dbd0e051ce539d393bef764d7dd4e538056726

SHA512
5d3ff9ff3843ec58503d8ccc1c73dae51c38d275f725d1183e83b77c178a33f5aad97798f99981f75cf69b6d22364cf185fd87c77fa59d71899a246beda0c2ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
38KB

MD5
bafaca24217a2c241210ad5e9d6fe4a3

SHA1
da8de220f4d108c018f40877d5393c5100f4510f

SHA256
cce90790593da21c47da782678a3e718fd34a23c386786c65d1c50b38a603520

SHA512
b21f7b7febd8c22d588e4c98358e60b06daff063d09bede0fdabc0fcbd7617ce6e8c745b7be614f0b901519c5c1e6f1c24f8ca4fbd063c4f483c8ff0b4be547e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
38e45bea8d519a1394ef42824b3e9fec

SHA1
c38d381ce03b624c4d54f2aa92f95ba07a79c4eb

SHA256
cdf8f229e7dbcfe07ddbbe642b11e39f975f23e2a6233b514ea99aaebbf3d35b

SHA512
101fba9955994f7fdb07137466d7dc5834864e5fbec9c7abfa83f568ecff39ff34b73a24833b04d6df903381a664fda4943400d158c9dac9fa744a361b167f0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
de2f15e57014bee40a3096de0c3318dd

SHA1
47efb7f6dbed7b8e1adaa6653cdb3d7c88c0d754

SHA256
35da4bafc02e8c3fa86080c54d1c287f5a340fa397ef06aa6540fe10b36aacc0

SHA512
93effaeaedd709b0665f6539555b2c32e8d97bf15f57311f7f70e358a8899e33467c7124bf2cd1dfc418b4abaeae961ede7af7e6d593931ace854a418df3905b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
1958d5190e372a4e2e8f580e41abdb0f

SHA1
d99db6e9a012642938ae0bb34f25d04162950ab7

SHA256
da14c7300afed515bb527fba6ffeddf8592fc180e3757e9814a391b8e397b5b8

SHA512
b624adb4483b78660bbb7d6d2cc18d5f8d6a93a8fbddcabaee30f0117f3b2d5bd5558cc21a2bd3c5cc48eca6859561e869aef7b0c6d372fb58e083559e08c6df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7d7bbc4d86c5d7033b968981359f9b31

SHA1
4f336472ca2ae0539769a3ce207724835d97284e

SHA256
954272ab19853bc96147f0a325cef7204664c991f54818db0e8b71bf5f640199

SHA512
3b8a334e58b974f6e1ce5c8aec37350619467e2904e508c38ed7a9f329dcca7c566f84fb3167e77bfb6de5f2d3c4e939ff86ebf13d7447966e1c28c045fdf54e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
0493f44576fd7d9b6216b7387a26543e

SHA1
47d35c7f2990ec4668ecf1c01e0e5f623153a3f3

SHA256
0679b6900e2118e17164159f449fdc1f6bf20c0cc0b056cc9aedfae42a830ca8

SHA512
a519962ffb281d471bcf63c0bf75bed19d4eeac591cf6bf8565af14dde1d57fe8cabfc05bec52b2087ce8c6f637dbefb438ce22054895dc116b31bffa18e9cd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
de79f145eba63371d5fe862a6937c3dc

SHA1
0ab4f374c5bdfbe9f3a47b32a8cd2a27d1426507

SHA256
e59f5df8fd37b8ce32faf45cc999a1fe6ffe384e88df2c1bf33f13bf09f11f4d

SHA512
37653040e747c020007d4eb9a80627965ed2a0b343e6780529d2c939d0237c9aa910e87b873090bb17e0b8a81020f13f1620f98671dfc78a7c522d8ace322040

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
1a13cf62397509bfbadf429fc922b066

SHA1
fc6fc38bf9ac12763206db6daacdaeca9495957e

SHA256
0daf5c6a8282df38d5d1c90af35cfdd4f2e19829b35ab85f66e9c62d9b793632

SHA512
3067cc55d935d6ce6c839e33bd8b91aaa8ae075675eb49591631415a6fb8e3d41568ee129c88fe10dc1cf845b916026ae368cda761a3a1d4d6b7b1161a1adc65

