76f9efe4a0ddee663d02fe4f3a15e1f27769b4af1d697bf5ec91807f73579649

Analysis

user interaction
yes
max time kernel
1050s
max time network
1051s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 14:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FlStudio25.torrent
Size 34KB
Sample260802-rnaxeavcnd
SHA256 76f9efe4a0ddee663d02fe4f3a15e1f27769b4af1d697bf5ec91807f73579649
MD5 724c87febd0e5751e0c612a07d96c811
SHA1 00e1f5e966b42b84b1f605dce0db48a2b448f936
SHA512 e56a1b5f961ff96865df7988baca2a1f847c962c58ccba7ee143790d903fe906f7b6611e0d9d57f75e89bba23ab8d14e4b9ac86772ccf9a5355de930373b6f04
SSDEEP 384:bb8RUJiZSx56ZiEEtgHQDEWOSoC5ICGM5wmSNraUcqr4Et7Z4kFTUgiZbs9dNIBz:3JICEmShcqrZ4cMbsDNIB6H+NTsCv
TLSH
T10EF2A5572A349325AB3EAE9306AB51D02B7EFBFA1C21E475C86BCF0D5C817C055F2612
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Contacts a large (618) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Downloads MZ/PE file 1 IoCs

flow	pid	Process
149	4756	chrome.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	qbittorrent_5.2.3_x64_setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	qbittorrent.exe

Executes dropped EXE 4 IoCs

pid	Process
4560	qbittorrent_5.2.3_x64_setup.exe
1684	qbittorrent_5.2.3_x64_setup.exe
5312	qbittorrent.exe
5932	flstudio_win64_25.1.6.4997.exe

Loads dropped DLL 30 IoCs

pid	Process
4560	qbittorrent_5.2.3_x64_setup.exe
4560	qbittorrent_5.2.3_x64_setup.exe
1684	qbittorrent_5.2.3_x64_setup.exe
1684	qbittorrent_5.2.3_x64_setup.exe
1684	qbittorrent_5.2.3_x64_setup.exe
1684	qbittorrent_5.2.3_x64_setup.exe
1684	qbittorrent_5.2.3_x64_setup.exe
1684	qbittorrent_5.2.3_x64_setup.exe
1684	qbittorrent_5.2.3_x64_setup.exe
5932	flstudio_win64_25.1.6.4997.exe
5932	flstudio_win64_25.1.6.4997.exe
5932	flstudio_win64_25.1.6.4997.exe
5932	flstudio_win64_25.1.6.4997.exe
5932	flstudio_win64_25.1.6.4997.exe
5932	flstudio_win64_25.1.6.4997.exe
5932	flstudio_win64_25.1.6.4997.exe
5932	flstudio_win64_25.1.6.4997.exe
5932	flstudio_win64_25.1.6.4997.exe
5932	flstudio_win64_25.1.6.4997.exe
5932	flstudio_win64_25.1.6.4997.exe
5932	flstudio_win64_25.1.6.4997.exe
5932	flstudio_win64_25.1.6.4997.exe
5932	flstudio_win64_25.1.6.4997.exe
5932	flstudio_win64_25.1.6.4997.exe
5932	flstudio_win64_25.1.6.4997.exe
5932	flstudio_win64_25.1.6.4997.exe
5932	flstudio_win64_25.1.6.4997.exe
5932	flstudio_win64_25.1.6.4997.exe
5932	flstudio_win64_25.1.6.4997.exe
5932	flstudio_win64_25.1.6.4997.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Instruments\Keyboard\Close Grand\desktop.ini	flstudio_win64_25.1.6.4997.exe
File opened for modification	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Instruments\Keyboard\Close Grand\desktop.ini	flstudio_win64_25.1.6.4997.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Image-Line\FL Studio 2025\Data\Demo projects\Performance mode\nucleon - Housework.flp	flstudio_win64_25.1.6.4997.exe
File created	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Channel presets\3x Osc\Kick 4.fst	flstudio_win64_25.1.6.4997.exe
File created	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Misc\Used by demo projects\Sacco - Goldener Schnitt\RDHatPH_3-001.ogg	flstudio_win64_25.1.6.4997.exe
File created	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Instruments\Keyboard\Stage Grand\Stage Grand 35.wav	flstudio_win64_25.1.6.4997.exe
File opened for modification	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Legacy\Instruments\Pads\PAD_Vector.wav	flstudio_win64_25.1.6.4997.exe
File opened for modification	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Drums (ModeAudio)\Claps\MA DarkStare Clap.wv	flstudio_win64_25.1.6.4997.exe
File opened for modification	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Drums (ModeAudio)\Kicks\MA Brooze Kick 03.wv	flstudio_win64_25.1.6.4997.exe
File opened for modification	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Drums (ModeAudio)\Snares\Hyper WinterBeach Snare 03.wv	flstudio_win64_25.1.6.4997.exe
File opened for modification	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Drums\Kits\HQ Funk Kit\Kick 2 HQ Funk #4.wav	flstudio_win64_25.1.6.4997.exe
File opened for modification	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Drums\Kits\Rock\kick_oh 19.wav	flstudio_win64_25.1.6.4997.exe
File opened for modification	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Drums (ModeAudio)\Claps\Power Clap 14.wv	flstudio_win64_25.1.6.4997.exe
File opened for modification	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Drums (ModeAudio)\Hi Hats\Hyper WinterBeach Hat 01.wv	flstudio_win64_25.1.6.4997.exe
File opened for modification	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Legacy\Drums\Kits\Drum Kit 01\FLS_Hatop 01.wav	flstudio_win64_25.1.6.4997.exe
File opened for modification	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Impulses\Halls\IMP StPauls_E_DST_hall_rear_07.wv	flstudio_win64_25.1.6.4997.exe
File created	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Drums\Snares\Grv Snareclap 25.wav	flstudio_win64_25.1.6.4997.exe
File opened for modification	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Drums (ModeAudio)\Cymbals\Volt CleanCrash 10.wv	flstudio_win64_25.1.6.4997.exe
File created	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Drums (ModeAudio)\Hi Hats\Hyper Roulette Hat 02.wv	flstudio_win64_25.1.6.4997.exe
File created	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Drums (ModeAudio)\Percussion\Attack WoodBlock 03.wv	flstudio_win64_25.1.6.4997.exe
File created	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Drums (ModeAudio)\Percussion\Collider Down Dry XY 02.wv	flstudio_win64_25.1.6.4997.exe
File opened for modification	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Plugin presets\Effects\Distructor\Guitar\Phase ninja.fst	flstudio_win64_25.1.6.4997.exe
File created	C:\Program Files\Image-Line\FL Studio 2025\Data\Demo projects\Product demos\nucleon - Transient Processor.flp	flstudio_win64_25.1.6.4997.exe
File opened for modification	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Misc\Used by demo projects\Laurie Webb - Pure Alkaline (FL Demo Edit)	flstudio_win64_25.1.6.4997.exe
File created	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Misc\Used by remix projects\Steptime\Drums B Steptime.wav	flstudio_win64_25.1.6.4997.exe
File opened for modification	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Drums\Hats\Bracke CH 1.wav	flstudio_win64_25.1.6.4997.exe
File created	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Drums (ModeAudio)\Claps\Power ClapSnare 08.wv	flstudio_win64_25.1.6.4997.exe
File opened for modification	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Drums (ModeAudio)\Foley\MA Bottle Strike 03.wv	flstudio_win64_25.1.6.4997.exe
File opened for modification	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Drums (ModeAudio)\Hi Hats\Collider Slack CHat 02.wv	flstudio_win64_25.1.6.4997.exe
File created	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Drums (ModeAudio)\Kicks\Power CrunchKick 05.wv	flstudio_win64_25.1.6.4997.exe
File opened for modification	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Channel presets\Sampler	flstudio_win64_25.1.6.4997.exe
File created	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Impulses\Guitar Cabinet\IMP Cabinet Model B.wv	flstudio_win64_25.1.6.4997.exe
File opened for modification	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Misc\Used by demo projects\Mehran Abbasi - With You\PL_TLO_05_With You_104_Lead Vocals_02_D#m_Dry.ogg	flstudio_win64_25.1.6.4997.exe
File created	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Drums\Kits\HQ Funk Kit\Ride HQ Funk #3.wav	flstudio_win64_25.1.6.4997.exe
File created	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Drums\Kits\Rock\snare_oh 37.wav	flstudio_win64_25.1.6.4997.exe
File created	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Drums\Kits\Rock\tom3_oh 12.wav	flstudio_win64_25.1.6.4997.exe
File opened for modification	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Drums (ModeAudio)\Snares\Attack Snare 14.wv	flstudio_win64_25.1.6.4997.exe
File opened for modification	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Legacy\Drums\Kits\Drum Kit 02\FLS_TomL 02.wav	flstudio_win64_25.1.6.4997.exe
File created	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Channel presets\3x Osc\Synth bass.fst	flstudio_win64_25.1.6.4997.exe
File opened for modification	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Misc\Used by demo projects\Astes - Bien Duro\1.1 Interlude #1.ogg	flstudio_win64_25.1.6.4997.exe
File created	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Drums\Kits\Thrower\Dead kick back 2.wav	flstudio_win64_25.1.6.4997.exe
File created	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Instruments\Keyboard\Close Grand\Close Grand 20.wav	flstudio_win64_25.1.6.4997.exe
File created	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Legacy\Drums\HipHop\HIP_Snare_6.wav	flstudio_win64_25.1.6.4997.exe
File created	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Legacy\Instruments\Orchestral\Tenor Sax\17_TSAX_LONG C3ogg.wav	flstudio_win64_25.1.6.4997.exe
File opened for modification	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Legacy\Instruments\Strings\STR_Rocky_C3.wav	flstudio_win64_25.1.6.4997.exe
File opened for modification	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Drums\Kits\HQ Jazz Kit\Kick 1 HQ Jazz #2.wav	flstudio_win64_25.1.6.4997.exe
File opened for modification	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Drums\Kits\Jayce Lewis\JL Toms Room Low 01.flac	flstudio_win64_25.1.6.4997.exe
File created	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Drums\Kits\Rock\hatpedal 07 soft.wav	flstudio_win64_25.1.6.4997.exe
File opened for modification	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Drums (ModeAudio)\Hi Hats\Fracture Hat 60.wv	flstudio_win64_25.1.6.4997.exe
File opened for modification	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Drums (ModeAudio)\Snares\MA Thunk Snare 02.wv	flstudio_win64_25.1.6.4997.exe
File created	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Plugin presets\Effects\FL Studio Mobile Rack FX\Echo\Trance Delay.fst	flstudio_win64_25.1.6.4997.exe
File opened for modification	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Legacy\Drums\Kits\Drum Kit 01\FLS Crash 01b.wav	flstudio_win64_25.1.6.4997.exe
File created	C:\Program Files\Image-Line\FL Studio 2025\Data\Demo projects\Performance mode\Charles Deluxe - Performance Demo.flp	flstudio_win64_25.1.6.4997.exe
File opened for modification	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Drums\Kits\HQ Metal Kit multi out.fst	flstudio_win64_25.1.6.4997.exe
File opened for modification	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Drums\Snares\RD Snare.wav	flstudio_win64_25.1.6.4997.exe
File created	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Drums (ModeAudio)\Foley\MA Bottle Strike 02.wv	flstudio_win64_25.1.6.4997.exe
File created	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Drums (ModeAudio)\Rims\Hyper RagsToRiches Rim.wv	flstudio_win64_25.1.6.4997.exe
File opened for modification	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Legacy\Drums\Dance\Basic 808 Kick.wav	flstudio_win64_25.1.6.4997.exe
File created	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Legacy\Drums\HipHop\HIP_Snare_4.wav	flstudio_win64_25.1.6.4997.exe
File created	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Legacy\Drums\Vintage\VT_HC.wav	flstudio_win64_25.1.6.4997.exe
File opened for modification	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Channel presets\Automation clips\Shapes\Sin-16th-0.fst	flstudio_win64_25.1.6.4997.exe
File opened for modification	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Misc\Used by demo projects\Seamless - Antecoder\FPC_OHH_Greal_13_02.wav	flstudio_win64_25.1.6.4997.exe
File created	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Drums\Snares\Alum Snare 1.wav	flstudio_win64_25.1.6.4997.exe
File created	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Drums\Snares\Stick Rim 1.wav	flstudio_win64_25.1.6.4997.exe
File opened for modification	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Plugin presets\Effects\Fruity Compressor\Internal\Vintage Mix.fst	flstudio_win64_25.1.6.4997.exe
File opened for modification	C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Impulses\Chambers\IMP warehouse_hall_dark_a.wv	flstudio_win64_25.1.6.4997.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 3 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\1 FL_Studio_25.1.6.4997_rev.1-WD\FL64 (scaled).exe:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\1 FL_Studio_25.1.6.4997_rev.1-WD\FL64.exe:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\flstudio_win64_25.1.6.4997.exe:Zone.Identifier	qbittorrent.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
628	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qbittorrent_5.2.3_x64_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qbittorrent_5.2.3_x64_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	flstudio_win64_25.1.6.4997.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4756	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301540553293893"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	qbittorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet	qbittorrent_5.2.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\Content Type = "application/x-magnet"	qbittorrent_5.2.3_x64_setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	qbittorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet\shell\open\command	qbittorrent_5.2.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet\shell\open\command\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\" \"%1\""	qbittorrent_5.2.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\URL Protocol	qbittorrent_5.2.3_x64_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1"	qbittorrent.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent.File.Torrent\shell\open\command	qbittorrent_5.2.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\shell\open\command	qbittorrent_5.2.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent.Url.Magnet\shell\open\command	qbittorrent_5.2.3_x64_setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	qbittorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\ = "URL:Magnet URI"	qbittorrent_5.2.3_x64_setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\DefaultIcon\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\",1"	qbittorrent_5.2.3_x64_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.torrent	qbittorrent_5.2.3_x64_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\shell\open	qbittorrent_5.2.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent.Url.Magnet	qbittorrent_5.2.3_x64_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616193"	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	qbittorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\ = "Torrent File"	qbittorrent_5.2.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet\shell\open	qbittorrent_5.2.3_x64_setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent.Url.Magnet\DefaultIcon	qbittorrent_5.2.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet\DefaultIcon\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\",1"	qbittorrent_5.2.3_x64_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616193"	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	qbittorrent.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent.File.Torrent\DefaultIcon	qbittorrent_5.2.3_x64_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.torrent\Content Type = "application/x-bittorrent"	qbittorrent_5.2.3_x64_setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	qbittorrent.exe

