40f01b9ba90e9ab4f32c859b1efd0bad59860f7fdeb41bbacf07e42f3f64dbae

Analysis

user interaction
yes
max time kernel
286s
max time network
288s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9a3b11257ac575e4f71de811322ce6b3-e9300eff7f7c9ed53b03129d4faea0287222e473/breachcompilation.txt
Size 386B
Sample260823-rexd2sgr8v
SHA256 40f01b9ba90e9ab4f32c859b1efd0bad59860f7fdeb41bbacf07e42f3f64dbae
MD5 6e66004d46a44e1c1333dcdbc860fb07
SHA1 1f5a7e67f42b70777bd09e0dd26c783137fee4ff
SHA512 7babb86f03428eae3ca8a88a7c658ee5017e52c2046af2f979e7af7008a21a6a09be88d3db641bbc5cc0db008fbb5d94f398dc7185cb211e3b674f7673d996c9
TLSH
T118E02BF0D03C9D22258353668FDAD4B7F990D206764392985E18C3DE430ACCD42F259A
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
124	4312	chrome.exe

Executes dropped EXE 3 IoCs

pid	Process
5784	qbittorrent_5.2.3_x64_setup.exe
5676	qbittorrent.exe
3176	qbittorrent.exe

Loads dropped DLL 7 IoCs

pid	Process
5784	qbittorrent_5.2.3_x64_setup.exe
5784	qbittorrent_5.2.3_x64_setup.exe
5784	qbittorrent_5.2.3_x64_setup.exe
5784	qbittorrent_5.2.3_x64_setup.exe
5784	qbittorrent_5.2.3_x64_setup.exe
5784	qbittorrent_5.2.3_x64_setup.exe
5784	qbittorrent_5.2.3_x64_setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	62	https://sourceforge.net/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a2faaff99e82b230	5

Drops file in Program Files directory 40 IoCs

description	ioc	Process
File created	C:\Program Files\qBittorrent\translations\qtbase_lg.qm	qbittorrent_5.2.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_nl.qm	qbittorrent_5.2.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qt_lt.qm	qbittorrent_5.2.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_nn.qm	qbittorrent_5.2.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_sk.qm	qbittorrent_5.2.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_tr.qm	qbittorrent_5.2.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_zh_CN.qm	qbittorrent_5.2.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\qt.conf	qbittorrent_5.2.3_x64_setup.exe
File opened for modification	C:\Program Files\qBittorrent\qbittorrent.exe	qbittorrent_5.2.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qt_gl.qm	qbittorrent_5.2.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_es.qm	qbittorrent_5.2.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_hu.qm	qbittorrent_5.2.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_pt_BR.qm	qbittorrent_5.2.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ko.qm	qbittorrent_5.2.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ca.qm	qbittorrent_5.2.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_gd.qm	qbittorrent_5.2.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_pl.qm	qbittorrent_5.2.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\qbittorrent.pdb	qbittorrent_5.2.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_cs.qm	qbittorrent_5.2.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_fi.qm	qbittorrent_5.2.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_he.qm	qbittorrent_5.2.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_it.qm	qbittorrent_5.2.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_lv.qm	qbittorrent_5.2.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ru.qm	qbittorrent_5.2.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_sv.qm	qbittorrent_5.2.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_de.qm	qbittorrent_5.2.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_uk.qm	qbittorrent_5.2.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\qbittorrent.exe	qbittorrent_5.2.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qt_pt_PT.qm	qbittorrent_5.2.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\uninst.exe	qbittorrent_5.2.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qt_sl.qm	qbittorrent_5.2.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_bg.qm	qbittorrent_5.2.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_da.qm	qbittorrent_5.2.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_fa.qm	qbittorrent_5.2.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_fr.qm	qbittorrent_5.2.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ja.qm	qbittorrent_5.2.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_zh_TW.qm	qbittorrent_5.2.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ar.qm	qbittorrent_5.2.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_hr.qm	qbittorrent_5.2.3_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ka.qm	qbittorrent_5.2.3_x64_setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qbittorrent_5.2.3_x64_setup.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4312	chrome.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134319676619359304"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Modifies registry class 33 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent.File.Torrent\shell\open\command	qbittorrent_5.2.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\shell\open\command	qbittorrent_5.2.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet\DefaultIcon\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\",1"	qbittorrent_5.2.3_x64_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\shell	qbittorrent_5.2.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\shell\open	qbittorrent_5.2.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet\shell\open	qbittorrent_5.2.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.torrent\Content Type = "application/x-bittorrent"	qbittorrent_5.2.3_x64_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent	qbittorrent_5.2.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent.Url.Magnet	qbittorrent_5.2.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent.Url.Magnet\DefaultIcon	qbittorrent_5.2.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.torrent	qbittorrent_5.2.3_x64_setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent.File.Torrent\DefaultIcon	qbittorrent_5.2.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent.File.Torrent	qbittorrent_5.2.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\ = "Torrent File"	qbittorrent_5.2.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet\ = "Magnet URI"	qbittorrent_5.2.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent.Url.Magnet\shell\open\command	qbittorrent_5.2.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\magnet	qbittorrent_5.2.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet\shell	qbittorrent_5.2.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\ = "URL:Magnet URI"	qbittorrent_5.2.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\URL Protocol	qbittorrent_5.2.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\DefaultIcon\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\",1"	qbittorrent_5.2.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\shell\open\command\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\" \"%1\""	qbittorrent_5.2.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\Content Type = "application/x-magnet"	qbittorrent_5.2.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet	qbittorrent_5.2.3_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet\shell\open\command	qbittorrent_5.2.3_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet\shell\open\command\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\" \"%1\""	qbittorrent_5.2.3_x64_setup.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5676	qbittorrent.exe
3176	qbittorrent.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1204	chrome.exe
1204	chrome.exe
5784	qbittorrent_5.2.3_x64_setup.exe
5784	qbittorrent_5.2.3_x64_setup.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5676	qbittorrent.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 31 IoCs