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\agdhwm6k.default-release\activity-stream.discovery_stream.json.tmp

Filesize
21KB

MD5
c9e08b22a9a5074dd52cf7e1785875ea

SHA1
911ea58ba5ed88bb11024d380799072f4a17499b

SHA256
ad3e47dc590e86118a4b8740786af52f8022aa495e9b6d6001e7b4f8898557dc

SHA512
cb5023c4f6e6dd3b898819b4c197c2073ef786624176ff079a5a355da38f83ea6e06958e7d340c6fa9a3ee6e2ffddf92b1fd5c55c922d9529f482cb6e2383822

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\agdhwm6k.default-release\cache2\doomed\17556

Filesize
45KB

MD5
48c39272fa3d540642144da4f33c7273

SHA1
ff695a82ffaf8156270b3441f388b0fbbfe7daba

SHA256
8b64d9dca79eebb17228fc94cbadd97fa0c650681143f1c96e5cc035afbe4e3b

SHA512
8943709e38070e7685490308b36f16a1aa1eb94c6350af35e3fa8938aa07668d35b88e416b374384c422c86ef6635b624f380bf73df1d3f793c5513df83359b8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\agdhwm6k.default-release\cache2\doomed\6749

Filesize
14KB

MD5
8b552bfc0000b0a8daa39b9d6a3def66

SHA1
154a1481bd2e3266b7602c5addec10ad6681bb47

SHA256
53a464121e0df131949f3fa7780fb6f69250f3e3bdc2b059c8cafe8808933dc8

SHA512
124e2e75bf69ff4e16b527b83862cf59f7ca57c70c57e06806d78abb26ff952b1d71f266f76e5b870075d780a7f578266daf0c095bfdb92b049b614809add088

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\agdhwm6k.default-release\startupCache\webext.sc.lz4

Filesize
107KB

MD5
7f183c2a43d619284e345fa4be399d88

SHA1
efb03410a7b404e0e0e7cd22c68fbcae044f187d

SHA256
6e46943791538d57c496656249f27bcf507f28d4505d95cb7efe586e6a0fb9bd

SHA512
784561e326cb35cc414c8c03d4e485267d2cbdec22482f1e05024ad03d3b56ae4f11ee1d53b9ef9b34d7c5b5f6b31f035222b92caaf88004fc2aefcfcb002bfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9KO2Q.tmp\botva2.dll

Filesize
41KB

MD5
ef899fa243c07b7b82b3a45f6ec36771

SHA1
4a86313cc8766dcad1c2b00c2b8f9bbe0cf8bbbe

SHA256
da7d0368712ee419952eb2640a65a7f24e39fb7872442ed4d2ee847ec4cfde77

SHA512
3f98b5ad9adfad2111ebd1d8cbab9ae423d624d1668cc64c0bfcdbfedf30c1ce3ea6bc6bcf70f7dd1b01172a4349e7c84fb75d395ee5af73866574c1d734c6e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9KO2Q.tmp\idp.dll

Filesize
232KB

MD5
55c310c0319260d798757557ab3bf636

SHA1
0892eb7ed31d8bb20a56c6835990749011a2d8de

SHA256
54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed

SHA512
e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PGHSL.tmp\RimWorld_v1.5.4297_rev1078_setup.tmp

Filesize
3.4MB

MD5
775d12ad85a682e0d41abb8782bb6de7

SHA1
8bbaf71382b93d53229df2494102534298a9503f

SHA256
a22d933123c0acfe4f6190f07d8afe170af936c317734688381ff7bd1d557878

SHA512
3c5a66bac5ede28cf9d8f411f573b55db39562716ac721f96795b81822af5d57951061f4dba728e651f5ae2b875cac4c7c22d0f5eecc899fd30c9be27fd06171

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc72E0.tmp\FindProcDLL.dll

Filesize
3KB

MD5
b4faf654de4284a89eaf7d073e4e1e63

SHA1
8efcfd1ca648e942cbffd27af429784b7fcf514b

SHA256
c0948b2ec36a69f82c08935fac4b212238b6792694f009b93b4bdb478c4f26e3

SHA512
eef31e332be859cf2a64c928bf3b96442f36fe51f1a372c5628264a0d4b2fc7b3e670323c8fb5ffa72db995b8924da2555198e7de7b4f549d9e0f9e6dbb6b388

