878ca7e3fb7a90a937afdbe080c055877b4c6334a9589d27e092fd6737a0716f

Resubmissions

02-02-2025 21:49

250202-1pr2razjas 8

Analysis

max time kernel
517s
max time network
521s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2025 21:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

qbittorrent.exe
Size

35.0MB
MD5

7a47d50bdb7a84a1fa58653f55eb2697
SHA1

fd767a6225bfdcca0537043b8f647d6ce33f7d1c
SHA256

6864e1a85198efb8ecf5f26564f7565d4d4e93f1ba7e4359bc05910ad74e83f0
SHA512

8c292a2a0bd6be2dac30e0f2cefe9bfd73aaff96e0cbb1301bba283fa8eabf378bbbc2c45667ec0cb0092e92d54bc02f054fb74b51eaa9068839225c3915d753
SSDEEP

393216:FW2SJNQ3qUQh9yIB8XPxjCzzwre3kFkGVIe760wTxw1FH88qPd6AKFdu9CwJsv6f:p+bzT3kFkpeKTxwFqPI5m7

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Contacts a large (1817) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Downloads MZ/PE file 1 IoCs

flow	pid	Process
4820	1804	setup.tmp

Executes dropped EXE 3 IoCs

pid	Process
1160	setup.exe
1804	setup.tmp
2044	FlushFileCache.exe

Loads dropped DLL 18 IoCs

pid	Process
1804	setup.tmp
1804	setup.tmp
1804	setup.tmp
1804	setup.tmp
1804	setup.tmp
1804	setup.tmp
1804	setup.tmp
1804	setup.tmp
1804	setup.tmp
1804	setup.tmp
1804	setup.tmp
1804	setup.tmp
1804	setup.tmp
1804	setup.tmp
1804	setup.tmp
1804	setup.tmp
1804	setup.tmp
1804	setup.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	qbittorrent.exe
File opened (read-only)	\??\F:	setup.tmp

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	F:\Until Dawn [FitGirl Repack]\MD5\QuickSFV.EXE:Zone.Identifier	qbittorrent.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FlushFileCache.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\NodeSlot = "4"	qbittorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 = 19002f463a5c000000000000000000000000000000000000000000	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac04000000c8000000354b179bff40d211a27e00c04fc308710300000080000000354b179bff40d211a27e00c04fc308710200000080000000	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\MRUListEx = ffffffff	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000000000001000000ffffffff	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "3"	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "4"	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	qbittorrent.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Until Dawn [FitGirl Repack].torrent:Zone.Identifier	firefox.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
760	qbittorrent.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1804	setup.tmp
1804	setup.tmp
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
760	qbittorrent.exe
1804	setup.tmp

Suspicious behavior: LoadsDriver 11 IoCs

pid	Process
2344	Process not Found
5344	Process not Found
5712	Process not Found
464	Process not Found
4412	Process not Found
812	Process not Found
4828	Process not Found
4436	Process not Found
4456	Process not Found
964	Process not Found
5980	Process not Found

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	5092	firefox.exe
Token: SeDebugPrivilege	5092	firefox.exe
Token: SeDebugPrivilege	5092	firefox.exe
Token: SeManageVolumePrivilege	760	qbittorrent.exe
Token: SeDebugPrivilege	5092	firefox.exe
Token: SeDebugPrivilege	5092	firefox.exe
Token: SeDebugPrivilege	5092	firefox.exe
Token: SeDebugPrivilege	5092	firefox.exe
Token: 33	5116	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5116	AUDIODG.EXE
Token: SeDebugPrivilege	5092	firefox.exe
Token: SeIncreaseQuotaPrivilege	2044	FlushFileCache.exe
Token: SeProfSingleProcessPrivilege	2044	FlushFileCache.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
760	qbittorrent.exe
760	qbittorrent.exe
760	qbittorrent.exe
1160	setup.exe
1804	setup.tmp
2044	FlushFileCache.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 5092	5060	firefox.exe	92
PID 5060 wrote to memory of 5092	5060	firefox.exe	92
PID 5060 wrote to memory of 5092	5060	firefox.exe	92
PID 5060 wrote to memory of 5092	5060	firefox.exe	92
PID 5060 wrote to memory of 5092	5060	firefox.exe	92
PID 5060 wrote to memory of 5092	5060	firefox.exe	92
PID 5060 wrote to memory of 5092	5060	firefox.exe	92
PID 5060 wrote to memory of 5092	5060	firefox.exe	92
PID 5060 wrote to memory of 5092	5060	firefox.exe	92
PID 5060 wrote to memory of 5092	5060	firefox.exe	92
PID 5060 wrote to memory of 5092	5060	firefox.exe	92
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 4852	5092	firefox.exe	93
PID 5092 wrote to memory of 3536	5092	firefox.exe	94
PID 5092 wrote to memory of 3536	5092	firefox.exe	94
PID 5092 wrote to memory of 3536	5092	firefox.exe	94
PID 5092 wrote to memory of 3536	5092	firefox.exe	94
PID 5092 wrote to memory of 3536	5092	firefox.exe	94
PID 5092 wrote to memory of 3536	5092	firefox.exe	94
PID 5092 wrote to memory of 3536	5092	firefox.exe	94
PID 5092 wrote to memory of 3536	5092	firefox.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\qbittorrent.exe
"C:\Users\Admin\AppData\Local\Temp\qbittorrent.exe"
1⤵
- Enumerates connected drives
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:760