NTFS ADS 64 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\2 Addons\Optional Features\Edison Declipper Windows\fbgemm.dll:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Community Vision Themes Vol 1\thmNeutralize Dark.jpg:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Radioactive Themes\thmFlerovium.jpg:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Radioactive Themes\thorium_1440.jpg:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Solar System Themes\saturnian_hd.jpg:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Community Vision Themes Vol 1\Carbon.flstheme:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Community Vision Themes Vol 1\Clean Bean.flstheme:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Radioactive Themes\Actinium.flstheme:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Solar System Themes\thmEarthling.jpg:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Solar System Themes\thmMercurian.jpg:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Solar System Themes\earthling_1440.jpg:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Solar System Themes\jupiterian_4k.jpg:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Solar System Themes\lunar_1440.jpg:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\2 Addons\Optional Features\Stem extractor Windows\libiomp5md.dll:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Solar System Themes\thmLunar.jpg:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Solar System Themes\venusian_1440.jpg:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\2 Addons\Optional Features\FL Cloud mastering v2 Windows\CloudMastering.dll:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\2 Addons\Optional Features\Stem extractor Windows\pytorch_jni.dll:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Radioactive Themes\thmActinium.jpg:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Community Vision Themes Vol 1\Loopy Fruits.html:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Community Vision Themes Vol 1\Neutralize Dark.flstheme:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Community Vision Themes Vol 1\thmClean Bean.jpg:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\2 Addons\Optional Features\Edison Declipper Windows\data_v2_0.mod:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\2 Addons\Optional Features\Edison Declipper Windows\deverb_0.mod:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Radioactive Themes\thmPlutonium.jpg:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Radioactive Themes\radium_4k.jpg:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Radioactive Themes\Radon.flstheme:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Community Vision Themes Vol 1\Legend.flstheme:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\2 Addons\Optional Features\Edison Declipper Windows\deverb_1.mod:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Community Vision Themes Vol 1\Hangar - Tile 2.png:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Solar System Themes\Solar.flstheme:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Solar System Themes\solar_4k.jpg:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Solar System Themes\neptunian_hd.jpg:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Solar System Themes\thmJupiterian.jpg:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Solar System Themes\uranian_1440.jpg:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Community Vision Themes Vol 1\Loopy Fruits.flstheme:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Community Vision Themes Vol 1\thmPhantomsphere.jpg:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Solar System Themes\thmPlutonian.jpg:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\flstudio_win64_25.1.6.4997.exe:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Community Vision Themes Vol 1\thmHangar.jpg:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Radioactive Themes\actinium_4k.jpg:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\2 Addons\Optional Features\Edison Declipper Windows\c10.dll:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Solar System Themes\martian_4k.jpg:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Solar System Themes\martian_hd.jpg:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Radioactive Themes\Polonium.flstheme:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Solar System Themes\mercurian_hd.jpg:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Solar System Themes\thmVenusian.jpg:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Solar System Themes.ini:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Radioactive Themes\thmPolonium.jpg:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Radioactive Themes\thmThorium.jpg:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Radioactive Themes\flerovium_4k.jpg:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Radioactive Themes\flerovium_hd.jpg:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Radioactive Themes\Plutonium.flstheme:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Radioactive Themes\polonium_4k.jpg:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Solar System Themes\Neptunian.flstheme:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Community Vision Themes Vol 1\Dark Prism.flstheme:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\2 Addons\Optional Features\Edison Declipper Windows\uv.dll:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\2 Addons\Optional Features\Stem extractor Windows\fbgemm.dll:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Radioactive Themes\thorium_4k.jpg:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\2 Addons\Optional Features\Stem extractor Windows\uv.dll:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Solar System Themes\martian_1440.jpg:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Radioactive Themes\plutonium_1440.jpg:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Radioactive Themes\radon_4k.jpg:Zone.Identifier	qbittorrent.exe
File opened for modification	C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\4 FL Themes\Themes\Solar System Themes\Lunar.flstheme:Zone.Identifier	qbittorrent.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5312	qbittorrent.exe
5132	vlc.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1684	qbittorrent_5.2.3_x64_setup.exe
1684	qbittorrent_5.2.3_x64_setup.exe
1824	chrome.exe
1824	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
5164	OpenWith.exe
5312	qbittorrent.exe
5132	vlc.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
5312	qbittorrent.exe
5312	qbittorrent.exe
5312	qbittorrent.exe
5312	qbittorrent.exe
5312	qbittorrent.exe
5312	qbittorrent.exe
5312	qbittorrent.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
5312	qbittorrent.exe
5312	qbittorrent.exe
5312	qbittorrent.exe
5312	qbittorrent.exe
5312	qbittorrent.exe
5312	qbittorrent.exe
5312	qbittorrent.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
5312	qbittorrent.exe
5312	qbittorrent.exe
5312	qbittorrent.exe
5312	qbittorrent.exe
5312	qbittorrent.exe
5312	qbittorrent.exe
5312	qbittorrent.exe
5312	qbittorrent.exe
5312	qbittorrent.exe

Suspicious use of SetWindowsHookEx 31 IoCs

pid	Process
5164	OpenWith.exe
5164	OpenWith.exe
5164	OpenWith.exe
5164	OpenWith.exe
5164	OpenWith.exe
5164	OpenWith.exe
5164	OpenWith.exe
5164	OpenWith.exe
5164	OpenWith.exe
5164	OpenWith.exe
5164	OpenWith.exe
5164	OpenWith.exe
5164	OpenWith.exe
5164	OpenWith.exe
5164	OpenWith.exe
5164	OpenWith.exe
5164	OpenWith.exe
5164	OpenWith.exe
5164	OpenWith.exe
5164	OpenWith.exe
5164	OpenWith.exe
5164	OpenWith.exe
5164	OpenWith.exe
5164	OpenWith.exe
5164	OpenWith.exe
5312	qbittorrent.exe
5312	qbittorrent.exe
5312	qbittorrent.exe
5312	qbittorrent.exe
5312	qbittorrent.exe
5132	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 1596	1076	chrome.exe	93
PID 1076 wrote to memory of 4756	1076	chrome.exe	94
PID 1076 wrote to memory of 5488	1076	chrome.exe	95
PID 1076 wrote to memory of 5488	1076	chrome.exe	95
PID 1076 wrote to memory of 3748	1076	chrome.exe	96
PID 1076 wrote to memory of 3748	1076	chrome.exe	96
PID 1076 wrote to memory of 4280	1076	chrome.exe	99
PID 1076 wrote to memory of 4280	1076	chrome.exe	99
PID 1076 wrote to memory of 6096	1076	chrome.exe	98
PID 1076 wrote to memory of 6096	1076	chrome.exe	98
PID 1076 wrote to memory of 5552	1076	chrome.exe	100
PID 1076 wrote to memory of 5552	1076	chrome.exe	100
PID 1076 wrote to memory of 5212	1076	chrome.exe	101
PID 1076 wrote to memory of 5212	1076	chrome.exe	101
PID 1076 wrote to memory of 4024	1076	chrome.exe	102
PID 1076 wrote to memory of 4024	1076	chrome.exe	102
PID 1076 wrote to memory of 3848	1076	chrome.exe	103
PID 1076 wrote to memory of 3848	1076	chrome.exe	103
PID 1076 wrote to memory of 4168	1076	chrome.exe	104
PID 1076 wrote to memory of 976	1076	chrome.exe	107
PID 1076 wrote to memory of 976	1076	chrome.exe	107
PID 1076 wrote to memory of 1684	1076	chrome.exe	108
PID 1076 wrote to memory of 1684	1076	chrome.exe	108
PID 1076 wrote to memory of 5548	1076	chrome.exe	109
PID 1076 wrote to memory of 5548	1076	chrome.exe	109
PID 1076 wrote to memory of 3772	1076	chrome.exe	110
PID 1076 wrote to memory of 3772	1076	chrome.exe	110
PID 1076 wrote to memory of 4004	1076	chrome.exe	111
PID 1076 wrote to memory of 4004	1076	chrome.exe	111
PID 1076 wrote to memory of 5364	1076	chrome.exe	112
PID 1076 wrote to memory of 5364	1076	chrome.exe	112
PID 1076 wrote to memory of 228	1076	chrome.exe	117
PID 1076 wrote to memory of 2976	1076	chrome.exe	118
PID 1076 wrote to memory of 5708	1076	chrome.exe	119
PID 1076 wrote to memory of 4252	1076	chrome.exe	122
PID 1076 wrote to memory of 4252	1076	chrome.exe	122
PID 1076 wrote to memory of 5260	1076	chrome.exe	123
PID 1076 wrote to memory of 4560	1076	chrome.exe	124
PID 1076 wrote to memory of 1684	1076	chrome.exe	125
PID 1684 wrote to memory of 5312	1684	qbittorrent_5.2.3_x64_setup.exe	127
PID 1076 wrote to memory of 1824	1076	chrome.exe	130
PID 1076 wrote to memory of 5880	1076	chrome.exe	131
PID 1076 wrote to memory of 5880	1076	chrome.exe	131
PID 1076 wrote to memory of 592	1076	chrome.exe	132
PID 1076 wrote to memory of 592	1076	chrome.exe	132
PID 1076 wrote to memory of 2176	1076	chrome.exe	133
PID 1076 wrote to memory of 2176	1076	chrome.exe	133
PID 1076 wrote to memory of 3260	1076	chrome.exe	134
PID 1076 wrote to memory of 3260	1076	chrome.exe	134
PID 1076 wrote to memory of 5440	1076	chrome.exe	135
PID 1076 wrote to memory of 5440	1076	chrome.exe	135
PID 1076 wrote to memory of 1904	1076	chrome.exe	136
PID 1076 wrote to memory of 1904	1076	chrome.exe	136
PID 1076 wrote to memory of 5060	1076	chrome.exe	137
PID 1076 wrote to memory of 5060	1076	chrome.exe	137
PID 1076 wrote to memory of 4852	1076	chrome.exe	138
PID 1076 wrote to memory of 4852	1076	chrome.exe	138
PID 1076 wrote to memory of 5076	1076	chrome.exe	139
PID 1076 wrote to memory of 1372	1076	chrome.exe	140
PID 1076 wrote to memory of 1372	1076	chrome.exe	140
PID 5312 wrote to memory of 5132	5312	qbittorrent.exe	148
PID 1076 wrote to memory of 1348	1076	chrome.exe	153
PID 1076 wrote to memory of 1348	1076	chrome.exe	153
PID 1076 wrote to memory of 3936	1076	chrome.exe	154