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc72E0.tmp\LangDLL.dll

Filesize
5KB

MD5
50016010fb0d8db2bc4cd258ceb43be5

SHA1
44ba95ee12e69da72478cf358c93533a9c7a01dc

SHA256
32230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e

SHA512
ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc72E0.tmp\System.dll

Filesize
12KB

MD5
4add245d4ba34b04f213409bfe504c07

SHA1
ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

SHA256
9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

SHA512
1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc72E0.tmp\UAC.dll

Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc72E0.tmp\modern-wizard.bmp

Filesize
25KB

MD5
cbe40fd2b1ec96daedc65da172d90022

SHA1
366c216220aa4329dff6c485fd0e9b0f4f0a7944

SHA256
3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2

SHA512
62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc72E0.tmp\nsDialogs.dll

Filesize
9KB

MD5
1d8f01a83ddd259bc339902c1d33c8f1

SHA1
9f7806af462c94c39e2ec6cc9c7ad05c44eba04e

SHA256
4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed

SHA512
28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc72E0.tmp\nsisFirewallW.dll

Filesize
8KB

MD5
f5bf81a102de52a4add21b8a367e54e0

SHA1
cf1e76ffe4a3ecd4dad453112afd33624f16751c

SHA256
53be5716ad80945cb99681d5dbda60492f5dfb206fbfdb776b769b3eeb18d2c2

SHA512
6e280a75f706474ad31b2ce770fa34f54cb598528fac4477c466200a608b79c0f9b84011545595d9ba94331ad08e2f51bd42de91f92379db27686a28ba351256

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\qBittorrent\GeoDB\dbip-country-lite.mmdb

Filesize
7.0MB

MD5
d010ba919297d1fc745ab641efbd8dbc

SHA1
ee8d2ef8af0b27a02eeed771983625ba5825a5ec

SHA256
809967d054622dc6b4f58235b80bb2cc16a7689d67a217a149420318886c1041

SHA512
b919719fbdf393f7442567862893c29227597cb1372dbb4d1949e55d6514a0ad757d3374672823f3b04cad1282bb69d270e7f109b2cb1430b14a5d55fbeff05b

Download Submit
C:\Users\Admin\AppData\Local\qBittorrent\logs\qbittorrent.log

Filesize
1KB

MD5
5bfd34a9dd18571dc77f5f8833cf5853

SHA1
b316e1111cf333ab4b8925e2bba17de3fa0f08d3

SHA256
37a0b6d9b5c1c77b49a48f02f3471a863c12aa0bc1571baa4e445c835c59297c

SHA512
928723a257a55c94120a2021266198b277edb26734c2f5049894f0a857a1b333b4a044b3f1076a66819f6b37bf4e040a5a0ff3e30ba191d6782943f6f53770df

Download Submit
C:\Users\Admin\AppData\Local\qBittorrent\logs\qbittorrent.log

Filesize
2KB

MD5
f5943e7a021d10159ae96e740119c0e1

SHA1
d4331e2d324317120f3b1973626f9c35ec73b53c

SHA256
73a033d5e6d381c9520a50115f93ad5fd1746655ba7541b352a2f8158181b240

SHA512
d71bce2abcec29da3c1f1306515a8bf18d59e9fa6a550510e3951b0203fb4bc9bf1a665e716107d4b205496af9f9bf6701654da4fa80e1d66807bad6c0fffb43

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
5d34e011b9d238f9a7297a36d48578dc

SHA1
c886e507f190fcf9bbc6f0e8b108b73ef8fd8e5f

SHA256
c898d09718df30e9e12ae05d24b50bebe3d70a76f39df013f69bfcf200bc198f

SHA512
51b64834c088d2bcf797e25edece19c6401d47cb1e6028b7ea47449ffb9ae86c9ad440906fe51c79dc2cca744bd408c932045b36b8f55cce6c6e4fdab6f71413