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2044 -parentBuildID 20240401114208 -prefsHandle 1956 -prefMapHandle 1952 -prefsLen 27188 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {14e1a8f1-e4c0-41e3-b46c-4bfcbe12b2ee} 5092 "\\.\pipe\gecko-crash-server-pipe.5092" gpu
    3⤵
    PID:4852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2440 -parentBuildID 20240401114208 -prefsHandle 2432 -prefMapHandle 2428 -prefsLen 27066 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1c8f032f-2914-4907-bf2b-9d7fc4345fdc} 5092 "\\.\pipe\gecko-crash-server-pipe.5092" socket
    3⤵
    PID:3536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3260 -childID 1 -isForBrowser -prefsHandle 3108 -prefMapHandle 3220 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1044 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f67a06f0-43cf-4374-b989-a60bae201db7} 5092 "\\.\pipe\gecko-crash-server-pipe.5092" tab
    3⤵
    PID:3848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3900 -childID 2 -isForBrowser -prefsHandle 3892 -prefMapHandle 3888 -prefsLen 32440 -prefMapSize 244658 -jsInitHandle 1044 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0484e094-2f76-4bf9-a089-f096f86710ec} 5092 "\\.\pipe\gecko-crash-server-pipe.5092" tab
    3⤵
    PID:4424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4736 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4788 -prefMapHandle 4784 -prefsLen 32440 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2bb1ff92-e186-4b38-8197-96555b92454f} 5092 "\\.\pipe\gecko-crash-server-pipe.5092" utility
    3⤵
    - Checks processor information in registry
    PID:5128
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5248 -childID 3 -isForBrowser -prefsHandle 5240 -prefMapHandle 5236 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1044 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a238375-1fc7-4bba-9365-d2d79080180c} 5092 "\\.\pipe\gecko-crash-server-pipe.5092" tab
    3⤵
    PID:5856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5368 -childID 4 -isForBrowser -prefsHandle 5328 -prefMapHandle 5188 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1044 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {05c10467-b562-473e-a330-fd807331c82c} 5092 "\\.\pipe\gecko-crash-server-pipe.5092" tab
    3⤵
    PID:5952
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5568 -childID 5 -isForBrowser -prefsHandle 5524 -prefMapHandle 5348 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1044 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd884991-7a32-4d61-9870-4a0e7365b7c0} 5092 "\\.\pipe\gecko-crash-server-pipe.5092" tab
    3⤵
    PID:5964
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1308 -childID 6 -isForBrowser -prefsHandle 4700 -prefMapHandle 2584 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1044 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {139637dd-3298-42bd-848e-113a7fc625a9} 5092 "\\.\pipe\gecko-crash-server-pipe.5092" tab
    3⤵
    PID:5368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4260 -childID 7 -isForBrowser -prefsHandle 6616 -prefMapHandle 6612 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1044 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6ef55564-966f-43c1-9207-0c77c1e697d3} 5092 "\\.\pipe\gecko-crash-server-pipe.5092" tab
    3⤵
    PID:5380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4708 -parentBuildID 20240401114208 -prefsHandle 6744 -prefMapHandle 6500 -prefsLen 32699 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce9715fe-1cbd-4c2d-86f6-e4f72df47c68} 5092 "\\.\pipe\gecko-crash-server-pipe.5092" rdd
    3⤵
    PID:4528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6916 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 6892 -prefMapHandle 6888 -prefsLen 32699 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6a6299cd-c930-46bc-8018-590c0aec3d5b} 5092 "\\.\pipe\gecko-crash-server-pipe.5092" utility
    3⤵
    - Checks processor information in registry
    PID:4200
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6284 -childID 8 -isForBrowser -prefsHandle 4468 -prefMapHandle 6388 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1044 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bed459b2-1d32-4a60-8b94-eb31fb109ce6} 5092 "\\.\pipe\gecko-crash-server-pipe.5092" tab
    3⤵
    PID:5612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7288 -childID 9 -isForBrowser -prefsHandle 5364 -prefMapHandle 6284 -prefsLen 28044 -prefMapSize 244658 -jsInitHandle 1044 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f1b2fe1b-c55b-4532-bb27-82041e4a7e4e} 5092 "\\.\pipe\gecko-crash-server-pipe.5092" tab
    3⤵
    PID:3480

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4024

F:\Until Dawn [FitGirl Repack]\setup.exe
"F:\Until Dawn [FitGirl Repack]\setup.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1160
- C:\Users\Admin\AppData\Local\Temp\is-A6189.tmp\setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-A6189.tmp\setup.tmp" /SL5="$4032A,4106640,140800,F:\Until Dawn [FitGirl Repack]\setup.exe"
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1804
- - C:\Users\Admin\AppData\Local\Temp\is-ID9EH.tmp\FlushFileCache.exe
    "C:\Users\Admin\AppData\Local\Temp\is-ID9EH.tmp\FlushFileCache.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2044

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3cc 0x294
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yimk2141.default-release\activity-stream.discovery_stream.json.tmp

Filesize
21KB

MD5
950632557595579b209b5aea1d215e14

SHA1
220aa5e1dd0b5a2ae17496adfff37a5c79bb1309

SHA256
265cb52dc237a8948e1225938142a4b50bbdc2e9bd0446a2bc9642fd9b24854b

SHA512
93bedd1342a24eaf9a98a5f115de98ec5e0832bf2e2253dde212254b7ea9ea635ecde0b504b9b37f65b853af7102c6f0dd6603b0838ca46f52b0c680f2c2b926