pid	Process
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe

Suspicious use of FindShellTrayWindow 59 IoCs

pid	Process
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe
5676	qbittorrent.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 5788	1968	chrome.exe	90
PID 1968 wrote to memory of 5996	1968	chrome.exe	92
PID 1968 wrote to memory of 4312	1968	chrome.exe	91
PID 1968 wrote to memory of 5996	1968	chrome.exe	92
PID 1968 wrote to memory of 4152	1968	chrome.exe	94
PID 1968 wrote to memory of 4152	1968	chrome.exe	94
PID 1968 wrote to memory of 2264	1968	chrome.exe	95
PID 1968 wrote to memory of 2572	1968	chrome.exe	96
PID 1968 wrote to memory of 2264	1968	chrome.exe	95
PID 1968 wrote to memory of 2572	1968	chrome.exe	96
PID 1968 wrote to memory of 4404	1968	chrome.exe	97
PID 1968 wrote to memory of 4404	1968	chrome.exe	97
PID 1968 wrote to memory of 2808	1968	chrome.exe	98
PID 1968 wrote to memory of 2808	1968	chrome.exe	98
PID 1968 wrote to memory of 5848	1968	chrome.exe	99
PID 1968 wrote to memory of 5852	1968	chrome.exe	100
PID 1968 wrote to memory of 1152	1968	chrome.exe	101
PID 1968 wrote to memory of 5852	1968	chrome.exe	100
PID 1968 wrote to memory of 1152	1968	chrome.exe	101
PID 1968 wrote to memory of 5504	1968	chrome.exe	105
PID 1968 wrote to memory of 5504	1968	chrome.exe	105
PID 1968 wrote to memory of 3512	1968	chrome.exe	106
PID 1968 wrote to memory of 2020	1968	chrome.exe	107
PID 1968 wrote to memory of 3512	1968	chrome.exe	106
PID 1968 wrote to memory of 2020	1968	chrome.exe	107
PID 1968 wrote to memory of 2928	1968	chrome.exe	108
PID 1968 wrote to memory of 2928	1968	chrome.exe	108
PID 1968 wrote to memory of 5496	1968	chrome.exe	109
PID 1968 wrote to memory of 5496	1968	chrome.exe	109
PID 1968 wrote to memory of 1012	1968	chrome.exe	110
PID 1968 wrote to memory of 2028	1968	chrome.exe	111
PID 1968 wrote to memory of 1012	1968	chrome.exe	110
PID 1968 wrote to memory of 2028	1968	chrome.exe	111
PID 1968 wrote to memory of 2296	1968	chrome.exe	112
PID 1968 wrote to memory of 2296	1968	chrome.exe	112
PID 1968 wrote to memory of 2404	1968	chrome.exe	113
PID 1968 wrote to memory of 2404	1968	chrome.exe	113
PID 1968 wrote to memory of 2500	1968	chrome.exe	114
PID 1968 wrote to memory of 2500	1968	chrome.exe	114
PID 1968 wrote to memory of 2044	1968	chrome.exe	115
PID 1968 wrote to memory of 2044	1968	chrome.exe	115
PID 1968 wrote to memory of 5284	1968	chrome.exe	116
PID 1968 wrote to memory of 5284	1968	chrome.exe	116
PID 1968 wrote to memory of 5100	1968	chrome.exe	118
PID 1968 wrote to memory of 5100	1968	chrome.exe	118
PID 1968 wrote to memory of 1296	1968	chrome.exe	119
PID 1968 wrote to memory of 1296	1968	chrome.exe	119
PID 1968 wrote to memory of 3068	1968	chrome.exe	120
PID 1968 wrote to memory of 3068	1968	chrome.exe	120
PID 1968 wrote to memory of 1776	1968	chrome.exe	121
PID 1968 wrote to memory of 1776	1968	chrome.exe	121
PID 1968 wrote to memory of 6084	1968	chrome.exe	122
PID 1968 wrote to memory of 6084	1968	chrome.exe	122
PID 1968 wrote to memory of 944	1968	chrome.exe	123
PID 1968 wrote to memory of 3688	1968	chrome.exe	124
PID 1968 wrote to memory of 1768	1968	chrome.exe	125
PID 1968 wrote to memory of 2516	1968	chrome.exe	126
PID 1968 wrote to memory of 2516	1968	chrome.exe	126
PID 1968 wrote to memory of 5284	1968	chrome.exe	127
PID 1968 wrote to memory of 5284	1968	chrome.exe	127
PID 1968 wrote to memory of 4128	1968	chrome.exe	128
PID 1968 wrote to memory of 4128	1968	chrome.exe	128
PID 1968 wrote to memory of 1940	1968	chrome.exe	129
PID 1968 wrote to memory of 1940	1968	chrome.exe	129

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\9a3b11257ac575e4f71de811322ce6b3-e9300eff7f7c9ed53b03129d4faea0287222e473\breachcompilation.txt
1⤵
PID:3368