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\FlStudio25.torrent
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:628

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5164

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff46ccc728,0x7fff46ccc734,0x7fff46ccc740
  2⤵
  PID:1596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1656,i,999370991359069646,6793874898478953190,524288 --field-trial-handle=2028,i,3973822743150186392,5302079723935274717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1800,i,17264647635742220940,16814108059859868194,262144 --field-trial-handle=2028,i,3973822743150186392,5302079723935274717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:5488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,11687416389730706197,10984106655183532275,524288 --field-trial-handle=2028,i,3973822743150186392,5302079723935274717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:3748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3300,i,6220751643735277086,5146240390559338367,2097152 --field-trial-handle=2028,i,3973822743150186392,5302079723935274717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3016 /prefetch:1
  2⤵
  PID:6096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3320,i,7611237442372569656,8490228537863150136,2097152 --field-trial-handle=2028,i,3973822743150186392,5302079723935274717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4544,i,17419161355160151062,6876682588312559603,2097152 --field-trial-handle=2028,i,3973822743150186392,5302079723935274717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4548 /prefetch:2
  2⤵
  PID:5552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4744,i,17437289250715177550,1453139912299014359,2097152 --field-trial-handle=2028,i,3973822743150186392,5302079723935274717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:5212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4972,i,11331407633903479394,16937642736963791118,2097152 --field-trial-handle=2028,i,3973822743150186392,5302079723935274717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3448,i,1223336500448148766,14900059036279968080,2097152 --field-trial-handle=2028,i,3973822743150186392,5302079723935274717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5816,i,69690496732798459,17565607429193872701,524288 --field-trial-handle=2028,i,3973822743150186392,5302079723935274717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:4168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5936,i,213209209688726299,2571244900530806174,2097152 --field-trial-handle=2028,i,3973822743150186392,5302079723935274717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4984,i,8987230508086724375,4210114023030768853,2097152 --field-trial-handle=2028,i,3973822743150186392,5302079723935274717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4712,i,10552564017084567106,9706768772197558779,2097152 --field-trial-handle=2028,i,3973822743150186392,5302079723935274717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:5548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3480,i,2404750192811193680,16340126948625872189,2097152 --field-trial-handle=2028,i,3973822743150186392,5302079723935274717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6080,i,719816704975498493,16267893329409201057,2097152 --field-trial-handle=2028,i,3973822743150186392,5302079723935274717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5204,i,4044822309775255889,15661592694177470592,2097152 --field-trial-handle=2028,i,3973822743150186392,5302079723935274717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3732 /prefetch:1
  2⤵
  PID:5364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6468,i,11014356082840039939,7733876304385933485,524288 --field-trial-handle=2028,i,3973822743150186392,5302079723935274717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6500 /prefetch:8
  2⤵
  PID:228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6464,i,2997045300693997187,4660561060578483684,524288 --field-trial-handle=2028,i,3973822743150186392,5302079723935274717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  PID:2976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6492,i,10028974002952933636,10437437569876949915,524288 --field-trial-handle=2028,i,3973822743150186392,5302079723935274717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  PID:5708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4560,i,9817018335371877135,5607085328628276700,2097152 --field-trial-handle=2028,i,3973822743150186392,5302079723935274717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6488 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6376,i,11533615317251801013,6924656049456066185,524288 --field-trial-handle=2028,i,3973822743150186392,5302079723935274717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4540 /prefetch:8
  2⤵
  PID:5260
- C:\Users\Admin\Downloads\qbittorrent_5.2.3_x64_setup.exe
  "C:\Users\Admin\Downloads\qbittorrent_5.2.3_x64_setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4560
- C:\Users\Admin\Downloads\qbittorrent_5.2.3_x64_setup.exe
  "C:\Users\Admin\Downloads\qbittorrent_5.2.3_x64_setup.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Program Files\qBittorrent\qbittorrent.exe
    "C:\Program Files\qBittorrent\qbittorrent.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - Modifies registry class
    - NTFS ADS
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5312
  - - C:\Program Files\VideoLAN\VLC\vlc.exe
      "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\2 Addons\Optional Features\Stem extractor Windows\data.mod"
      4⤵
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      PID:5132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=7052,i,5266846687489799862,15231562031661294953,262144 --field-trial-handle=2028,i,3973822743150186392,5302079723935274717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7032 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=3652,i,2448429627970098190,11779509049420412798,2097152 --field-trial-handle=2028,i,3973822743150186392,5302079723935274717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:5880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6332,i,4984790694886321033,12273984351489655979,2097152 --field-trial-handle=2028,i,3973822743150186392,5302079723935274717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=3712,i,7654416751409305110,18295214385931399473,2097152 --field-trial-handle=2028,i,3973822743150186392,5302079723935274717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6872 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5252,i,5949442061397396105,3697133410705572425,2097152 --field-trial-handle=2028,i,3973822743150186392,5302079723935274717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=4656,i,16756546588908308420,14443833414371785695,2097152 --field-trial-handle=2028,i,3973822743150186392,5302079723935274717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6876 /prefetch:1
  2⤵
  PID:5440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=3696,i,3412398272055518158,1409199614930284537,2097152 --field-trial-handle=2028,i,3973822743150186392,5302079723935274717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7264 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=7372,i,14808044581546763326,17394119586682117572,2097152 --field-trial-handle=2028,i,3973822743150186392,5302079723935274717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7340 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=7492,i,10852341312983659842,440215239381474255,2097152 --field-trial-handle=2028,i,3973822743150186392,5302079723935274717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7476 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7700,i,8861830389447168371,13492105267659862589,524288 --field-trial-handle=2028,i,3973822743150186392,5302079723935274717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7712 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6984,i,4494606006004105760,7036172528942361915,524288 --field-trial-handle=2028,i,3973822743150186392,5302079723935274717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6944 /prefetch:8
  2⤵
  PID:1372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=5084,i,1641939364471885971,4414450239981773306,2097152 --field-trial-handle=2028,i,3973822743150186392,5302079723935274717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=7364,i,871628697154956411,7947047087534293082,2097152 --field-trial-handle=2028,i,3973822743150186392,5302079723935274717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6824 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=3732,i,3756391226071150157,13377265617837158251,2097152 --field-trial-handle=2028,i,3973822743150186392,5302079723935274717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:5920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4628,i,4503553054801542791,1882181694414884353,524288 --field-trial-handle=2028,i,3973822743150186392,5302079723935274717,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6440 /prefetch:8
  2⤵
  PID:5060

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5908

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3552

C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\flstudio_win64_25.1.6.4997.exe
"C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\flstudio_win64_25.1.6.4997.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Exteriors.nfo

Path C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Impulses\Exteriors.nfo
Size 29B
SHA256 c5705dd82713be76cc5e4c1930589106d67cab8b6e905768a21233c77387db31
MD5 c9e2cc184f1dd73cd5a66abcd8c6e0cd
SHA1 ccb180bc3ef502a872f88d591a90571fd8c61fae
SHA512 addbac550b8d084e8fb95cf82d7ccb13acdf434b2aaa63b8e7b8bc09a9cc0e5ecd8d8121762a0de6eb69d8ac4f07d7ae9b5b0969f72d36f5b042d76df181887e
MD5 SHA1 SHA512

Submit Download

Monster Kick 005.nfo

Path C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Drums\Kicks\Monster Kick 005.nfo
Size 36B
SHA256 f55f810b44800b37393cc2a97d85595f2a0ea3cd9c4d4416dc00c9dc8badc3d6
MD5 1406de33f68d12ff32f186da3a596309
SHA1 0d4c28f3f5a9290c553a33312bd0686ddda28eb2
SHA512 143282705c3c19a24b217653b8af2cdb5378a4adb0b5093fca2643a38be74f4fbc06e9551d75f854091855ddc401fb65ae4560aa865a638346a831e7b9100d0d
MD5 SHA1 SHA512

Submit Download

snare 4 v7 rr1.wav

Path C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Drums\Kits\Groove Bias\snare 4 v7 rr1.wav
Size 9KB
SHA256 f8c31012d32c60da332a6204133b832e610a38ba9506e42606fafc6d9b77053f
MD5 d786090570f1b09f694aef4b78b5fb44
SHA1 bb063717c78da303499bb0239ab6de0cd99ea079
SHA512 25cabe81af1c5ccfb45de1c37f2064a4784842a1c03513a6ac59d5e5d49de684961a683d2dafa269087fe5b88b7f0551448f5a9cbd8a490a81cd30822ba7aed3
SSDEEP 192:uttxO3uNllsUkdZqeH6QIk1kX+b074AT0cPnlvifGBUmfdxkrMeSxQ:utDwaHsNaeaQ0V7PFXheS2
TLSH
T152126BE18434D5C1FD072473B1B297E745923E3476D052CBFF8042AF296EEA5B961439
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Olbaid Compendium.ini

Path C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\FLEX\Packs\Olbaid Compendium.ini
Size 18B
SHA256 e8fd8720e3d84008209b45c361f2e90d290f88360e592f47e0bb44aa1552c48b
MD5 59dc9b1de18367c8e25e9cac3ce92891
SHA1 eafe36a79fab4d9024198cd21702b168a89f7741
SHA512 2aed289f436943243398cce293eba988f9f7a9a47e592fbaed897681bf7c3c0a2854e4f152803c463945652354ffab1e89ae2069947de2bcf1ffb86451a9fbdf
MD5 SHA1 SHA512

Submit Download

RD_Hat_6.wav

Path C:\Program Files\Image-Line\FL Studio 2025\Data\Patches\Packs\Legacy\Drums\RealDrumkits\RD_Hat_6.wav
Size 5KB
SHA256 2f68d1362865ec229d560d6b4748ef7659696aea5294d5f1bb447bbb61023c39
MD5 dc5fc06e1df47fadd5f1ec4a4a5b2aea
SHA1 ed79736a5c4fad63616084c85d1bd64956d9c0f5
SHA512 2d4b6d03c4b845d641729b24f1dc3332aed8e04165022410200aeb4b45dbdcbac9d132700a99476cca88e6b4b2d23684f56bbd242e97ad81ccdefafd4e2a0ff0
SSDEEP 96:HptjZytrqSBjNhyBhW+GCqI7uhhJ837UdgnCijwJhYb9t7cujLGKpekwAJQg4:Jvy5nBjHyHWGq0o234gnjw/Yb9tw5QJa
TLSH
T198B14A4EF208A98FE51704B218B3E73686E1B27017F9D717E67A325A4DA3982795C1CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qbittorrent.exe