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yimk2141.default-release\cache2\entries\18DD2C03FE1BCFA04785C9DD64ED339AD6C3F609

Filesize
116KB

MD5
10965f40a6c3dada34f4536811b96b21

SHA1
d0d723fabbdb740f56009e780d316e54dbf0e92b

SHA256
3d04d9525874db16bb5676c626b25c40a405f7014cfa4537d01ef9a438d975ee

SHA512
4d7862417e3d5c92828ce650e92ad6d7dbb59168f0b933eac0ff6fc5889ed6ac957358c415207e77695cc5a6bfd5e2389d4cc6126776ba77cd2f2f9ba727fa7a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yimk2141.default-release\cache2\entries\2244FCA9BC622EDDD30CFA97CA2DE594DEBB40D5

Filesize
62KB

MD5
b73eef0de92ec1ffd17b69e900aec504

SHA1
a6687ec45c97d976a9a43086787dc91b833bf038

SHA256
f367e801014f9d0ceeb17f84149f024dd8ea3a98f6004c5f8fdffe02077748c9

SHA512
0006ce169ba58cdb76d31b1e76f5285d83178b98e5b3915011790ceaf421ee46030dc6e2ea8f61e27b70094967f35b1c8218eb012c253080ba3ea4b8bc889f82

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yimk2141.default-release\cache2\entries\342886894B084E1600401A58A8BED109CDEC19BF

Filesize
1.5MB

MD5
0e50fa676c252d2ee8c6974d9972aaa5

SHA1
df2e2e72b1c595edf4bb4735893c10e84cf4541f

SHA256
ece521a6fef2b7ffc909fe638601d986aa154a6a6643eae1874d50e690b3b3c2

SHA512
ebdc22c71e06c2b76f5f62a9683023de7766447a5c2db9ee0e133e2826722d51037f6162c4bf3a000a5d7c8a89bcc927025e29d2c925582af00f34a422742201

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yimk2141.default-release\cache2\entries\41E0E23A201F0235EE703675384BB2E71AF8836D

Filesize
13KB

MD5
82a014f965ad6d4ff3a58e5f375a70cd

SHA1
6fcb33d1298b537b79dbe792183a87852d447b77

SHA256
d8be9d2b8d5cd41662655f713883ca19ae5c0ae3633ca0a16d2ae3e4a433e9f8

SHA512
b21b9d9e49a53f80a0185b2702b640b2ba2930af514de6cd8c72a1ec42c12c2fc6a2ca615be74aba5d1b9e1834e5b770bad440fa33cf28012247e06f41d7c324

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yimk2141.default-release\cache2\entries\56DB77DEC81CF81EA58556FE381E7A16F1C104D6

Filesize
135KB

MD5
5d3116dbce5ace4cab0b077f6e6e0abb

SHA1
9fe5bd2b1aee930af7fe99f88778c2ae79c4fa9d

SHA256
1f3b5a3dd00eb61a18b8d225f55c7aa269b7db14b11dbe00ea2ec5fd9e975c2a

SHA512
5ad2b17a341205c782e4654cf75e9c87d76061a2a8ba21b68854e0726090bc10cbe8c3abd098f2a535fc15e68393be7e3d85626ede8fe9d470c3693bb362ef96

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yimk2141.default-release\cache2\entries\5FB09AC291F7EA67CD456F895CBC8B6F4E2D5E0B

Filesize
9.9MB

MD5
7dcb867fd54a043a09e26dc4d7834c6e

SHA1
d2aa4611f4ba90f4404434491783c97a79827037

SHA256
e8b65cf4e88e693ef609d91a94c6adf4df81196763af8bbb48fe503e7fa5c2f4

SHA512
7fd80331b0f9d22e360472c03cdf91f628f42c765313c3406b9228eae199b4b33d6ea501f6fdbb2bfba1664ac6c80832809a6d3b6bd0c12248316318cc342774

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yimk2141.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F

Filesize
13KB

MD5
5cd37d687aa2d68ac6dd5c0617ea8725

SHA1
8a9ecf214473f76a61fbbcdfbf84528d55ff6e42

SHA256
1877daae20d556e88602597802909001cccf717098538d39e72cb35752f67d85

SHA512
0d1246608222ad4a2ffe78ab790abc3cc698896ea1244b3862041f780f37594ea5ddbc5f4cfd2be2bd3edfa438f3015acf38d9f8e5de8647e716fc54215d42af

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yimk2141.default-release\cache2\entries\77B924A371537D489341CFF467FB022A3564FD0C

Filesize
574KB

MD5
9b351ceed136933ca312a6490214a5d4

SHA1
05197ff9e254eb98644491cd8188f0acbf0f17fd

SHA256
2ef02391172d87031e3e14261e5a013c0fda628078a81b92c8f2550c7802c5d9

SHA512
0fbf5fde7ec45a615d06a396023df2cc42ff2847738e1b781d3b71b89ed17a64d6f0abfeb329bbe76e4c09e7af9081bd57b713223051c41ef4b3b1c25c2f2640

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yimk2141.default-release\cache2\entries\93040C9CDAF44EB54ABF4CB62F4F47AC6C6449C6

Filesize
139KB

MD5
76a78ab2a3e0567fdf4c0d093af71e13

SHA1
2b536f273b20708b767d2616f226cdf13d650e63

SHA256
2efa5a3f66f4b4c51ca934ffac2a99a1b65acf8344e70e2df4ebd8b8aef7c6f5

SHA512
10e4d15c0389bfca6ed9287fe5b4e543a62f31c338c22ef655bd9cf6e53ccb00c7751e67a5a612a614077dfbae755574793db301875c8b132c6fe307a4e43187