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\AlternateServices.bin

Filesize
16KB

MD5
93b2bfb3baa20e48f929bbb8144f6bd2

SHA1
8950622df524c0622dfb4517c09d50a846edd2da

SHA256
61e9ff07a57299ac715a0413532fd0d7b9fbcb7fd3388a60ec570fe59907a6cf

SHA512
592133d7adaed8b99fae6d49db0dcb80cc56364203c51238d1d7c70f010c710a04b6c187ebbc009656e5d8fcf77d503d99c01616736dd7151d6c404c0eabf899

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\AlternateServices.bin

Filesize
8KB

MD5
8ccfaf33137b026e387a3799e8b08f35

SHA1
0c485af869620d612e2c03144556d5824a14af7e

SHA256
adfe642b696896480b4f4cd15127cbddc073ff3806999847f47ae7fadb643e1a

SHA512
5aeb33e2c20b0e0501dc89a7c4c6eaa5679eb9ba80c91aaa350417956c50fc7674de551573633b409009d046980bc943f5104cd4b56de85f7624fa34e2a2ca17

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\crashes\store.json.mozlz4

Filesize
66B

MD5
a6338865eb252d0ef8fcf11fa9af3f0d

SHA1
cecdd4c4dcae10c2ffc8eb938121b6231de48cd3

SHA256
078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965

SHA512
d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\datareporting\glean\db\data.safe.tmp

Filesize
21KB

MD5
14f5e3edc206044f9783693cd4046d92

SHA1
e1394d97bfb88c4d1b9ccd12df0f9f308c8da070

SHA256
d5beaa6a462f371c6397a1028839ba9c36b26d66060911b2b2a8a3bd4716f652

SHA512
3850b1d4e23f0d5c1a67df5b44f2620b2f0c0f219113fdec90ea04da520fbd8fc806695fccd22e2fb89a94672e82f84fa6f2d8729ee448d630e1fd2473096cac

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\datareporting\glean\db\data.safe.tmp

Filesize
21KB

MD5
185902d672433c2c4e106118ed8e9869

SHA1
f7e0be6f49adb8494c529f92c4a3f2074ccb0b17

SHA256
19bf514137aa8580bea55174500026559f8fc94738717cf353cfbdc79a3a84a2

SHA512
ccf6d5ba1124ac2fd4aead019cca885623ad9f6b4919c494c6cb9ff08900d4cb4c7b96157983aa856b045b1260de4828044ac2aba39a8bef311829110b9c6b26

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\datareporting\glean\db\data.safe.tmp

Filesize
39KB

MD5
7072769a8d1d286c464e3374148040e0

SHA1
e2f98f8bb51166ca6b67cc1bec82c92dd9802f42

SHA256
16f07c0100e5aca2807e26ffb421a175b512ad660981e5284e711cb7306ec74d

SHA512
48c6cb4fdfd565d9d660d22e1b24f0bd8e6b94479daefac2b3d60e5df851b144958897aaf892f6d85f001f8db2f0d6c85489adea17460961a307b4e3810b5d67

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
3b18642c7d32f88e6d97ee0080266db2

SHA1
d0a3c96f95d4ec58a79299660038c3d364304ff0

SHA256
69baac21f7a9123c746d6acd13f1b1c7fa19a4872788d5018222ec1ecb1b80ff

SHA512
1513a233ddf77e0e6deb1353390800cb08188e2870ef430b6ad2f250e672c032f15332fe2497802799a954dca44da10f179e4a43d84b843684d00710dc4033ac

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\datareporting\glean\db\data.safe.tmp

Filesize
54KB

MD5
92e9a6c65ada18d14ec25cf2640389fb

SHA1
749aa06daeca58c0015a9514b33c9c11c1ac22b9

SHA256
81361c7182fe8584a22616c827d3cb2a6548e763500fa7661fd087f73c7d9bbe

SHA512
f5f48e1d6a50d8174269a7841c82fa15b05c7ae5c8a77546fff7ac80c116a5bff183ccf2e3ed5fe134a74eedc669cb03db842a540ab197d165dc236ad057e033

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\datareporting\glean\pending_pings\0b0b0860-4fdb-4cb7-9138-642bca122927