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff8c934c728,0x7ff8c934c734,0x7ff8c934c740
  2⤵
  PID:5788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1856,i,3048776699722566602,3582625342227365866,524288 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=1884 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,15523125079059063289,1906678942481364100,262144 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=1844 /prefetch:2
  2⤵
  PID:5996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2140,i,9676901348947329076,15523067088685454495,524288 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:13
  2⤵
  PID:4152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3272,i,17317531424713263138,14444304825503227259,2097152 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3300,i,1990377544699104857,17163722258819538067,2097152 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4716,i,10725842605019432183,12688600417006054109,2097152 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4912,i,5247100588355861875,4508243310153237844,524288 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:14
  2⤵
  PID:2808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5412,i,491303919361777046,2601828801687320529,524288 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:5848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5512,i,2103018139233835643,12217776513277136762,2097152 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:5852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5524,i,12636283322734286293,11801470555044016225,2097152 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5708,i,3274099785066948614,5959076539747618888,524288 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:14
  2⤵
  PID:5504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5836,i,9925806583220539748,11702188489598285579,2097152 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6052,i,1551210523528361211,15464996050423602877,2097152 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6212,i,151296743800045677,15991211929072282227,2097152 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6376,i,1195244892982286456,3413811503254793591,2097152 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:5496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5800,i,18374118585676657307,3934305774381651671,524288 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:14
  2⤵
  PID:1012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5496,i,16212052963649930754,17721926355355475455,2097152 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5500,i,16898612173532330276,8784093211235374833,2097152 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6412,i,13401553110779703400,18172232626184471251,524288 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:2404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5732,i,11796372297187692385,15302583934259115029,2097152 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5788,i,9924055407826183465,13880815814303336360,2097152 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=3940,i,8452567465422850574,4026005255256123612,2097152 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=3924 /prefetch:9
  2⤵
  PID:5284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6464,i,8003451588824664149,2480855396804702028,2097152 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6152,i,722655619379373681,11107755289375629709,2097152 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:1296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5676,i,4470873811154299749,14603223399823877245,2097152 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5732,i,16358495482602774103,8807165663692216155,2097152 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=4484,i,2915512612750455078,11211932370491985376,2097152 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:6084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3476,i,12262936146153020555,12162630300610175133,524288 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:14
  2⤵
  PID:944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6204,i,12146628397307404873,8947628784335291051,524288 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:14
  2⤵
  PID:3688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6220,i,10653326505496000750,8795531564109095316,524288 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:14
  2⤵
  PID:1768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=3584,i,18132102333087302756,4487146294148749163,2097152 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6348,i,13378657567794900165,2775231185838090485,2097152 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:5284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6464,i,6160978048138284385,1297912846102164055,2097152 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=6920,i,8118334854408008788,12061317672448547983,2097152 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=7080,i,14388355631986177674,8351340311222886848,2097152 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=7112 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=5752,i,7189271566491028595,11914229789044063571,2097152 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=7196,i,8216732387401883311,15667465819366827705,2097152 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=7088 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=6112,i,5994716992313089019,15776867062299140685,2097152 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=7252,i,2111015633159987487,5159905717737442846,2097152 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=7268 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=7416,i,4862940196297766077,15381100320507340452,2097152 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=7400 /prefetch:1
  2⤵
  PID:5820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=7120,i,16105929996089905599,4262166805335106570,2097152 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7512,i,12707690001214588050,10746908616040265690,524288 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=7540 /prefetch:14
  2⤵
  PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=7532,i,9497822269882166612,1759855367662133797,262144 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=1168 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=7060,i,12277678850353066385,3746312084759592814,524288 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=7472 /prefetch:14
  2⤵
  PID:1352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=6380,i,14495954189191967759,674977069949908802,2097152 --field-trial-handle=1848,i,1959574701992708082,2320311845014290672,262144 --variations-seed-version --mojo-platform-channel-handle=256 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files\qBittorrent\qbittorrent.exe
  "C:\Program Files\qBittorrent\qbittorrent.exe" "magnet:?xt=urn:btih:5a9ba318a5478769ddc7393f1e4ac928d9aa4a71&dn=breachcompilation.txt.7z"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  PID:3176

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1892

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5224

C:\Users\Admin\Downloads\qbittorrent_5.2.3_x64_setup.exe
"C:\Users\Admin\Downloads\qbittorrent_5.2.3_x64_setup.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5784
- C:\Program Files\qBittorrent\qbittorrent.exe
  "C:\Program Files\qBittorrent\qbittorrent.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:5676

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\134ba99ec44a436b841c6e6f6f5b4308 /t 4168 /p 5676
1⤵
PID:2456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qbittorrent.exe