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yimk2141.default-release\cache2\entries\B48EC666218FB4682CB9FD6C8EE485483F7F2EA7

Filesize
38KB

MD5
15b7b31841686299cd26cd3092fc5b15

SHA1
6fbeff54892d153576ed39808b24d6c7a302d2f6

SHA256
8af74942faf8ccab168ff36f046a6c692a065fcc76fd9a6b9186713272ee4352

SHA512
6b0de312aa961c662cd3dfe478b48aadc515fb943d157c8e9ab8482f942f010786b731f6ae4ac31c57c8d5c69a3c56f518b47801cee892e39c815567dc9978ce

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yimk2141.default-release\cache2\entries\E60B9BD4DBC486130F50AECFEBA70A537A92204D

Filesize
15KB

MD5
b7c9084dea16b463c448607514490f79

SHA1
a8725d22f4b4562fc167a551c60ee8ae5224fdc1

SHA256
5663476559de9060dac4eaec236b3dbceee8434f9c6be395ab1677d7ba0dc131

SHA512
d9563aca4f9ad17d2ac81868d990e69560526fc0f62b9d4fb2a9489a8c7cdfc4ba9ac456b8c91f8ba5223027d5f9f96959310d634cf68bdaee8d569456fd1920

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-A6189.tmp\setup.tmp

Filesize
1.4MB

MD5
ae9890548f2fcab56a4e9ae446f55b3f

SHA1
e17c970eebbe6d7d693c8ac5a7733218800a5a96

SHA256
09af8004b85478e1eca09fa4cb5e3081dddcb2f68a353f3ef6849d92be47b449

SHA512
154b6f66ff47db48ec0788b8e67e71f005b51434920d5d921ac2a5c75745576b9b960e2e53c6a711f90f110ad2372ef63045d2a838bc302367369ef1731c80eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-ID9EH.tmp\BASS.dll

Filesize
103KB

MD5
8005750ec63eb5292884ad6183ae2e77

SHA1
c83e31655e271cd9ef5bff62b10f8d51eb3ebf29

SHA256
df9f56c4da160101567b0526845228ee481ee7d2f98391696fa27fe41f8acf15

SHA512
febbc6374e9a5c7c9029ccbff2c0ecf448d76927c8d720a4eae513b345d2a3f6de8cf774ae40dcd335af59537666e83ce994ec0adc8b9e8ab4575415e3c3e206

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-ID9EH.tmp\CLS-srep.dll

Filesize
15KB

MD5
bcd4ebd26140038f1e45ba5c639d9ad4

SHA1
315a5e4f3bc5472dea5375a986dd6f6fb35b2f17

SHA256
39c965edc8f577695dadd68d6d40ace4e1e17625ca4669e3f1321b6b26e470c7

SHA512
4d9d88f8062288f3586dabd95baad19ab3fcfe22cbf28f60f051d73f9158d2d697951b86dbd8094345d70ff494c3a2a4233b3cac7975e06c2355390fe93021cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-ID9EH.tmp\CLS.ini

Filesize
992B

MD5
6afe7793f8538605a840a6490e89fb1a

SHA1
3db3e88b5dc24df0048bc56a080e0fe3bd4246a0

SHA256
7ed407550c1d0167157653a46633f06a6f4ee66194782c8fdc7439281b8388cd

SHA512
ebaf48dc25962d996e8506a6890476932657b693e62cb763cce1d8ced433f05614c03c7e48f5ee26ab9870f37c76fe7dcb9889c19feaa64069b5d5884ff7a627

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-ID9EH.tmp\CallbackCtrl.dll

Filesize
4KB

MD5
f07e819ba2e46a897cfabf816d7557b2

SHA1
8d5fd0a741dd3fd84650e40dd3928ae1f15323cc

SHA256
68f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d

SHA512
7ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-ID9EH.tmp\FlushFileCache.exe

Filesize
29KB

MD5
df77f2b6126f4f258f2e952b53b22879

SHA1
fedda8401ebfe872dd081538deec58965e82f675

SHA256
a4cc6683393795f7b84d0b49eea2d7d7fbe1392bb7612cf39896af6832ffe0b8

SHA512
623c5a2b3382b610bf2a2812db94ea77e52051f307fd1ba7767927719277a7d99e844f9286a52549f888ad818c4d4d09759c031a8ab6dbc58911257987028a37

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-ID9EH.tmp\ISDone.dll

Filesize
380KB

MD5
63dc27b7bc65243efaa59a9797a140ba

SHA1
22f893aefcebecc9376e2122a3321befa22cdd73

SHA256
c652b4b564b3c85c399155cbb45c6fb5a9f56f074e566bfd20f01da6e0412c74

SHA512
3df72dc171baa4698dfd0c324a96dde79eb1c8909f2ff7d8da40e5ca1de08f1fc26298139ab618e0bb3fa168efe5d6059398b90d8ff5f88e54c7988c21fb679e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-ID9EH.tmp\MusicButton.png

Filesize
1KB

MD5
473a683962d3375a00f93dd8ce302158

SHA1
1c0709631834fd3715995514eef875b2b968a6be

SHA256
7f4ad4d912cdabdfbb227387759db81434e20583687737f263d4f247326f0c1a

SHA512
24ffe03b5de8aec324c363b4be1d0ae4c8981176a9f78a359f140de792251e4f2e3e82e2a6f3c19ff686de5588e8665409ddc56fc9532418f6d476869f3f1f9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-ID9EH.tmp\botva2.dll

Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-ID9EH.tmp\cls-lollypop.dll

Filesize
16KB

MD5
0ef04bc15fd1b28975aff2951b857f03

SHA1
817434cffcef953111182a34aba7d7b6c56495f9

SHA256
f84677643d9977aa1e8a4aa8c85a12665d29a4e8292485a0b4df846dd161f824

SHA512
93bd57efc27523c0df0b9960fdd194190cd09766f3ef5972713c0c8a10c7ec5ae06f5eb60de44f57667bc8c89df346d85cc29e10f26068b8bdf2e4bc1c54f2ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-ID9EH.tmp\cls-magic2l.dll

Filesize
16KB

MD5
9e1e200472d66356a4ae5d597b01dabc

SHA1
8d93246907a422d2333697cfe999cd9aeaea764c

SHA256
87df573ac240e09ea4941e169fb2d15d5316a1b0e053446b8144e04b1154f061

SHA512
dd16e9c0831e72d19b1bf1431a2c8c74bcc183cfa16f494b5f11f56168209948744e0add7f2afe62db7f34adddf940fd570e28d60bebf636e07f57a0bf0346cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-ID9EH.tmp\facompress.dll

Filesize
165KB

MD5
fb5ecb3f135465ac61a78ca3c177485c

SHA1
1eaa2cc250e8191f6206f710fbd1d34bb88a9f49

SHA256
148fa9a255bfff3f7d8a74f25394944f20611af31f26ef9700cbc0edc19a3483

SHA512
cbe65374073c7aeaeb185d5ba47c358e7d48ca39bd31c1ef92fa2f98ad9e1667658d96fe707bb4da9f8660b5824d6450873c978dcf3c7950270e92e50e8c1da4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-ID9EH.tmp\idp.dll

Filesize
220KB

MD5
af555ac9c073f88fe5bf0d677f085025

SHA1
5fff803cf273057c889538886f6992ea05dd146e

SHA256
f4fc0187491a9cb89e233197ff72c2405b5ec02e8b8ea640ee68d034ddbc44bb

SHA512
c61bf21a5b81806e61aae1968d39833791fd534fc7bd2c85887a5c0b2caedab023d94efdbbfed2190b087086d3fd7b98f2737a65f4536ab603dec67c9a8989f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-ID9EH.tmp\innocallback.dll

Filesize
63KB

MD5
1c55ae5ef9980e3b1028447da6105c75

SHA1
f85218e10e6aa23b2f5a3ed512895b437e41b45c

SHA256
6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f

SHA512
1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-ID9EH.tmp\unarc.dll

Filesize
350KB

MD5
da1fe7b7699ee3d96c2056b09e580129

SHA1
0cf70c324e299f089e5dd95a70d3f524cbcf156c

SHA256
7ded3fb8947e3b42c157de34ac8a6340c75cbea54bc44a949c4e5124c72f14bc

SHA512
6f104c94eb124fcc624fd192ccb8a3d420d9ef7061be73f5126456f3112ecfe6d467464bec94bfe4ca5b3353679ee77573a9d3f997c022f10090f0e5f9ca830c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-ID9EH.tmp\wintb.dll

Filesize
16KB

MD5
9436df49e08c83bad8ddc906478c2041

SHA1
a4fa6bdd2fe146fda2e78fdbab355797f53b7dce

SHA256
1910537aa95684142250ca0c7426a0b5f082e39f6fbdbdba649aecb179541435

SHA512
f9dc6602ab46d709efdaf937dcb8ae517caeb2bb1f06488c937be794fd9ea87f907101ae5c7f394c7656a6059dc18472f4a6747dcc8cc6a1e4f0518f920cc9bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SVI9ZCA0DAYF51EKM96Z.temp

Filesize
18KB

MD5
8c2dfa58721271dfbb59f96670961f87

SHA1
4ce3e959c4f13b25a3e831d66a1e56716e7b4052

SHA256
b63248c527e41a23e66caf2e51d977053d8d0f76027d0b8146b915411eb6cc8d

SHA512
58faa278c5b8b2bf2029157af0dec1818dbbcafa4b7cd3010e1cd86b202652dc9baad4e1c29bfbe1503c6a034b8eeb323b1769fc8a262f0538a17d379a4b49e2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yimk2141.default-release\AlternateServices.bin

Filesize
8KB

MD5
95d1862d8cb75cd23f3666f055892443

SHA1
de0a815ca4d0b5844062902212f3c13395d8fcc2

SHA256
7f5b919e096c7b13d057049a2e1a8a9a5a6de349ee2241563d542f62d7f5f1d3

SHA512
6252f49305e0108805541032fbe51230524cf2e9b7504b9a458bee78cfe70abf9f24606129c2c61b9b236aa2014ced9558c3b1d21981ba1d4d377e749f718a01

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yimk2141.default-release\AlternateServices.bin

Filesize
23KB

MD5
a7b641b3aed4ef7c27a1a91ab97efac8

SHA1
f66991904ec29813c76f32464a0101cb280fadc6

SHA256
1513c4be518c077c7da3818adffa8fac1ec5e6a5495392015925e03411250f9c

SHA512
fef4cf343256c4805e8249645080d381c5f1c67fcf405baf6b7d273380e1fecee20e3535626a4db0e96982cbf52a217d174ef72d7980a3c877f95caf385e5a68