Filesize
671B

MD5
3091a314cffc45a0c2d571c9ce993713

SHA1
6c58814274809563c2b6f9604533b0b44e184378

SHA256
2fcd640e4116d056a6b4ff13e5085378483a496c3b218999765b945443afe8d9

SHA512
f42f482585b541635a0c436450c31896ce2cb4ba7eb36d50528caa660149a89f0335232e40ee20900fa4d8f2cff91b8371d3e8ac5128a6fb285971fd6820ca67

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\datareporting\glean\pending_pings\25ab46b0-0d01-40fc-96bd-607f00ccc363

Filesize
26KB

MD5
a32b7ec5de89a70c085ec47c63a07c4a

SHA1
ae21227ce63aa15cfdd7474fec4b98b8dbb47a8c

SHA256
c4944da36add2ce617e8ba3c5a5f6cce4170325e765d51d2d9d1f20f99b6ffa0

SHA512
e0ba3d6dd35708953d6dd3888ece9e1c6b503d48e1d8a1979091d1b8747bfa49f9e94d5e063e39a11efd5e710940f614d5c3fec567cc0af999eb9907088fcd93

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\datareporting\glean\pending_pings\6d85c96b-e556-454b-8c0c-3874be0b5c07

Filesize
721B

MD5
cfdfbf20043c47f56cd8e0fcd9450a5a

SHA1
ff0168ec6415a27ea3624c059ae08f48f1f74fa5

SHA256
36d72777390ad50154440a3f9a149b6337d4d489b1041e112cbda5a7dc0db87d

SHA512
9fbc96003dedfd99246e70cdcf34c0cfa125a5798dcf9dfd0c5ab562a60bad6ace4f11e314bb84c40d8a11cb2d975d4cb9d113b9e3572db445736af1b16d988a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\datareporting\glean\pending_pings\cbf0b8ec-00d5-49e3-99d0-48a78989f6ba

Filesize
982B

MD5
ca200fc0b911f71361fa4c8e9fa24407

SHA1
66d6f79f40caab32af77ea1c4fc44d2c0cbbdfb8

SHA256
1076b2ab25c6fd18f14059f311e044e51a0016f8726bc89486596eb76c374049

SHA512
55a11a7f72ee18030a6ab853d2fe831401b685ff501866e95f8240e7e9bb80cbbed149ec66dded84f53ec59a303ac224318fd6031d0a5e1b0a8a3a47af8dfa2f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\datareporting\glean\pending_pings\d115a3e8-7949-4106-9f1b-871447258d77

Filesize
15KB

MD5
d73a90a84aa6c745b641f18617fc0c83

SHA1
0516d72dd156367410e8970fab65f33db7f01bf4

SHA256
11fd0cf7e81e581401d70eba61263851548adb56cb4dcfd3d1c927760106e62f

SHA512
b6ae995fb11d68ac85c6b43e2b6976672338fa0d6495357bb729f2837f29ee8331785936dfcca28b2adbc3b6de59280f8a76f4014ab9522ec803ac63696143a3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\datareporting\glean\pending_pings\ea15cd15-8df0-4bfe-8c80-e8ac0a2e2e9d

Filesize
1KB

MD5
03771b2cdb3ab5c3f2193636790d8dd6

SHA1
3c95bfb9d0fb7842b3922e57c2978a7b707e5f33

SHA256
481cfb2dcaa2988cc3a42347345ee34e603688448a1a79167f95fcaa4a8ef942

SHA512
bce545e5c1b0d92b59d5f09c79cca6cc998ecdb77f8299e2613f48313d3bbbb13bfef8a879c9ba27d285d583fc1988ad9b54bff6a2cb25d186d207d3f2d2c68d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\places.sqlite

Filesize
5.0MB

MD5
df5b13aa3b61d6b5accfc1fd375ee3b9

SHA1
2da5782820022c12108c2e5ab97752334cc214cd

SHA256
2fa6498d53c4f6db83d021318781b159192d85382dc59fc8c617c7f5181b5864

SHA512
79d81be02fa67ce887f7efeac111e9b2faa4bf971667de7b0320eccbd7a1f09cefc3ea70f4e2623b918b7c9c2975d506eaeb515842f18570f092a11b56fd4bad