Path C:\Program Files\qBittorrent\qbittorrent.exe
Size 41.3MB
SHA256 f69360ae8545a64f4fc84fb6bacef03d77a6aa0793a4c14d4a28651ca26a27d1
MD5 0ac96cecadaa65abdcd587c9b4554e82
SHA1 70db70b82eb49a2bf1bcf6079c56c5f929c23d00
SHA512 a4ec9f241c815de4a50b6c9fd50408c4d593ea9580f7c220fe3d7d7440fdbbdb80bf3246a049e5b38a2cb85fb8d01357bca3db752fd9eb996a6d12e903ea0c7d
SSDEEP 393216:d1cQ1hWhcknyRLhIMYIB5mH4yU2lT4IKEXERyJdgsoGQn/tnTfKFdu9CwJsv6tai:c4yUK0BEXEgd1XQ/tT44mO
TLSH
T13897AE56A7F80195E0FBC27886679113E7B1B846133497EF02A496B91F73AF05E3E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qt.conf

Path C:\Program Files\qBittorrent\qt.conf
Size 84B
SHA256 fdb8fa58a6ffc14771ca2b1ef6438061a6cba638594d76d9021b91e755d030d3
MD5 af7f56a63958401da8bea1f5e419b2af
SHA1 f66ee8779ca6d570dea22fe34ef8600e5d3c5f38
SHA512 02f70ca7f1291b25402989be74408eb82343ab500e15e4ac22fbc7162eb9230cd7061eaa7e34acf69962b57ed0827f51ceaf0fa63da3154b53469c7b7511d23d
TLSH
T11CA012E02135B2104063430303DF4192303C81C030333D1C6304001A5E01C0A0776E50
MD5 SHA1 SHA512 TLSH