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yimk2141.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
388f51863fc12500e3469127fcd4d401

SHA1
183ac36f59eaa1faa2599e8eee20860a320071dd

SHA256
92cdbf554b0f61318cbc4e286158b4ecd2b7996d9824e4490c4ad68abced8c64

SHA512
ce003583e9750109310053fd28016606a5a4fe23c287dc407477987d0296319dace74d756d62173123d832b41652f6102a4dbf54749a92f7594a501f92f28ad4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yimk2141.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
e339e4d86b209aa0ac76e81b2e18bbce

SHA1
3e9c2b11e38d88b14ed79de7ed5c6e06bca11200

SHA256
421e196b9d8603e537ebd497a97ca397fa704233c6fbf79d2e876b5cab8d9274

SHA512
b57b56399e753e7496b691c78e3df6ee3fd608ac3d750d3f1c4b25f30957976af51ebefdf24f8a24213eaee87934721b75c0c580f03ca8c6ced21d74ac21d13a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yimk2141.default-release\datareporting\glean\db\data.safe.tmp

Filesize
90KB

MD5
e6651800a493e73516d4139d1966be42

SHA1
42b70567bf4d7198c9bcd43e523b52a8053daeaa

SHA256
6a02927e14c4e1bf66f0a44e00d90c7c64bee9270900c4002915e379d32e45d5

SHA512
077fb27e462690c4a5767f656cf9988f565f17970bafa35acdc80ba52c5799b9a6b124b735e1d9775ad6b082835862dda03f24a616ceab92b17ccbebf57c7147

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yimk2141.default-release\datareporting\glean\pending_pings\4a380909-fd8b-46af-b314-5eda4256fec0

Filesize
28KB

MD5
ab588206757ff7dcfc69ad9d03187108

SHA1
ae5758b1a5e4940dd9a7a95985efa2b69b0f9174

SHA256
f4e0d6a2673dba4d41c5a0dae600da71b736b85dd2a932684c75e1aa4066c0be

SHA512
a4ebb4bf1c6dd474620f5d7788cfec403638e27813208a5862e37105bbc78df4e40ae7e4b8e70ee43fb6d88a140389b6ef623c0ae3ef8da32c4e8df0e6d7e203

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yimk2141.default-release\datareporting\glean\pending_pings\9fa8f864-fbdf-4a1f-ab5b-0695c667ed49

Filesize
982B

MD5
eae4a34a00cd9b8e52b8fe59327e91da

SHA1
0779330a6832695159ef9683167de8f43c0e1ebd

SHA256
9343aea369092c8c16c85861817a8d43b881570551ba9b7379a2d18141d96052

SHA512
2abff32a8a2138dff9cb206dfe661f58c0196af4cb90eb79e0abb41a7f7e9a9ca75e3961947e5a2601b45fd626b88929a6a0ce25ea6c54234def7963c922fa75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yimk2141.default-release\datareporting\glean\pending_pings\d6de92a7-c257-432f-bf7b-18f0929e0d29

Filesize
671B

MD5
4c8a3bfb2fe26789ef106cdd5e4fc54c

SHA1
a8b4dedd5d609711a74f0bb1b43746f142ef5edf

SHA256
6e826c065eb07b3edff90cf907684ca56b139f1fe326aada0f40d345cab5c690

SHA512
30aad648b2a3111124feac423e46d48c5e414e06462b3c2b002972d7e98939f09d16e81c26b711112d6cd3ab82d3a5fabd674400d62378c681600c97896962c2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yimk2141.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yimk2141.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yimk2141.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yimk2141.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yimk2141.default-release\prefs-1.js

Filesize
10KB

MD5
cfef91b9a31cae0ab331e4216fee7d33

SHA1
604439e4a45ae5b5dacdc9a07ff04c15c92d0d14

SHA256
a5b6002449636d563be6994b841b06656e698e658c7fc2409a4bfd56be88fb98

SHA512
d1c2555bda324aa9227264930f063a2bf224ef739174e3566a18af72e4bb18b432aa1f9158656e20af40effbe6ef1b268bd80219d2d079af7cdc20eaa40e01ae

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yimk2141.default-release\prefs-1.js

Filesize
9KB

MD5
f21362e89692514ea9c4db8b17eee86a

SHA1
df2a94fbaf8fd29087d94b62c6cb61b7a55f3a7d

SHA256
ed4b09776d2e1b780be5d4700fd0fdd125b0a38123f8e273f2b592288f2a4cfe

SHA512
fd87893013f80bb41034ac21606347ca509c0449439e46a49487297a138f008280823fc8b22deb9ee77ae407675aec19e412c2852bee32a5e90a440ad0140826

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yimk2141.default-release\prefs.js

Filesize
9KB

MD5
2ac6373bb2ccd7febe2a414ffe74d5e2

SHA1
8fc099bda7f842d8531b804c8c4b1bd6df5d8a4c

SHA256
95a156bbbdcbc137b836bbbe78cc55992f6722e2557786826e74c79611c5828c

SHA512
2e863a3797cd92434c408bab3aba5ca632e3ea964fe156a51640ab774a4ad4cc64558a9198f0a29d08acb40ac8612ea3b0754719b7cb964914f464fc9ed61715

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yimk2141.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
73d2eff025ad86877dee6af1b72cea0c