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\prefs-1.js

Filesize
10KB

MD5
f34e8b815113d1a8a732f7391c9b2040

SHA1
5b8118c4a06e1b22d27bd66db288681c25ebf16d

SHA256
b43f04e63586d47f4fa144caed08a50b611503425be8b3763779e5b837af6e4a

SHA512
fad1f10787f4b9250cd59f97d4410f00dbec55c0b651c5eab9dc43b76e83eb50dd6ae6c3fecfa1e56dbccaca95b3e58e5d52b5c2ab357341a94d08eac867c938

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\prefs-1.js

Filesize
10KB

MD5
caa2c567c095473ba518135c857d13f3

SHA1
7c7ec38db3ebc7add6e02eaa98081978c2d4aca9

SHA256
44597a72a8325bd9341755c0be141db57ec1532d560949672f6f2563f39f0c7a

SHA512
376d667956409013894349af1b9670c02da2b1bf978f79c214c7adc477ff2c2d839f3279d32b45474ddebdafc62877ea4c2edb9a2c01cfaaae89ebfd25b10389

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\prefs-1.js

Filesize
11KB

MD5
d644942002f0509d94e95a37f67f8f31

SHA1
83febd4e85b8aa7af65a6e7a7cc8e90a266a8a94

SHA256
91b84d27f1b37ec88cfc14fe876b9386612e8cc9a37eef1f2c7d780dff116c07

SHA512
73d4bfc02d4a870d86bfbf81635e457aa0e882989a59d63aedebd382fa9ce8bd2f3aaf84147df96fc5b6e571abcf0a88692736707dfb0b8b8f210ae7de44a3ee

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\prefs-1.js

Filesize
11KB

MD5
b370f5b46dc04a058206dccb666093f0

SHA1
f3c0194fa69b1086d20779e3281908a5a8a8658c

SHA256
a78c0bb25eaad1207736c6e9d8059acc27731d9e2ff43810f9d245b4778099f8

SHA512
2bd0b18fbdb1f8d1e728fa8cd6775ecc75f414a2448c7bbe8cb70c48e0eab0b122c6f319252c3e293cf6be9953116accfe3182b31ce0d994fcee54643bd3e2ab

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\prefs.js

Filesize
10KB

MD5
f6b65ddb82d5dd32724a2a80cbbbc724

SHA1
038be502119bb82a227c25c74df82db58e7de68a

SHA256
27aea7c19167c02f99e6b4ff2b66a3925e2e197f2caaab3508e603ae081f4f7a

SHA512
5ba5b022c2b61e2608418964350976b9b94fac450db66c44aeb18c43ea894023fbb68efefa6c5de079d507ef28f8168bd8468c29ab23c338eaa31f494152f9fe

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\prefs.js

Filesize
10KB

MD5
4c36da1b00dcc5ca4aecb7036f0c1a00

SHA1
0d785f70338bb673d93378b5e8cea026d5335b29

SHA256
7aa6369b99a2552007c566abdc93d3213217f548431bc1eafd2101fb252383d0

SHA512
f4311996fc672e4b3319e981c22be08a6450fd151f3665aee5a3c6f03cd5e76418a19f6f454d1abf6afb925efb9ee9fe6beef942396f74227adb1bf3b40d9da9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\sessionCheckpoints.json

Filesize
122B

MD5
99601438ae1349b653fcd00278943f90

SHA1
8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9

SHA256
72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a

SHA512
ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\sessionCheckpoints.json

Filesize
53B

MD5
ea8b62857dfdbd3d0be7d7e4a954ec9a

SHA1
b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a

SHA256
792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da

SHA512
076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\sessionCheckpoints.json

Filesize
288B

MD5
948a7403e323297c6bb8a5c791b42866

SHA1
88a555717e8a4a33eccfb7d47a2a4aa31038f9c0

SHA256
2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e

SHA512
17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\sessionCheckpoints.json

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\sessionCheckpoints.json

Filesize
146B

MD5
65690c43c42921410ec8043e34f09079

SHA1
362add4dbd0c978ae222a354a4e8d35563da14b4

SHA256
7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d

SHA512
c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\sessionCheckpoints.json.tmp