Submit Download

uninst.exe

Path C:\Program Files\qBittorrent\uninst.exe
Size 149KB
SHA256 21c1e29dd82bdaacb1bcdc8836e8086a0447c1bf5af77ebd0e712b8c74e1c34d
MD5 e1cd723e7620d793a240fae929f2e3cf
SHA1 827b06ac38383de32c4b8864fefc030e41133640
SHA512 47aa085ace6b16b9089f0134deffbd90e5e42281024ccd126f03666e61247c87b3f200f095f5e7b3ae25838ac7ba7d4b9cc1567df5509abcfedde447df2dbdc4
SSDEEP 3072:vX47fcIrwR8ksubceAjSWE3Oyit+CMjhgqcToQBVmb7gSBh:vX45rw68mjgit+CUh3cTXKQc
TLSH
T1DDE3CF0477D4C476E4684A319EFBC7F33A72F450161D8B9BBB44970FB862A44EE29782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000004
Size 72KB
SHA256 0df3c4f39d3f7f318e5e9c31c07d7ff54b52d551ac30ab1c709743167f53a64b
MD5 718bfb329979c646da12fa79376bae76
SHA1 28dacce140caaad9a8492766e18ed92b0c93d2c2
SHA512 cb670c914b72c530362c7df9c2eb5b77bdbbe3c6d10f089be55a01e7534b21042203eff4edf3780b3369942a371aaeb317adb6dc34783dad39fc8f7a681433b5
SSDEEP 1536:GuNC1lRrqCNDEMmaSTJ2ed+oQK7vsmLMv29xy68oaVBOMS5In3N:LMlQCNYZTJkPAvsmz9N8oavOP4N
TLSH
T141730246A7ED93FDB5EC33E31742A406180908A8DC7A9BDFFD1F07AA1C1CA0195D895E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 312KB
SHA256 0b6251fd38152a7a7319d54a8e993417dfe359650a9581c135c3950fe5704861
MD5 932d4b5eb7460fda1f102de6f7149790
SHA1 fadbac31c043b89a72bf3abf502f9ee53ccbf86c
SHA512 eaad89143b37482972189a3ff86698a7ae3332c42248d177fc74e0ec6aa9e1756a0699cb77d3b83cd815e2651df267c0cca4e9866d7a59a26d0dbeadb060189d
SSDEEP 6144:Y87U1JYBYrHsCcjPUrsgrwz9Ot6mjoSF7SI/5Czsl/sfz+IeJqJi:REJYqaQ8QN7p5Cz0jqJi
TLSH
T1786423C8B9A7916BD9F3FEECE0C64958B3FE733433C684798421915B87122D882E45D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a
Size 38KB
SHA256 7165713d3e1a610399471a5e93d5677508f62ef072c1151e72273bf4bd54f916
MD5 9436affc97843765a966b3568fa7e5ec
SHA1 7bfda74bb30589c75d718fbc997f18c6d5cc4a0b
SHA512 473ec3a843c33e18d6d194651fe11353fcd03a7959225faeabf8c77484155ea6a7bccb72dbaf2093ed53c408faa3be9f6fc907f7a5ddf8223375f9d09b504456
SSDEEP 768:eUEh2+iKBVQbBhu8vjenqz2Ez6Y/AxHLEaP72sV9qKYbDblXqhP8qwFSE3uk:eUEEoBVQDjeQaLnP2pfZTqgSEB