Path C:\Program Files\qBittorrent\qbittorrent.exe
Size 41.3MB
SHA256 f69360ae8545a64f4fc84fb6bacef03d77a6aa0793a4c14d4a28651ca26a27d1
MD5 0ac96cecadaa65abdcd587c9b4554e82
SHA1 70db70b82eb49a2bf1bcf6079c56c5f929c23d00
SHA512 a4ec9f241c815de4a50b6c9fd50408c4d593ea9580f7c220fe3d7d7440fdbbdb80bf3246a049e5b38a2cb85fb8d01357bca3db752fd9eb996a6d12e903ea0c7d
SSDEEP 393216:d1cQ1hWhcknyRLhIMYIB5mH4yU2lT4IKEXERyJdgsoGQn/tnTfKFdu9CwJsv6tai:c4yUK0BEXEgd1XQ/tT44mO
TLSH
T13897AE56A7F80195E0FBC27886679113E7B1B846133497EF02A496B91F73AF05E3E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qt.conf

Path C:\Program Files\qBittorrent\qt.conf
Size 84B
SHA256 fdb8fa58a6ffc14771ca2b1ef6438061a6cba638594d76d9021b91e755d030d3
MD5 af7f56a63958401da8bea1f5e419b2af
SHA1 f66ee8779ca6d570dea22fe34ef8600e5d3c5f38
SHA512 02f70ca7f1291b25402989be74408eb82343ab500e15e4ac22fbc7162eb9230cd7061eaa7e34acf69962b57ed0827f51ceaf0fa63da3154b53469c7b7511d23d
TLSH
T11CA012E02135B2104063430303DF4192303C81C030333D1C6304001A5E01C0A0776E50
MD5 SHA1 SHA512 TLSH

Submit Download

85cd443e-2798-430e-a03a-064c37cb9b9b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\85cd443e-2798-430e-a03a-064c37cb9b9b.tmp
Size 13KB
SHA256 56cba7f0df233b9f39aaa1c794888fb928b7ef35cee4c8ee9f52efacc66acf14
MD5 18d3d0577c7aa3de9dd9422db92221e4
SHA1 c0919d689bc298383db97f986e6997cba86cc709
SHA512 187f3b454a0fce1a803dc5016065ce8c49d6609d2574c400e72cb681c2c761a78cf576572f342bc2e0b75816dce97a59f8635148ae9565848f89ef9a0e1477d7
SSDEEP 192:WRXcBz7Gm/flN+v7cpAPRp2qFyU/9BHsb+WND6oP4BO2eK2ZewgqVyIsnAUge:WRXmz77/b6wUXlBrwZf2B2rgqe
TLSH
T11C52E92EAA2029BB5CDBD22AF9667B57E3F5102225802DC0E7FC897C14E76CD3117417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 382b7450a1fb0d3f0bc95abc1a69b8cb82ad4a7fbc3bf3c085ec514e0c354750
MD5 b167068ba13a50fafacdae975b526c0c
SHA1 abdb81f043f0d4f2c8e07c093d8c454309e2077a
SHA512 cdb7648d04ba80730575d2d1f2a417e7ad4c9e2eb51799791d32252ef19411cb91721f9169dcf76142558043a0d91259549395c3a500dc7eea36eea262988d6f
TLSH
T140E02BA9C821AC270DFA5B6860100B4AE755031A3F90C85F3B3DD20D8FB5A3F8567C2C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000014

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014
Size 22KB
SHA256 9c4f02f38678f2628292d66c4f7a1a6a06af7ffac4d279359b09074e7d0f1fe0
MD5 9e38e04780525a20f28d6c455901b2cf
SHA1 9a8514b5e462d06a2b6a4f31e60b97c48272f58c
SHA512 15efa4e8efdb92442e270606f13948aecbf4902a7ccba2fd186bb0bea52feb59530fc922eb4ab603c70cb8cdd26b5d5b2d8318d0cf61f26a96099df38dc694dd
SSDEEP 384:Wnkgg5ugJYnmChrWRPP8mVjX23owWnt4Powv5/cwR2TkqOOCjc/V:WkgY2mcmVzhwK6AAkwRbpeV
TLSH
T18FA2D0EF49DFF985CA334058F4FF0CB982365178E7AA60EF1194969660888F24432BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000015

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015
Size 21KB
SHA256 6f32da94d4f26e98cb6ccd97034d306aa38945322c816f54a93c7d15dc0905b8
MD5 2c20035257a126aec473203c38baf276
SHA1 cea71b90976aab1ed5d2c1324bb4b09be960e15d
SHA512 c94fb11cae0ed5a7870ac53453e1917fa4e09dde68048a48071798b03c395e97efbd55b45a0360775525bbfd2a24e6d81ea0cb9ccf0569716735ea4d02b50465
SSDEEP 384:X7cRxmywBqrZEV4zWI1TdquIrkzoCu6DzCgpGhH7P2kqwV3fofML:X7cRYdMWI11gZC/o72kqwV3fofML
TLSH
T1D0A2D055FBA8B200E768257A25EC85D9C8B83F318599BF0DCA6B40C60D73DBF06CD192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000016

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000016
Size 24KB
SHA256 f254eb93b015455a3c89aaf970631bc989fe2bd387f79e871b514992359651aa
MD5 5366c57b20a86f1956780da5e26aac90
SHA1 927dca34817d3c42d9647a846854dad3cbcdb533
SHA512 15d7127970436f2510344600f3acecc19c39a05f8e82c8a7950095386382b2e2da55883a5a9faa97b84452e67315b9ac1693b6592274c8c1c35c813dfeb543a2
SSDEEP 768:ZfRLYs8uBykIQZ6yXBeQOS9JUmBgKYTbgVec:vsbmrDXwEfUmBgKYTc4c
TLSH
T18DB2D004F02ACA26E53655B371E82BD54CB6C4CAABA9935C113520AF3ED3F48C991673
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000017

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017
Size 24KB
SHA256 a3cf4861c7d0c966f0ed6564f6aad6b28cbd3421a9ca4f60e2246848d249f196
MD5 344ee6eaad74df6b72dec90b1b888aab
SHA1 490e2d92c7f8f3934c14e6c467d8409194bb2c9a
SHA512 2a9a9162d610376512a8fae2cf9eb7e5146cc44c8ebde7a12e9a3985da1718c62ae517c25b00de7c0269efab61b4850a0becfbf04382a25730dbe9cf59825a62
SSDEEP 768:RMxowxdaCb0WaY4P8keYUej86bykBRWIsna:RM1r0NY4P80j86bHtqa
TLSH
T1EEB2E0EEEE552E4CE2F059B4962B734B8A46F022191F947832E7844E8F494C24EDE477
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000018

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000018
Size 76KB
SHA256 e8555f5a3de74c17605f8efdd5600e3f2faf4722d1f9bfcb1daffa802a63284f
MD5 e85a226f3af5d7c619de6be2b6ab9a4b
SHA1 b78e6fbdf51cd9a8bc1a969c330ec861716b8d35
SHA512 650d19e3f03645145a9ab09f19b9c85287333c2e393220f7c8e3cca11eb0d4bc181ae4fa28ea6a41b11cdb797956eed4e8304ec2fe3776ef96b9531af40a90cb
SSDEEP 1536:NP2s592WtuNCcRZAJF2j9hiW0rSrhiaV6W2dAbx7g08xvZAkc3vy+43GIT:N9592yECcRiJgJhiW0rnW2dF08vA3K1t
TLSH
T1377312F27ABD11B1606CDC3E9BCD19B6B9BBB4863460E0C22C85EEE15571A73573211C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000019

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000019
Size 41KB
SHA256 0e2e6d1994902577a3d3a7f0e37875dd22de26342bec8403ebe262f92f2eddd7
MD5 a587d1a659231c3c59460569a5564da7
SHA1 eb542e028c0b1d2fd44d24b15f20176a26255d07
SHA512 73c9bfccbe137b51140469d22c9469ccda975e6caee5402a819a4629d1d5a23664e062e5f96271c1ca37b2f737e39cba6f7c25d25c0f1a3d7a31394ab8ecd814
SSDEEP 768:aS1GIh+o3q6EIwVfpJWMT3PHw1ALy+wBAPYqaia1PsbtUZE5JCaUvZGJatEG2fhN:aq9/EIwVTT3PHGAmPXRiMPmoKkHZGJau
TLSH
T17313F1CCED8DD55C266FF1E788F8B6B35468BF818819D336A4A067DC0724803743BAA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000035

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000035
Size 81KB
SHA256 07e8b7f6011c1ba8b8248c36216f7b80e814c872609115b73f2995adde07b91e
MD5 6c940674500f3c2b95ee13333a5c8ed7
SHA1 baacb500d3dc6fe3b616175acae3ead350de9f36
SHA512 923fcc59936d654ace9c1fdb4aa387d991f8176b09a2fe9e696bcb420224d22df9a096f113d00c9fc614e3303fc811beabf9a40130175b3501e55dbc9b290d33
SSDEEP 1536:EHQXHVH7y2rGwOeukPjZRLifG9+cRBI6ZiXyGtrasRdX0duNsqpK89:fXJ7DyTqjZ5mgI6ZiX5RdXIuNq89
TLSH
T1A783022ADBE56027B024CF1900EEA285142AF42F575A5725B00E83F2E5AFA97DCDF453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000062