Filesize
288B

MD5
648ea624280e409ac3a7f120b5e9000e

SHA1
168bd9dd85eb0603e0db6bef23a0df64f916bf83

SHA256
ea208bf36fe4e150165db9ff5972004c6f468114058d6dbe5d0350f85e8fc08a

SHA512
49520e85cd86cdb0b9fcefecaabc99ba3915ed5ce0b622ffe752de94df6d1fbf3f2fbae13ee18397b32477aadfb23280e42be6f92ec1c74feb4f246c60eb7e32

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
e92253b9608655a0ec23fc43748eba0c

SHA1
9f99ae2847570ba81fe77ec1d5fdcccffdeb646f

SHA256
9b1a831bb790fa9895a6d28cff9f2f5e2ffcce83d02a489cd62b21ccbb6d82cb

SHA512
9c452bfc74404935a7a4367d6725dd4d5139c02de80ebd97328378d5d7a3d66ef271e27ff0d7c6b239de127121c4145ccd13a97a9276d1493218c63e453d4e1e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\sessionstore-backups\recovery.baklz4

Filesize
2KB

MD5
0cf28ea23367f7023df14dee20a0b572

SHA1
ae9bf05c164e185b93a7f916501178dabad353ea

SHA256
27053ea916348d7ec40612838397a2815771012257dcfa2b1f3967e429cd2c5c

SHA512
c0ef9793c0beb2a5fd3344248b74c9c0453a433be1cd4da95f1e3b4b56f5793021471d7a1875ca2546f53663d79eb870b013af20a015c18b214e5a707b49367d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
6f40f76ee35f4e7c879817607aae14d7

SHA1
0edb4059d08f1fc7b02b62297d2138aaf0de8f40

SHA256
cc703f04e96f981b680262257b08744951a0fc6d40968977725ae55bca03b459

SHA512
b5e68019af0d1635f9d6beaada3b4812997ecbcf4e029e8b8f9190c22376e09ba2ae5124b78701e1c3568219303ae4bb81c65b355f3bd75b555156d62a0a925b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
2cdb9de0aed2e83e3d37ae00e877faa0

SHA1
c699cbfa3bd6fe89359ad925931196e855948652

SHA256
8ab05f362b62852fcef81d5f23d370d4a558693f688d1da25cbfb6a85ad4cce9

SHA512
f92caed8a178395772f5deb099bf96e4072ca57b1796028b8fa98a04056640bdb115280b5e5e014d0754dbb3b6ad2fe8fef3fe1d394333d7105bdfcd24283c9d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\sessionstore-backups\recovery.baklz4

Filesize
2KB

MD5
d9e660ac73d0c8d0274d0fa9675adced

SHA1
5eb93676a335cc214ac41a8ca5398979ef151879

SHA256
5b7291ac654c3342baf08a086387d8b4693b47c9750ed59ab3f8f31811484beb

SHA512
84e6b091e4d3c723e3aef6605c03bdd88de83b01b4ea58158e7d57a19d2e10eace1afbb81a1ca9f0df732c97e45ae36b25525eec102e36d36f76722b8b630ed5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\agdhwm6k.default-release\storage\default\https+++www.virustotal.com\cache\morgue\197\{f02892a8-7044-431d-9e0d-d6c2d44cb7c5}.final

Filesize
50KB

MD5
633187aab37bd1089b24031bbe287e7c

SHA1
0447c0424727d95816e0eb43821e6ccd19e38cbb

SHA256
c7e4efb4966916c975ab9ecfcc776301b2825f50b372748a13a7d01dd238ecab

SHA512
5c54f6166ca5946539e83161457559c6e8e726c430096ca675399584fec19b8f0898c27b612c83b0d46394beb43d89fe54f454bc26a090ef98b2efab91928614

Download Submit
C:\Users\Admin\AppData\Roaming\qBittorrent\categories.json

Filesize
4B

MD5
5b76b0eef9af8a2300673e0553f609f9

SHA1
0b56d40c0630a74abec5398e01c6cd83263feddc

SHA256
d914176fd50bd7f565700006a31aa97b79d3ad17cee20c8e5ff2061d5cb74817

SHA512
cf06a50de1bf63b7052c19ad53766fa0d99a4d88db76a7cbc672e33276e3d423e4c5f5cb4a8ae188c5c0e17d93bb740eaab6f25753f0d26501c5f84aeded075d