SHA1
66e8b4b077d15dba4b552dd3d087cdbdcc32c3b6

SHA256
cd2c04c1e221ec1a2191d45aeeb92993711a039ed232f62cf1fec28f3de64d0f

SHA512
62620797f897c083b429496f27300c875a3846aa84b319fad85c42f86faa6e494d55f8e7c6fbe08cc52bbe491079f966af686f5ea610e09cee12d3887678de49

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yimk2141.default-release\sessionstore-backups\recovery.baklz4

Filesize
18KB

MD5
bb35a0c877ff48a41858bfc5c23b63b1

SHA1
30c17ffee8f6fbc3b529126c9d8a84ae289de9ac

SHA256
6945246581d5347fa4ada3ed9464619c6e5d98f686e6e2a1dde61ef8a2cb43b5

SHA512
47eee9daa458494e335a556609a5072328091c96586358920041b646fbe2ccdec16c83224cbb8cf53747d45f9bff1921c91657136551f1ce8cb0e5798abee3cd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yimk2141.default-release\sessionstore-backups\recovery.baklz4

Filesize
19KB

MD5
1f16cbeb5d91dee59dd14eef00609199

SHA1
424a46402d7f93b099b037028fade89a14b68ec1

SHA256
e08aeae81e1285dcb0e78126e995271a1fc23a736b2dc1a78bb51bcf1fe46fe0

SHA512
e454d10502b1fee3f18f1d2e1fb95f6ded383b1b6cc38acc2c6b19c0f7ae748c2e8ecbae941bae2b319237138bc234693a349f2f09bcbe59e898ced5be22b7b3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yimk2141.default-release\sessionstore-backups\recovery.baklz4

Filesize
20KB

MD5
59c5d3c551a6ba30fd2fc458750059d1

SHA1
65289bae983693bc9bb146734f9f3f4a6400cff5

SHA256
7c809d662fe4072e7a55ce8aacc089fe58371c37c229a2ca352a87a97f961dbe

SHA512
c9b0cb512dc6fd4799855297e26154a4c36ac76f0f02f0aabf70474c2d8edcd3eaea9db926b165c41f049c8828f6c28a8badc243a8b0c81285505a74a85a22a2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yimk2141.default-release\sessionstore-backups\recovery.baklz4

Filesize
14KB

MD5
8af4dd63f470c11a032518d1d02fd866

SHA1
8e5d4ed5dc11b7a503873d936147e4770f34734c

SHA256
4a3ad9b9da0d12a6feabff44db545de0ad6b71db41681875af11206bf857086e

SHA512
ee83c6864694bf20f6dd00ce25b376b25cc8874961d6ecfe2e345ec0bd35a1dd9421a095a83942e5fbab8ef9ae13bb8c9c33d75f584974707dbc3c51d0ca9304

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yimk2141.default-release\sessionstore-backups\recovery.baklz4

Filesize
18KB

MD5
88a21cff349e202273c366a060b50bf5

SHA1
87db74770f61af7ac99987ff620cd040857cb0a1

SHA256
85c1645e4a239cbad6bf655e2e33536f7d7dfa7d2a436f1526bbad3f6a441f1c

SHA512
5bb440a6096515d598e08c23667fd95eb95005bc09cb2f99e3c092153086c6be6885e05df12d7466b1211395c222039aa2a1b0221fa696490c3aa0c52e55bed8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yimk2141.default-release\storage\default\https+++www.youtube.com^partitionKey=%28https%2Cfitgirl-repacks.site%29\idb\2570078944LCo7g%sCD7a%t4a8b1a7s.sqlite

Filesize
48KB

MD5
dcce30a8fff664b0a46995cf1c222c94

SHA1
2c5568293f56d7d06de9296767387068b7837764

SHA256
71f9e22e3ed554b98fd6fb4794ceba60e42cfe0ec5d688b92a11f82529fed3a2

SHA512
1e6a8d3deae78538ab94232940db00c9e996531825a67d5faa49826544784adc7b8fdc2fb3bbc14a102360dfbd744549ec02ef19bd385cb2387fb04916a49944

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yimk2141.default-release\storage\default\https+++www.youtube.com^partitionKey=%28https%2Cfitgirl-repacks.site%29\ls\usage

Filesize
12B

MD5
a4b57866747aa8bc0828ccb259689903

SHA1
b77c045f5580c81a6cd07a5e5d2271064aa52233

SHA256
395c2160a5f25f4ebff4939482f032465544c7d1105b8f93b529552a1f8f7b88

SHA512
f5e9b04e525e1bb7a913c3e02504f98b1f860cbc487029075c668cfb560bcf85855d7e48ad19586368becbb6157872b70a083a40081c2c109314ccbe9e5825b0

Download Submit
C:\Users\Admin\AppData\Roaming\qBittorrent\qBittorrent_new.ini.lock

Filesize
63B

MD5
fe7f5b82279390d6b0b58b6d59bcc769

SHA1
10b0cad963b4a581b0b23727e91711c76bbf8eaa

SHA256
ffb33f6ad9ffa15acdb1dd81a63c3714222e8c09a6a684263b1204393a3f30be

SHA512
21c673c0db920914ef19896d512ae930279f8f9e0ecc057d65a703dd453eb62f6820ce9c13c23d73a9b2eba990a52ee61594b4b761e6fd4977bf14d1527781a1