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000062
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 b9136c2a9013db202aee5899e00aabc098f77206679dbcf5f205977a6dc2550e
MD5 940ac0c9100cbba5f36747bb5c09111d
SHA1 edb242cc6eecb68fcb729c0932aef85617953e12
SHA512 b72b9902da8131fffdc705422f0bfa68d50b71724438c8f9e5134c1cb0e00c496a4d9949092e5315c56172a987e6d69d787d78af605d3cc16318e882e3047670
TLSH
T11311BD9584B5732CCBC821B0F8D94B4A35BAC2974E8FEBE361819F7623E5FB514C6051
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 43222914319602455f999807191b3d903363a0e38870dfdbdad3357a2abbe032
MD5 5046f6e9cc84393e002a7f8aedef3eae
SHA1 437eaf9548829e08e95a5cdfbef3189290343811
SHA512 ab69d1d869adb37835073397b11e678ea824dfde13468ff12221cec359395f01a8d7a20940c94c2afecd5f5ed611d63835914b05702ff06e0d606d5835a1dffe
TLSH
T19C511F5580D1B228CF84047075DF4ACA34F9C2461E8BAFDFD082FEB925FA3A121D115D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 8f022067636c5dcc1854bfd5de0d365faffea1c0b25f85d842864ed84a03df28
MD5 833957a917c497ae429e1e6f2bc1bc4c
SHA1 67ba68eb8113f9a66a89579066c92ab06682198f
SHA512 59bdda4841096401bf465318641953567475d2feb41ca44df83051d9f59cc00e78040bbeb08732ae7f998d23c83a8581a7d5c7798e75b019215ee09b07198165
SSDEEP 96:EwL60LgjL1k2QGeLVxDj9giCMojyQ1vLS9BKn:EaoK2QGeRxDj9gBkQ1vQKn
TLSH
T1BF81B7458080B624FF80D47065DF49CB34F9C2666E5B5FCED085FABA21FA3A020D15AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_limewire.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_limewire.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 5d6af0a479157532571856f789833aa8fa8410cc9fc91024d8b96da32ba115cd
MD5 bdb0ba1ba7c8f338ae6ac78db169f58b
SHA1 72474a7a7e75ecf4811958e4122b37ec321eeeb6
SHA512 adb1e62bb5b3f5186359a38db86aec1f2e5177362e16254889648e4a5668c5e4e3ebfda72becf8cce2669cb01404fc947ed91b9f927d25b6ac100b1a014c07d7
SSDEEP 192:DoUOwA6h/jrSXbaI/LQgPNyN7Cf0hZFodfGbHiIw6:DoUOwA6h/jrSXbaI/LQgPNyN7Cf0hZFp
TLSH
T1FBF1EDF3C3D8C66D896156F4A7247F2BCE2D0A18521C3C66C8E5BE5F63E2472E20164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 2873da53972e35f7ee9ac09d3e791f820074e6e83fc0867247a6f6989a082470
MD5 3f752a4853b8265d03762bf807a5b876
SHA1 6c7b15ef13f908dca92502e30f42f9cfdb50360f
SHA512 4cb0801bf0f14551ec1a40e82bbc87d475a17ef44a51a8c451ec420f528892b51b282ff852a1812016670bf37b6a7dde75f6e86c8e96d110262a369ab9b9f41e
SSDEEP 384:Dm0uitxhDPMibjlG5fK0LK0eEMIYJxRqJE6EaI/LEdPNSZ7UmNhZgoNfpiuF34dZ:LP4yc5v8Bgb
TLSH
T161627CF787F49A6DCD2152F0AA156F1FCE2D0924432C3C66CAE4AE5B93E2471E24174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 17KB
SHA256 55c934fc106b41ad4ae4ada7f626671c497d58d6c9bfa6cd8edb7ce974e1e7c4
MD5 555e3b585808af8e1e5d09b7755f2828
SHA1 f0450ee7eefbe46c41a7c83f41d3de387491678e
SHA512 439fd6838fcd401ad766b10ec4c7d4642bde05d1498be55be40c98a39090be6dab4e58b5c67cedbd5ce0fb6be6843dc3fd3e8e395afd2229fdf0791323f9733c
SSDEEP 384:Dm0uitxhDPMibwVkKlTWTKkJePfvBJAFRJ6aI/LEdPNSZ7UmNhZgoNfpiuFPXd7P:LuWmcb4blD
TLSH
T12172ADF7C7E89A6DCD2252F0AA156F1FCE2E0914521C3C2AC9E5AF5B93E2471D20174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 16KB
SHA256 83a0997b011c8c03e30b73d3c62f264c386e17273bdaa7d2a278df354b529193
MD5 21d305eae1daa8b5d3eb227e22fdddd0
SHA1 4a836dc46e1500dc69ef0c10d7f5281616c0bf81
SHA512 def521ca434a21b9b173654ac3907c7f5d1f9aabf349071bdfdf6a489d2a153ebcbe63a12a94d63d48dc035e0b4226b55e159b06311f4bdcbbddab2cc61ab306
SSDEEP 384:Dm0uitxhDPMibwjlG5fKTKkJePfvBJAFRJCZaI/LEdPNSZ7UmNhZgoNfpiuF34dy:LhWoc5mblx
TLSH
T1F872ADF787E49A6DCD2252F0AA156F1FCE2E0914431C3C2AC9E5AF5B93E2471E20174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 41ae1148f828f25bfeb57043358c010106ccb71ea56ed828992cef1febf7204d
MD5 0bcb5c2145bc3306ec92a513546fbaf3
SHA1 07c5e5a12b4705630516cd968d1c294584878f86
SHA512 2d723c60a8fdf8f801ea0d09b56dbee33f01bfc9e3114febc4a3fe7ecf2ed6a0f6d0048f94b8f96d55c9c660e06507c46d870030916143cbef9a65eba40b1f6e
SSDEEP 384:Dm0uitxhDPMibwjlG5fK0LK0eEMIYJxRqJCZaI/LEdPNSZ7UmNhZgoNfpiuF34d0:LK4oc5v8BivM
TLSH
T137628EF787F49A6DCD2152F0AA156F1FCE2D0924432C3C66CAE4AE5B93E2471E24174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 21KB
SHA256 0dae556e22bfd2b3e9cc00ada10ea73e6c9c735816a34c17739cfb0c0e74bb38
MD5 63585c1599e2efa1029529193d6cb243
SHA1 d1e3f7d19da499f1a1a2a04651dab2395b265bdc
SHA512 13ba27e56bc88952a743757ee7d219479125ee2056aae060b667c5ad353b46c84c60a82b65cecd2ffef2601be59a7b2a3d988a6278e6935c2727fdbb6c924b64
SSDEEP 384:D0uitxhDPMibjlG5fK0LK0eEMIYJRqJE64+f6dpmimtIkaI/LEdmUhZgoNfpiuF4:IPCec5vX0gm9m
TLSH
T167A2CEF787E48A6DC92152F0AB157E1FCE2E0924532C3D26C9E4EE5B93E2471E24174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 18KB
SHA256 cb5eab98d5003de499e202c8a44e16d96b305344692ba874b93064efa554c178
MD5 a5c6e645d79dc3bc81604aca0bf40fed
SHA1 f290949ccab4b561ac17d337c06372dd51bcd3fb
SHA512 b96b5c399f8252d021c4c2219f9f65600b0b4bba267c491673384b1902af054be02aef718897013f8267479b84e2d7b808dabcf1817d4e951271df1b794d2cf0
SSDEEP 384:DoUOwA6h/jrSXnVkKlTWTKkJePfvBJAFRRaI/LQgPNyN7Cf0hZFodfpiIwiTXd79:9cW2lf4blp
TLSH
T13C82AEF7C7E89A6DCD2252F0AA153F1FCE2E0918521C3D2AC9E5AF5B93E1471D20164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 484a404e34d2b7fa8b0da9c2ec0e2eecc3274d08c704022e852efa7851272463
MD5 a6b6caedfc2c7d8c186c290e02686392
SHA1 50e90f8d6b9229817d1fa4f61355e3bd0c8c5d8d
SHA512 5a329584d4503e7caf59f965c0ced53cfdfb388f760d45da7edab626d7e8abdeca095eea59b3b64b1d1b3d4b0f32e64b50aa53a7f4a568e56106a289a91ec2d1
TLSH
T145517EA7D67EF897203C4DBB1E447C092A7EB8360682A4F9DB66813CB0844F71F16426
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 7383cb3553f5d5085a32173296a50195b08bd286ed5225a7c6837c12b7a5fd4f
MD5 07a6ffb0527513cc547d46aa9cf90c22
SHA1 6dd840c61b42702ea98bb65fcabd045ca2f59145
SHA512 08fc0ae645a3d7f561bd8d79a5c18cffd363f6b08d66f247a08e83b277c4bd5b378ffb8419b2595c3eb65bb8e4e2f8e8a9fd58f7465b88dc8290426750d1e7f5
SSDEEP 192:WRXcBz/Gm/flA+v7cpAPRp2qr+0yU0b9BHsb+WND0WKyGN1oP4BO2G+K2ZewrqVK:WRXmz/7/O6wUXlkrwMTNif2Gh2rrqe
TLSH
T10C62E92AA92029BB5DEBD22AF9167B57E3F1102225812DD0E7FC8D6C15E7BCC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 9a99268a3499b843ae7ba3337868350abd97a53d71fc9637d2c440e6c22a4beb
MD5 0fef8d0287b57b583b340d838b01a0da
SHA1 114cf6790b5d51c72f9bf68455dd2c43564c2204
SHA512 86d942781a2541e08d4f932d8e7cfe26ef3770bea1b61a1cbe3b636c30cdac413c30f5a91c93c1fa1e14fb83431e480c9e107c110392f8b25f59501ca53e2f3b
SSDEEP 192:WRXcBzW1m/flTxv7cp4PRpqqr+0y910b9BHsb+WND0WKyGN1oPUjU+BO2BK2Zew3:WRXmzWY/VhwUXJbrwMTNiRl2Q2r/qe
TLSH
T15C62E82AA92069BB5DE7D22AF915BB67E3F1102229801DD0E7FC8D6C14E7BDC3117417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 dca658d20314a65a5f14fcc1010581ac6e3c487c979c6ea1e5554066e1a915c5
MD5 1bc50b92ae78ce1bab7ca34a508ecddd
SHA1 da067f54c378054289bf99e5b3e56333b6d3c533
SHA512 48574347838eb5b2e36fea02eb44607052c5edfca8b6a7899134afc2c80339ad988d52e2a9ae8e282eb50c4c71a89a3a8960e351b89e29bc54f7f43ed2f7228d
SSDEEP 192:WRXcBz/Gm/flGxv7cp4PRpqqr+0yU0b9BHsb+WND0WKyGN1oP4BO2G4K2Zew/qVK:WRXmz/7/EhwUXJkrwMTNif2G/2r/qe
TLSH
T1FC62E82AA92029BB5DE7D22AF9167B57E3F1102229802DD0E7FC8D6C15E7BCD3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 479d8d0119357e7b1d29a6dce427c8b46962fdb743d46aea475859f650aeee9d
MD5 d75a9349d0341e65cbce52be9fe997ca
SHA1 377a7cab1b4cace78add9ed813009003fd84b2ca
SHA512 9a8526ce832c421029f73efe04c10dfa936126ed7f924b22d623046bcabc656c02dc6d381d3600f9ddc2a4a9c8cd84d9d8d5ab5184721285f8ca7eb8d0a19070
SSDEEP 192:WRXcBz/Gm/flN+v7cpAPRp2qr+0yU0b9BHsb+WND0AoP4BO2pK2ZewgqVyIsnAU/:WRXmz/7/b6wUXlkrwCf242rgq8
TLSH
T18F52F92AAA2029BB5DEBD22AF9257B57E3F1102225812DD0E7FC8D7C14E7ACC3117417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 e6d3a7acea5199b35323502d719e9f361c358e726dabe79403ae03dd3c02437d
MD5 815e6dbf922b58bfecde161c506e4377
SHA1 33a94fb28fc1acc3a97a56777b925ef9201a78a9
SHA512 0ccd1b4d107f7bd39ed1d4494e779f4a5fe404f89fab67c017d1e74cdd34a2f927d5f08bdd95c8f4de7af4ae8b71a06b0ed042aee5051589a3c65e1c0fbf891f
SSDEEP 192:WRXcBz/Gm/flPxv7cp4PRpqqr+0yU0b9BHsb+WND0WKyGN1oP4BO2G4K2Zew/qVK:WRXmz/7/BhwUXJkrwMTNif2G/2r/qe
TLSH
T1A362E82AA92029BB5DE7D22AF9167B57E3F1102229802DD0E7FC8D6C15E7BCD3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 24fcc5a4a26a318f6c89376fcd9ef8a3da64db64330c9864db794deec03a6510
MD5 02437ac2d8f62fc25012661a434741ba
SHA1 86750bbd9fb667a26ebdb74f96515d2c7e9d4352
SHA512 aeb018b159cac1f052026495ba8895331e95e93577fea65c38e2dce3aae088390e106d6a37ff08c7c660b2cc3989fb6fc67e792bc4e86e43f835482521ab92c4
SSDEEP 192:WRXcBzW1m/flTkv7cp4PRpqqWE+0BB10x99BHNDHsb+WNG+aWKyGN1oPUjU+XMW5:WRXmzWY/VAwUXJUJrwGTNiRRWk2r/qe
TLSH
T15772E82AA96029BB4DE6C226F916BB27F3F1202229C01D90E7FC8D6C15E77DC3117817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 797143926d4b1fbc73de00599743279c0398073ba098cf95ec17dda8e5854d24
MD5 5d3ecdb56c3e1532feb1d4d859a63372
SHA1 f1ed1030dbdf4cba7109c0bcaef09835c3909c97
SHA512 62514907be2cb12e76bef9f3bcfd7525e1ae5070265b7aff1c32867b2e0b2bb4021d5ca517e292a53b9740f4f0d8d46fc75fbeca54bdb0dc33bbc7fe85fc9ee7
SSDEEP 192:WROcBzW1m/flTkv7cp4PRpqqWE+0BB10x99BHNDHsb+WNG+aWKyGN1oPUjU+XMW5:WROmzWY/VAwUXJUJrwGTNiRRWk2r/qe
TLSH
T11772E82AA96029BB4DE6C226F916BB27F3F1202229C01D90E7FC8D6C15E77DC3117817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 3569e1192709254b2ca31366be4756e36944494d15e31bb439910b873f21d4b6
MD5 4cf13e4cbf798c14abae5760b60396b7
SHA1 742110d93ce2f65dcca961f4a604c0b056980783
SHA512 93ac4bd5036e79e39a1800d70e0b7371ca914482ed944d218e7f00a4ce4ab4429dfdab76de6062ad5a0c2af4d5aba8d1f3c4375d49c3d837e4c7e407de1ce8c1
SSDEEP 192:WRXcBzWGm/fl1xv7cp4PRpqqr+0y910b9BHsb+WND0WKyGN1oPUjU+BO2BK2Zew3:WRXmzW7/fhwUXJbrwMTNiRl2Q2r/qe
TLSH
T1F662D72AA92069BB5DE7D22AF915BB67E3F1102229802DD0E7FC8D6C14E7BDC3117417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 bb5412911b7fab0f17e4e40fbb6111f9dc06b3a7e6834e73e6efb251a6349ce9
MD5 e72cf73441ac04001a1197903b1d15a6
SHA1 cedb3ca1a612a56c9bd19dcac64b51f6ec07a37c
SHA512 40e5cf0d3d6983c13e2fb96e72f7346c198e0b94494c7a4a0e10bc1a3e53b7f9998e091a2f033520deb84a7b3d0d1698140341299fd336d540d988d31d08d04b
SSDEEP 192:WROcBzWGm/fl1xv7cp4PRpqqr+0y910b9BHsb+WND0WKyGN1oPUjU+BO2BK2Zew3:WROmzW7/fhwUXJbrwMTNiRl2Q2r/qe
TLSH
T18662D72AA92069BB5DE7D226F915BB67E3F1102229801DD0E7FC8D6C14E7BDC3117417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 3c139435606fadb17eaad9ea5cbe72a8b5b5183edd976061ef8fed37c42a2418
MD5 06517052e4074c0afe675eb764523fb2
SHA1 b3525369d15171e66f26ac9f28e950e64b1c27bf