Download Submit
C:\Users\Admin\AppData\Roaming\qBittorrent\qBittorrent.ini

Filesize
1KB

MD5
571c2f701ec8a3ee698708fbb2cf0eb9

SHA1
272f642cd9e8a6645abdd0fb7b2ce6026b4d165f

SHA256
23272090c8fe4aa9eca8bb0eaa4553d49969423126d5292caa49a887fd863cce

SHA512
f0b43f7aa6f1a8b1ae3719c5de85c550652f168ddfd6b90688512f6353da939be3ecfb8bb8901867bf955ba53b8f65b8131c47e8a92e03092c14587b7fb45040

Download Submit
C:\Users\Admin\AppData\Roaming\qBittorrent\qBittorrent_new.ini.lock

Filesize
64B

MD5
7de68e60a1e6a73d0a9d4a8f91d69cde

SHA1
6b6cd79d69bd266e3ab458a4af95dc93330e4a2f

SHA256
6f5a2ba3cdec3a4a6e453d755df64088f1085d6eaa1a0e358edb1360dde43097

SHA512
dff325370c2fc62af86eafa52ed32e0118cda30880e1b9672e2f2938991d1aaaad4831dd8eee88b74a0e7d8981f4478e30597fcb66ddf5045e83c7d397e802f3

Download Submit
C:\Users\Admin\Downloads\RimWorld_v1.L0iV8VOs.5.4297_rev1078.torrent.part

Filesize
9KB

MD5
017e44cd518105c54d6eca64509c45f3

SHA1
23287b82f1551c0fefb8facd90a1696a6ae45e9e

SHA256
53fc5e05ac79bd58f4a95049f07350cc55ecd7002ec719d50731776e7c6638f4

SHA512
ff252d18993a05b59556ceb612b8e2c8c7970e6aade1be8cc2aafd4cc2f70f11663f54341597c42e26730b268253cbad23a4fb5235817d1de32b0c5e1acd5cfc

Download Submit
C:\Users\Public\Desktop\RimWorld.lnk

Filesize
1KB

MD5
ecc30e75ee0fa4e6e75eb05144452973

SHA1
18e85db354315cb402373b44c3f38c826fec8545

SHA256
4e5dbcee7838c0127f1c7028ff371f987f79ac1704b8caf43ea0f1086380b107

SHA512
d2a759c3df4b16af2926454215c57347e7b7b28129f331e5f84c84c14dfe45e172c5e8125f5e075ab782b6487eb0b795640c7eb6e5e1d4d7d89d235857b5d304

Download Submit
memory/976-5636-0x00007FFC7DE10000-0x00007FFC7DF23000-memory.dmp

Filesize
1.1MB

Download
memory/976-5632-0x00007FFC7DE10000-0x00007FFC7DF23000-memory.dmp

Filesize
1.1MB

Download
memory/1736-5030-0x00007FFC7C120000-0x00007FFC7C233000-memory.dmp

Filesize
1.1MB

Download
memory/1736-5036-0x00007FFC7C120000-0x00007FFC7C233000-memory.dmp

Filesize
1.1MB

Download
memory/3288-952-0x0000000000EA0000-0x0000000000FB1000-memory.dmp

Filesize
1.1MB

Download
memory/3288-973-0x0000000000EA0000-0x0000000000FB1000-memory.dmp

Filesize
1.1MB

Download
memory/3288-4715-0x0000000000EA0000-0x0000000000FB1000-memory.dmp

Filesize
1.1MB

Download
memory/5388-975-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/5388-4317-0x0000000000B90000-0x0000000000F00000-memory.dmp

Filesize
3.4MB

Download
memory/5388-4714-0x0000000000B90000-0x0000000000F00000-memory.dmp

Filesize
3.4MB

Download
memory/5388-4272-0x0000000000B90000-0x0000000000F00000-memory.dmp

Filesize
3.4MB

Download
memory/5388-3115-0x0000000000B90000-0x0000000000F00000-memory.dmp

Filesize
3.4MB

Download
memory/5388-974-0x0000000000B90000-0x0000000000F00000-memory.dmp

Filesize
3.4MB

Download