Download Submit
C:\Users\Admin\Downloads\8mgX7NDQ.torrent.part

Filesize
228KB

MD5
0533eacd06d9d9b5fbe3d8ab375d9b3a

SHA1
2d040ab9c4c8879834f40b2c2bab733b4f078e9f

SHA256
0b04ec7348abf89a957184fd9439a22fef02c9dc55cd1afeee9d7315f4af7e09

SHA512
8d319a5d9e4b3bf3335802b75b9fdb4092126c90fa5f7664d63910fe42ee7dadf48ecabde5fb93c46fe4fe74d520de64bb3f53d0fd9df15b4ec6687f8f834ce0

Download Submit
F:\Until Dawn [FitGirl Repack]\setup.exe

Filesize
4.5MB

MD5
c2aa9ff0baa8bad66bd6340fd7f03132

SHA1
91763705f9e68fb764acd17d495dcf92db816aed

SHA256
912551a552dee884918873ef627a55f6a13d86f9bfc2153a3c88099c8d4e13cf

SHA512
b919b483b00f1b3962892bb9f045e2db9d2f807be086bcbc839c3f438cdf6bdbac609d64b2b0681723e5a786399d96c57184e3b79c6c71f4871474c493a547b5

Download Submit
memory/760-1633-0x0000027A46A80000-0x0000027A46A90000-memory.dmp

Filesize
64KB

Download
memory/760-0-0x0000027A46A80000-0x0000027A46A90000-memory.dmp

Filesize
64KB

Download
memory/1160-1408-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1160-1323-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1804-1415-0x0000000011000000-0x000000001104C000-memory.dmp

Filesize
304KB

Download
memory/1804-1550-0x000000000D130000-0x000000000D189000-memory.dmp

Filesize
356KB

Download
memory/1804-1422-0x0000000011000000-0x000000001104C000-memory.dmp

Filesize
304KB

Download
memory/1804-1418-0x0000000000400000-0x0000000000579000-memory.dmp

Filesize
1.5MB

Download
memory/1804-1409-0x0000000000400000-0x0000000000579000-memory.dmp

Filesize
1.5MB

Download
memory/1804-1438-0x0000000000400000-0x0000000000579000-memory.dmp

Filesize
1.5MB

Download
memory/1804-1442-0x0000000011000000-0x000000001104C000-memory.dmp

Filesize
304KB

Download
memory/1804-1449-0x0000000003390000-0x00000000033A5000-memory.dmp

Filesize
84KB

Download
memory/1804-1453-0x0000000006AD0000-0x0000000006ADF000-memory.dmp

Filesize
60KB

Download
memory/1804-1452-0x0000000011000000-0x000000001104C000-memory.dmp

Filesize
304KB

Download
memory/1804-1448-0x0000000000400000-0x0000000000579000-memory.dmp

Filesize
1.5MB

Download
memory/1804-1473-0x0000000000400000-0x0000000000579000-memory.dmp

Filesize
1.5MB

Download
memory/1804-1477-0x0000000011000000-0x000000001104C000-memory.dmp

Filesize
304KB

Download
memory/1804-1412-0x000000006B080000-0x000000006B08D000-memory.dmp

Filesize
52KB

Download
memory/1804-1411-0x00000000034F0000-0x0000000003555000-memory.dmp

Filesize
404KB

Download
memory/1804-1413-0x0000000011000000-0x000000001104C000-memory.dmp

Filesize
304KB

Download
memory/1804-1414-0x0000000006AD0000-0x0000000006ADF000-memory.dmp

Filesize
60KB

Download
memory/1804-1410-0x0000000003390000-0x00000000033A5000-memory.dmp

Filesize
84KB

Download
memory/1804-1399-0x0000000006AD0000-0x0000000006ADF000-memory.dmp

Filesize
60KB

Download
memory/1804-1546-0x0000000072830000-0x0000000072837000-memory.dmp

Filesize
28KB

Download
memory/1804-1390-0x0000000011000000-0x000000001104C000-memory.dmp

Filesize
304KB

Download
memory/1804-1543-0x0000000072840000-0x0000000072847000-memory.dmp

Filesize
28KB

Download
memory/1804-1541-0x0000000072850000-0x0000000072857000-memory.dmp

Filesize
28KB

Download
memory/1804-1540-0x0000000072860000-0x0000000072867000-memory.dmp

Filesize
28KB

Download
memory/1804-1342-0x0000000003390000-0x00000000033A5000-memory.dmp

Filesize
84KB

Download
memory/1804-1349-0x00000000034F0000-0x0000000003555000-memory.dmp

Filesize
404KB

Download
memory/1804-1557-0x00000000034F0000-0x0000000003555000-memory.dmp

Filesize
404KB

Download
memory/1804-1559-0x0000000011000000-0x000000001104C000-memory.dmp

Filesize
304KB

Download
memory/1804-1561-0x0000000061080000-0x000000006111D000-memory.dmp

Filesize
628KB

Download
memory/1804-1556-0x0000000003390000-0x00000000033A5000-memory.dmp

Filesize
84KB

Download
memory/1804-1555-0x0000000000400000-0x0000000000579000-memory.dmp

Filesize
1.5MB

Download
memory/1804-1567-0x0000000011000000-0x000000001104C000-memory.dmp

Filesize
304KB

Download
memory/1804-1575-0x0000000011000000-0x000000001104C000-memory.dmp

Filesize
304KB

Download
memory/1804-1622-0x0000000072830000-0x0000000072837000-memory.dmp

Filesize
28KB

Download
memory/1804-1631-0x0000000011000000-0x000000001104C000-memory.dmp

Filesize
304KB

Download
memory/2044-1527-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download