SHA512 c91b23060fddd0918390269fafc02478b36c3d11f84b6abf89b1b62b7daa2967fd73a0124ff2a3a5f6971c626e2f9e3df28d30cc0426640e52f828d6ed91ebc3
SSDEEP 192:WROcBzW1m/fl1xv7cp4PRpqqr+0y910b9BHsb+WND0WKyGN1oPUjU+BO2BK2Zew3:WROmzWY/fhwUXJbrwMTNiRl2Q2r/qe
TLSH
T18762D72AA92069BB5DE7D22AF915BB67E3F1102229801DD0E7FC8D6C14E7BDC3117417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 32e563a0ce6da37bbae37e5193cd09ea8bbc9065763095f306295c6e17210318
MD5 0614c51dacc79a65c21770b6cc6b5da3
SHA1 29d3bceead025d4995ba821bfc93b0979e2ca99b
SHA512 3a1b70a8922ab93b6e8e4582882c3f51124cf80705e71fe8b63a8340b379791e47db43ce4c6ba24ad760242699399d44812751e15a6af340c912b8c2e85466da
SSDEEP 192:WRXcBz/Gm/fl1xv7cp4PRpqqr+0yU0b9BHsb+WND0WKyGN1oP4BO2G4K2Zew/qVK:WRXmz/7/fhwUXJkrwMTNif2G/2r/qe
TLSH
T1D862E82AA92029BB5DE7D22AF9167B57E3F1102229802DD0E7FC8D6C15E7BCD3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 5d438de8cd498684ff9d40999a4a75522d9de1f25bf35e47d6ae1d5fca10edd3
MD5 d244b63f56688215f70a4fbcc82b4659
SHA1 6024c5a247d51bf6e2ae53639af196e7b929ea20
SHA512 0bdb6e493815d5dfe1b6ba26d9f396c65dc74fcef127677127ec97d6231ceac16caa26643d04e7c2924ceeadac9fe0a4a8cf4cfe6fbef1f916d891eba3351dc9
SSDEEP 192:WROcBz/Gm/flA+v7cp4PRpqqr+0yU0b9BHsb+WND0WKyGN1oP4BO2G4K2Zew/qVK:WROmz/7/O6wUXJkrwMTNif2G/2r/qe
TLSH
T15D62E82AA92029BB5DE7D22AF9167B57E3F1102229802DD0E7FC8D6C15E7BCD3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 844d3ec03467232c0b0b31852592e1d5bfd1b998c353219bbfd11d0dd2534c85
MD5 248039e3512518ae98cef47428956f17
SHA1 6b50102f479957e0c5bdc48e63949ea63a96eae7
SHA512 56f6fa2b67411fc0644fb1c73d9ea2b6838fd695e4701b9f0083f58780d47178025347ce2472b1dab91a02f1555f53e8546aeb65ea769478c186dc3b4f42e72a
SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcSjzOXODR0+ErU3DTHGENMAYw:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7p4
TLSH
T13872E9676C4C9E770F94C6CCD8267F4FADB5024B66E9886483FA582503D5BCE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa813c9ad67834ac_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\fa813c9ad67834ac_0
Size 199KB
SHA256 391143c52fffcbc59361a624d68a68ea1d341faf5d1006d073f4adca74b14b13
MD5 50eec00a3ff3fcae98dbb0dadcc717eb
SHA1 ec4f08d69dd109d7d6d0d57069707209b2bb524b
SHA512 7f469ed3e0e8e378a4db3b9ca30a381028a2e1d55fa713789565137a54a3e43776c1ddd4794808ac05e50294b1e21ca2d5cec82f3b7d8782011fd429c7925636
SSDEEP 6144:vywYS/4tg5aRQprexlCZBXftl1nPB/brXsZbBDf:N/+g5acr/X/BdbebBDf
TLSH
T14C148E712979A47387A60DF1C4F50206B37499993488C8B4F7BCCE5F29B698485FBF28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e53116c0cabab18df14c20467488330fd3424a9591be651bd53574d4387686d8
MD5 9a1055a9a0e6387795eef1f650599937
SHA1 4ae304fdde2f2148caa46757d7b8288c5ae4fc5f
SHA512 6f490da6e6f9a940296ce4aed03947e7be21efb52483eab4dae8bd31ee9153e0e00a2e056854c204f33da77f4817ab9deeec02fe3b88e3bbcbc2c4c9434964d8
TLSH
T138B0128084029585C44302B0115254897228AF15A60A570153E4A92AD8266E18015060
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 6f0ffeb6aa5a0552308cb379488b1e26dfaa0189e893fe6a0e5a9b2ed07d3ae7
MD5 3c13e8238950edf8d5a95d10eef032e9
SHA1 6a73cf3084fd3d6fa2d7b72274e104588c8f1c85
SHA512 33985d3cf4f6e4236cda0be50eda5e5926fd4aabbbc87e376efb5a6edb4f57692a1acf466dce0fcced03980b7ff68b60ba9d7184a01837d7bc3555ddc73339b1
TLSH
T1D9C01242C802B0A1C18A03B9145396ECB2689F74DB1A175CB3F46D129C34222C1182A5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 168B
SHA256 56ce6bf60f169e1ee7cc553dd1c50ebf71d09e6fb3fd4909275dea02d100fafc
MD5 3bf5daf7060fcd25ec3c5d1062922534
SHA1 d55bc6d4e6f889a4d06eaab777b69fe3655c4645
SHA512 469f4ef73ce7a28e9b03ab9ed6aa48b653851acf170fc8d62aa573d3c071512a6c5e47801049c0b6ec8ffc9266f989d9ad1321165bbd451fd613305e64139405
TLSH
T158C02B018CC0A051C09103737822A18CF2504F2ECB0E230472A4B8124C34621802C361
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59eb7f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59eb7f.TMP
Size 96B
SHA256 bb7dbbffc78163c9d8b7a610c36933f281acdf77dea6b41969ecbf563ec916ed
MD5 6fbd8d9df4983940d10dfee3e3e5faf7
SHA1 40f92fb3118584575d1336a4745da476346b4f10
SHA512 bffa8800082e06c86fbb07a0c47cac55fd8ab3497f4726685b6e389acab3c0535c97ae9d2aef016044a7cddb62955e455e67f1e711e4c66f40286ce37d595cbe
TLSH
T192B0026AC1066213C04213B0259A99E9717CDF26CB03521392E01A66DE256714A25165
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 2e2ba47ef4aca7c68f64c64a13d0655b7b48ffc01ce2ad76e29ce7ffebba790a
MD5 136cb2c6fe21060d1a48201bb66ac711
SHA1 fbff1c39f174278635d1fec0a8949629e327552a
SHA512 b07aca5db509124e947ff2ca40438816d4738224d1722103b53f8c3572461190ffb9a6bfeefd810156f59439b1008e83053a25444407b43b060e3b49b70af2ec
TLSH
T1EAA0022186910061D84D127061E10152B3B4581206D5026550D15068CD501508939C08
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 b0670850d3a525c077190ee1f79d1186d7a56795723379cd19c33518c923e482
MD5 1376aa1ed75c753797b70f60c3bf15b9
SHA1 cbd9eea0e64aee5dcda060f1d6c1861e72c6df7c
SHA512 1be25b88a3f347fb207fc801a37c3a0fa1b387d499d36bc533c70ef9df9c9af3aec79152336f6fbb3857a3ad2bd8be6a1570ee7ab0d66957d3e0338e3041e7ef
TLSH
T1AAB00219C1614917EE6C43B073E10894B7B19C2553D6C5FA64B021F6C436293D725604
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 5ad994e7b941bc43f0d90ef437270a9b8cc1c3d5e2990f75f5eb7ffeb52c4400
MD5 38d3315d4857950089efb5a4f900c03c
SHA1 27dffc87dac1512150731e4a033052d5378c9dc6
SHA512 490a7a6ba71b9d7496b12171ac21ea5935a7ab03449ceef950c5254c82b6d5e92bf5d3269283576b57764e661a59731884fa4b0a31686a851c689b7b34e6a2e2
SSDEEP 6144:a8i0Aw9NDv+qw5ZtA7FmUi21rSm8uUVNSlzYY:aeNO5ZtAfi21b8j8zV
TLSH
T10E3423316F13DCB3DFC8305474AF5B0D4E98AC11C685CAD31692BB568A9E2CB293F624
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 de3ad6c3f10bdcaf1585e249cb3e93e8f9c845ae782e3c7ab4f5fd7b0eb4594a
MD5 e2032dd9ad886b783dfb34c4e199a516
SHA1 e873d7cb1034f9470b2b4c0d6ba2710b613d87c4
SHA512 c0b5e546aace46dbe92a0f4070c658ea6158f4d780978151c18cceceb475e0ffff3af6fa97d12cbd37858304bbb01280b18b491ac0a7eb7e13eecade063db6a8
SSDEEP 3072:SmFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:3FmUi21rSm8uUVNSlzY/
TLSH
T153C31300B6E3E8F2EE5930447BEE2A145D6C0D818291C6415373AD419DEF3C71FAAB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 deaa47af9cf642294c695d1d75e232fde64d507be0290c6e9fe3c02c67ae7ce0
MD5 b622fb579c57b10ef16cfb61205934b0
SHA1 f929ebaef4089db767ff7f48d9e680f9f89064cf
SHA512 f5c8b118cf87ce9c4de30c0f79b7296c69d168031f807aebba2e6a8de82ce7955dbe7c8fc8171c98a639d585b7a626789a52555c8c60e892f54557fb142dbfae
SSDEEP 6144:A8i0Aw9NDv+qw5ZtA7FmUi21rSm8uUVNSlzYY:AeNO5ZtAfi21b8j8zV
TLSH
T1043423316F13DCB3DFC8305474AF5B0D5E98AC11C685CAD316A2BB568A5E2CB293F624
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 82da337bf88d1bf8b0f2d5fd6f7d4510b64fed8db890815aaa62e4680f10b7b4
MD5 b021894797acfce432126440d9e96b9d
SHA1 88557aef855633230ef49337306930cc934a9ed6
SHA512 e4334ca7f8c12cfa0b11f33ced7a8af889c98a66565edf29202371ed492b8ea77b745761263657dd410cbacda3f9d259fac0a16ff3b6fe0c7b46dd82bcf8500d
SSDEEP 6144:jT8i0Aw9NDv+qw5ZtA7FmUi21rSm8uUVNSlzYY:/eNO5ZtAfi21b8j8zV
TLSH
T18D3422316F13DCF39F89305438AF5B0D4ED8AC16C680CAD655A1BB56895E2CB293FA24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 830633649d3b141e5fae0daa4b672d48b2d1db0f6ee853ed59839b601bd4dacb
MD5 820b84965943a066d56f25198c3120ae
SHA1 0d27305a7b84cd1b291ea6c8514b671a32806284
SHA512 856c29c6b160a21ce31756d1163691da383e7a1194be2506454f77464e6c539b3385b7ae86268583ed084e8734caba43780284bb5cb40c5c64ee72b909ecd2d4
SSDEEP 6144:/T8i0Aw9NDv+qw5ZtA7FmUi21rSm8uUVNSlzYY:beNO5ZtAfi21b8j8zV
TLSH
T1173422316F13DCF39F89305438AF6B0D4ED8AC16C680CAD65591BB56895E2CB293FA24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
Size 28KB
SHA256 dff981c5a1ede93d9cdf5fd9fc6750b9d12026866b750d6a8992032831e51eab
MD5 e1edee0df7dc5c2003ca9642e6705b5d
SHA1 d91e543d09e4930d2e2f4db8d5dd87e0182654a5
SHA512 5e552a14e40623c6a3e8b9d063e3b19190734bf029b7c8e0670735fa9a727a4a0eb4a40f7884e961f91577a8c01cc77971bab74fac26e1ba8fc29b831f1572ab
SSDEEP 96:K+4kdVOAy5eAcCSu3TLlrXi8fATRH/95a84:K+4XA/A1Su3TLpXiWATd4
TLSH
T18AD24C527E70C650D40A543CADAFDBEE2D65FEC5DC1912633BF1FB6F4AB88168504148
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ILSetup.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc9E27.tmp\ILSetup.dll
Size 1.2MB
SHA256 bee6fc430a05bdcf82226adcbbfba9abbe08fc065b97c1f2cfeb9f9c4e34cd25
MD5 494dbd5993a47b3b720f5e0f6eb04c59
SHA1 08d3f00ee435a9ddbb0afe7869a3183bd3e0a284
SHA512 2e9305862c5c55e37d5533b6392a428694858880a8ca533f9a7260b7ee4220b79b5d45f5645526b631a05bfaa9fc0725b6e43b0a5681cb36b7b6c413083f386e
SSDEEP 12288:9eOGI93yacPkwfUdKTzX54vZxYyQB8Og4X/WpeW9UnLDbXBF:9e+3y5MwfgKTL54vZxb88j4vWpeWqP/
TLSH
T130456E23B2C6A43EE0EB19366D33E557583F776125129C5A97F4098CCF293806E3E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc9E27.tmp\InstallOptions.dll
Size 15KB
SHA256 f34385901206a3952fe2724edb3b0b123fd897119c774ab68c8745de6662d990
MD5 998189882c9f1be220c9faf0fd2bde15
SHA1 787d50c46c9a2a48565f684fabc7503aca8b0493
SHA512 e0c52ad851b476e7bcbadea8f993e5c6f9f70a9b46e2aebe8ee353a372b0bd5af95241240f880f49b9d91d240a4a2b7e7d2b7c8a18ca1654e607fa8d2772dfd6
SSDEEP 192:zkByiog2tkjvs9/yb2GC5E5RatZzMHjphLAykyc5MT5/9v9GwBCMFauVizLY:znio7tgOO2GaW2zcjpAT5Ot9lVBZaL3
TLSH
T1AC622B117FC610B7EB9226712BFEA7139BB2B21018D19C0B8E7339462D7A605EF35652
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc9E27.tmp\System.dll
Size 11KB
SHA256 c4aaf80e3990185eeb5ea56bf841dbf5f3d02269d715f3bfdfe8b54aa797a7b9
MD5 24523fe14bb9ba400a3950016b187915
SHA1 6ec152b4e4ac04038d4608a8a206070185116036
SHA512 ae73351d27109187f7c4e312bc30a165202f29d74c65dd0feaee75dab72b97d27c6482b1e95771063afec7e9f2ca03a27a11cd25e39228072b69c33fffef7257
SSDEEP 192:cS8LqFZBOtRG/+VE6HwIobhj+PJu97wI88QF+wnY5LL:xZQtsh6HQdj4Ona85LL
TLSH
T163324A0347A081F1E151833C08673B27BBB9A72566F08C23AFD35881BD596D6BE79713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserMgr.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc9E27.tmp\UserMgr.dll
Size 23KB
SHA256 7696c255014a543f720e189ab3fe48f62fcf43435465062649c96138eedb222f
MD5 9210597fba3dfab3c69b1eb490205419
SHA1 6e3ca39043756ed1cceaf2d4853e7cb6be1c64cb
SHA512 4877daefdd34725791fba7c8cc2d85c4e91080ca7787a71ee9ffde71704ac40799b891f03d1f1805a31af6ddc35e335f74c9d620e87d517670a378c001cffb06
SSDEEP 384:qy822ev7imqsdMCgfwnvmau3+zK8E1Iz6P/RdJ3AiMtDVeNvOCcN:q5TehhMCgfwnvmauiK8Eg6P5TQXBe
TLSH
T1E2B21A01728D4081F216BA3B39E6DB379BFC73B5571988C7F386270B61539C2A978236
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioA.ini

Path C:\Users\Admin\AppData\Local\Temp\nsc9E27.tmp\ioA.ini
Size 1KB
SHA256 47767dbc8a1404898471da42fa4ed99ab4523c3b315a3751c97949ea292088b3
MD5 d9b1eee558ba609521bf875f2c0fda31
SHA1 7e906cc4ce98c03a7c8a16cc3c90e2b38a169d00
SHA512 f7e74aa4121083d6001b127f30b3296040d89ef7efd17a9ae96c253805e434dddbb2d73482b9fa6cad4ffc3cf404bc435f5d19af5c887f04c419a6c44d750ce8
TLSH
T100318B633AF89065E1EAF648FFF6857153387805682DCA5ED1E04E0E48E56809037BEB
MD5 SHA1 SHA512 TLSH

Submit Download

ioAllUsersPage.ini

Path C:\Users\Admin\AppData\Local\Temp\nsc9E27.tmp\ioAllUsersPage.ini
Size 1010B
SHA256 c0313e195465e521ef5cbd94e19a1abe70cf0d564ec38b017f1e09a276e30c15
MD5 634fd2633a884035690fd3635c7ae34f
SHA1 91af7c2af8a41563d33f944868d22673c6116e2d
SHA512 810389998f4eb641228e5b4e2ec43849102d2d9e1890c17aff5067cbcd0e46bac7850f732815746cbdf62d4f698cc47002cad2aa2f3b442cec3a5652558b058a
TLSH
T1C2117C533AF85514F0AABA0DFAF94035A7397942082DC95EC0E10E0E54FA680817BBEB
MD5 SHA1 SHA512 TLSH

Submit Download

ioAllUsersPage.ini

Path C:\Users\Admin\AppData\Local\Temp\nsc9E27.tmp\ioAllUsersPage.ini
Size 1KB
SHA256 87c4dc2bc1cb3253c93f18d40f46ce9564aa9dba2274d30b21a553d64739c12b
MD5 bb7be322cf61ba72a7012aeaab633a90
SHA1 a54fd8e53412f3f3b621140d2a957682d49914f7
SHA512 58d5994503a3c288e10ae0c53a732b621e7c30bbb93662cf986c89d992a74f3f97554384bb4e3c85c95b2ea607477a7bb25cee02a06f8d19d3b3fede33c9530f
TLSH
T12A218B133AF90518F0EBB60DFAF94035A7397843581CC90EC1D20A4E54FAA80856BBDB
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsc9E27.tmp\ioSpecial.ini
Size 1KB
SHA256 8a08c5da4536e019082da25f4a0e4304e19d934af3702f8f0a7cd3f26f303442
MD5 da7cd66f7346cfd3ceacdf52812001ce
SHA1 d8187023af413c1ccf00fe7b0952e64782539342
SHA512 cce4539b337949257c11903fc21ce0f98d1210b5d3c32fc7f967be212c31eff2f5306d558d712dd264a56b4226908cd2057522a9c878fb2f7f6f2dfd00dd12ce
TLSH
T15D21B0037AFC1104F2FAFB14FFB541758B3A7C56A839C61D41C1090E09E5B408963BAB
MD5 SHA1 SHA512 TLSH

Submit Download

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nss3A2E.tmp\LangDLL.dll
Size 5KB
SHA256 4cf25411f28f639f72156c24b0f66ea42f5aee5973f6c137d901da6ae42d5b7e
MD5 4b8a750993567ac9a350ba9768fabfa0
SHA1 7ee7a8c313b292d62561b085c9d490c0f8065624
SHA512 c2a06e352815a2f5340e8244cf2c5a4a5cd7e7848ea67e454ab207262cb33130008491e83d053c778bea97720f7387de737bf15355db3cd5477b94f3571107bb
SSDEEP 48:S46+/TTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8mkGofjLl:zxuPbO5tCZBVEAWyMEFv2CmqL
TLSH
T171C1A370B3D248B9D591413778AB33D36612AE746784500FDB6311AA3820AE7AD3EBC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nss3A2E.tmp\UAC.dll
Size 14KB
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
TLSH
T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FindProcDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw6A08.tmp\FindProcDLL.dll
Size 3KB
SHA256 c0948b2ec36a69f82c08935fac4b212238b6792694f009b93b4bdb478c4f26e3
MD5 b4faf654de4284a89eaf7d073e4e1e63
SHA1 8efcfd1ca648e942cbffd27af429784b7fcf514b
SHA512 eef31e332be859cf2a64c928bf3b96442f36fe51f1a372c5628264a0d4b2fc7b3e670323c8fb5ffa72db995b8924da2555198e7de7b4f549d9e0f9e6dbb6b388
TLSH
T1E07186BA56E54FFDD1541A3030CE7003EBDE75B416AB625AC93B261A7BD0191D83CA22
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw6A08.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsw6A08.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw6A08.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsisFirewallW.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw6A08.tmp\nsisFirewallW.dll
Size 8KB
SHA256 53be5716ad80945cb99681d5dbda60492f5dfb206fbfdb776b769b3eeb18d2c2
MD5 f5bf81a102de52a4add21b8a367e54e0
SHA1 cf1e76ffe4a3ecd4dad453112afd33624f16751c
SHA512 6e280a75f706474ad31b2ce770fa34f54cb598528fac4477c466200a608b79c0f9b84011545595d9ba94331ad08e2f51bd42de91f92379db27686a28ba351256
SSDEEP 96:8SMPv+eLDUDp+weLv2lstU+0IgNB2Aa20kdArfOwJKbFrMiRsuHdRYL:wnxLDUwp6sgN2RDrzJMMmsuYL
TLSH
T16DF1F936B7E18171C26F02B09F4F569DE1F8E66067E0013377628B5D2EB029DE836526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qBittorrent_new.ini.lock

Path C:\Users\Admin\AppData\Roaming\qBittorrent\qBittorrent_new.ini.lock
Size 64B
SHA256 e8db8a9736dc1e690f1b04a3edda78be15d0d9762a4acd2d2674a28dfdd6a102
MD5 2dc4c9d3707ede85dbeb7b8fb1eb0ce5
SHA1 95fc6a4c71954f38be5d3f1ea11582233dc0bbf0
SHA512 250f7fdeb6946d9d3768667a7e81fb347097dc110e9f04764e824a28a2bccc061ad449809d86e07d131d9ce6581711c78e65ccdb0150f2b7afbbac347bd91652
TLSH
T159A0220AC20828A8200000328880E0B820B3A38CA3002CB0C08CC80B808E08FA8B0300
MD5 SHA1 SHA512 TLSH

Submit Download

FLEngine_x64.dll:Zone.Identifier

Path C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\1 FL_Studio_25.1.6.4997_rev.1-WD\FLEngine_x64.dll:Zone.Identifier
Size 50B
SHA256 86a3e68762720abe870d1396794850220935115d3ccc8bb134ffa521244e3ef8
MD5 dce5191790621b5e424478ca69c47f55
SHA1 ae356a67d337afa5933e3e679e84854deeace048
SHA512 a669e10b173fce667d5b369d230d5b1e89e366b05ba4e65919a7e67545dd0b1eca8bcb927f67b12fe47cbe22b0c54c54f1e03beed06379240b05b7b990c5a641
TLSH
T129900206060508084555754417DC4554600E75544D854288BCC189D795C508C8578517
MD5 SHA1 SHA512 TLSH

Submit Download

CloudMastering.dll

Path C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\2 Addons\Optional Features\FL Cloud mastering v2 Windows\CloudMastering.dll
Size 18.0MB
SHA256 51dd40c5d5ffd4a867e9cb11b4a6f885151c6420b4c1bf10fd23d04eda11a1a2
MD5 19a0d2039ad1f234f73492d363a8fc5a
SHA1 7e4549c06ccf4a3b2d50dd0f8d7444ef4bba223b
SHA512 2dd59ab242773d1db4464be8ea745aca4f061d8cf4f6ae270501f0196d67819acea74acc0ae4a0bd9fda404e1447c3bacc855b9705f205f9521e520cd29ce8db
SSDEEP 24576:W28ePynqjo0Nmxtw45wV4CF2V7q/ARaQ4PQ:WHqs0NmxO4WV4E2VVRaQ4PQ
TLSH
T1D5174B1B74B512ECD2BED074CA39B913F7A1340D432869EB05E109666E16EE06EFF712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fbgemm.dll

Path C:\Users\Admin\Downloads\FL Studio 25.1.6.4997-rev.1-WD\2 Addons\Optional Features\Stem extractor Windows\fbgemm.dll
Size 4.7MB
SHA256 0cb1070c51fa9a987bd7c547d361f131963901b821921737e3045912c1c58cf5
MD5 ed5ae9db115c46cb25d1b22f41f6f396
SHA1 d36b0fbfacbb255dd0b593b894ed9e644eac4c87
SHA512 4ed4b65b81124dd640cc0bc566221914c35493fa9092393d1471d6d921cbddcfe768a291b378de0e27172660f3e8bc149253386c7602afa1adac74058255f976
SSDEEP 98304:ttjteKHGQB8887n2iUpWmagQ8+fIGUdut3p4dqDfEmtbm+bafeIBx4FUN1TePiy7:tt
TLSH
T152362A71B1D642C8C43BC038E64BA913A634784E433CA6F75E958FA16F65EB0ED3E611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FlStudio25.torrent

Path C:\Users\Admin\Downloads\FlStudio25.torrent
Size 34KB
SHA256 76f9efe4a0ddee663d02fe4f3a15e1f27769b4af1d697bf5ec91807f73579649
MD5 724c87febd0e5751e0c612a07d96c811
SHA1 00e1f5e966b42b84b1f605dce0db48a2b448f936
SHA512 e56a1b5f961ff96865df7988baca2a1f847c962c58ccba7ee143790d903fe906f7b6611e0d9d57f75e89bba23ab8d14e4b9ac86772ccf9a5355de930373b6f04
SSDEEP 384:bb8RUJiZSx56ZiEEtgHQDEWOSoC5ICGM5wmSNraUcqr4Et7Z4kFTUgiZbs9dNIBz:3JICEmShcqrZ4cMbsDNIB6H+NTsCv
TLSH
T10EF2A5572A349325AB3EAE9306AB51D02B7EFBFA1C21E475C86BCF0D5C817C055F2612
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qbittorrent_5.2.3_x64_setup.exe

Path C:\Users\Admin\Downloads\qbittorrent_5.2.3_x64_setup.exe
Size 41.1MB
SHA256 ff508e2f912d59c9eabaf03633ebacfd45c2049f38dcac027b8a7d7ad867ab2f
MD5 c4c58fa22842733f566c4ef47306bfd3
SHA1 d0990ba2596e7d3e57eae438d8769aec29ff7060
SHA512 c4bd6dd7db10c4e39f07ee019e54de52d3c8e718a572f112503749c0900d76f0c09da2d727123c4f8e897d34932901ebb1dc43985a9728c6e8f777a96d2ea845
SSDEEP 786432:g5mgiFGe/+eNyHgHb/LwQaPYgEqM6oRKU5etJMr5ycxkeX+K7PchrPSXZxu1pvI:gA3oeDIOb/LFawgXM6jGetJMrQGH+LKJ
TLSH
T14C9733BA2776E630D6EF41B5482CCA451A1F684EE451633AFFC22109F894D3CFE65E81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5132-1347-0x00007FFF3A290000-0x00007FFF3A2A1000-memory.dmp

Download

memory/5132-1335-0x00007FFF474D0000-0x00007FFF474E4000-memory.dmp

Download

memory/5132-1336-0x00007FFF46CE0000-0x00007FFF46CF1000-memory.dmp

Download

memory/5132-1334-0x00007FFF34DB0000-0x00007FFF35140000-memory.dmp

Download

memory/5132-1337-0x00007FFF3A340000-0x00007FFF3A412000-memory.dmp

Download

memory/5132-1339-0x00007FFF35D50000-0x00007FFF35E38000-memory.dmp

Download

memory/5132-1343-0x00007FFF42E40000-0x00007FFF42E58000-memory.dmp

Download

memory/5132-1348-0x00007FFF3A270000-0x00007FFF3A281000-memory.dmp

Download

memory/5132-1349-0x000001E01B500000-0x000001E01B70B000-memory.dmp

Download

memory/5132-1353-0x00007FFF35670000-0x00007FFF3571B000-memory.dmp

Download

memory/5132-1356-0x00007FFF29900000-0x00007FFF29B45000-memory.dmp

Download

memory/5132-1355-0x00007FFF35630000-0x00007FFF35642000-memory.dmp

Download

memory/5132-1354-0x00007FFF35650000-0x00007FFF3566B000-memory.dmp

Download

memory/5132-1352-0x00007FFF35720000-0x00007FFF35745000-memory.dmp

Download

memory/5132-1351-0x000001E01B710000-0x000001E01B75F000-memory.dmp

Download

memory/5132-1350-0x00007FFF35750000-0x00007FFF357E8000-memory.dmp

Download

memory/5132-1332-0x00007FFF46A10000-0x00007FFF46A32000-memory.dmp

Download

memory/5132-1346-0x00007FFF40620000-0x00007FFF4063A000-memory.dmp

Download

memory/5132-1345-0x00007FFF3A2B0000-0x00007FFF3A2DD000-memory.dmp

Download

memory/5132-1344-0x00007FFF3A2E0000-0x00007FFF3A306000-memory.dmp

Download

memory/5132-1341-0x00007FFF45D80000-0x00007FFF45DC1000-memory.dmp

Download

memory/5132-1340-0x000001E01B410000-0x000001E01B4F3000-memory.dmp

Download

memory/5132-1342-0x00007FFF3A310000-0x00007FFF3A33F000-memory.dmp

Download

memory/5132-1338-0x00007FFF33E70000-0x00007FFF34106000-memory.dmp

Download

memory/5132-1366-0x00007FFF47380000-0x00007FFF473B4000-memory.dmp

Download

memory/5132-1367-0x00007FFF35140000-0x00007FFF353F6000-memory.dmp

Download

memory/5132-1365-0x00007FF6B6CD0000-0x00007FF6B6DC8000-memory.dmp

Download

memory/5132-1333-0x00007FFF469B0000-0x00007FFF469DB000-memory.dmp

Download

memory/5132-1329-0x00007FFF35140000-0x00007FFF353F6000-memory.dmp

Download

memory/5132-1331-0x00007FFF48E30000-0x00007FFF48E49000-memory.dmp

Download

memory/5132-1330-0x00007FFF48E70000-0x00007FFF48E81000-memory.dmp

Download

memory/5132-1327-0x00007FF6B6CD0000-0x00007FF6B6DC8000-memory.dmp

Download

memory/5132-1328-0x00007FFF47380000-0x00007FFF473B4000-memory.dmp

Download

memory/5312-1312-0x000001DC4FF90000-0x000001DC4FFA0000-memory.dmp

Download

memory/5312-1311-0x000001DC4FF90000-0x000001DC4FFA0000-memory.dmp

Download

memory/5312-1309-0x000001DC4FF90000-0x000001DC4FFA0000-memory.dmp

Download

memory/5312-1310-0x000001DC4FF90000-0x000001DC4FFA0000-memory.dmp

Download

memory/5312-1305-0x000001DC4FF90000-0x000001DC4FFA0000-memory.dmp

Download

memory/5312-1306-0x000001DC4FF90000-0x000001DC4FFA0000-memory.dmp

Download

memory/5312-1307-0x000001DC4FF90000-0x000001DC4FFA0000-memory.dmp

Download

memory/5312-1308-0x000001DC4FF90000-0x000001DC4FFA0000-memory.dmp

Download

memory/5312-1304-0x000001DC4FF90000-0x000001DC4FFA0000-memory.dmp

Download

memory/5312-1303-0x000001DC4FF90000-0x000001DC4FFA0000-memory.dmp

Download

memory/5312-1300-0x000001DC4FF90000-0x000001DC4FFA0000-memory.dmp

Download

memory/5312-1301-0x000001DC4FF90000-0x000001DC4FFA0000-memory.dmp

Download

memory/5312-1302-0x000001DC4FF90000-0x000001DC4FFA0000-memory.dmp

Download

memory/5312-1299-0x000001DC4FF90000-0x000001DC4FFA0000-memory.dmp

Download

memory/5312-1298-0x000001DC4FF90000-0x000001DC4FFA0000-memory.dmp

Download

memory/5312-1297-0x000001DC4FF90000-0x000001DC4FFA0000-memory.dmp

Download

memory/5908-116-0x000002DFB9000000-0x000002DFB90E9000-memory.dmp

Download