TLSH
T11703F112148F7FA1C244F224A4EFE416ACC3F565ABA15E6980B8B7C7010E3C657A46FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c
Size 86KB
SHA256 591294f72db6c8b45e62381d7fee6eb7fa8ba361597cdb17dec408afbdd7fd8b
MD5 0b1c116f27739bfa0debbdcb79558bd5
SHA1 08e3369971adf8961508dd3580e130f45c04f01a
SHA512 f3653cd3ed0b2003ff6bd47a773535d08ad876450dc02c82d161601210198a1d560ecffbedd0c32fe6efbe6212b8d70a234264408d39835df0116060a2a0f73e
SSDEEP 1536:jWSDm9FJM+WOXMxQWNkyq7ZT+M8Mvg6Ur7K7dppv6FEBQfOmgPNt7m:6sm9F1XcQWNkyqFTsUUr7Kxv7jVXm
TLSH
T1D18312FE7AD3A3D5B1E5A934A2C1790C8B28648DFD7371D96B0E98E50BC05F09018797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d
Size 436KB
SHA256 0b320d2cf00e9215763a5377904e2301b2edb7a5d299bd319259714cf8bcd9a9
MD5 38e965609b7e0769e6754549cfa3c2fd
SHA1 8ef9e62fa3ae6d8b371f5a9e9344a6cdf31515fe
SHA512 18cff962b979abf3e3d06261422f35502463a0e196aa0cf801cadcff8833a83f20c9e9f22fb3133041e406fdf2304088a0a5eaa4bbb8aff07ab15a0c1b46b0e4
SSDEEP 6144:HT+7EhQjYpz+XUGr9+7Km54TxcjJJEWv6p0qOJ7kuKtAiDL6GnkES7+S8HBWzDi2:6vj0iUI9EKFEJdU0p7riDxw7L8oviJ3c
TLSH
T147942367DF08D99BDA158361EA30EBDD1158EB6EE00A3CC844BB462CE54C0F9F6913C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e
Size 517KB
SHA256 1685b2bb3ececb0d375b91c9bc14db46cc0c4f791bdd4b5b90361e2864177043
MD5 ab4b4bc524c03ece719c04c6ce7995f0
SHA1 60996371c83b4bc374ac65537d4635415948ebd5
SHA512 d0f88ccb375211a9f67a75dc9df55000c10c478eab5cb4021c18d5fb8e68a146eed6dd183e61d4796b17cf1c601c1882bddfbf3a12f372036ced340361d5fcf1
SSDEEP 12288:iRtsycGshBtoYp5CJ+qvCn8iW9SgC15sS4E:cW/xtoYOJPa83SgC1WS4E
TLSH
T1B6B4232DBF4819C499A658E847E73740996AD87C84263CC23CD0F8C49DF787B3647A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000019

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000019
Size 24KB
SHA256 a3cf4861c7d0c966f0ed6564f6aad6b28cbd3421a9ca4f60e2246848d249f196
MD5 344ee6eaad74df6b72dec90b1b888aab
SHA1 490e2d92c7f8f3934c14e6c467d8409194bb2c9a
SHA512 2a9a9162d610376512a8fae2cf9eb7e5146cc44c8ebde7a12e9a3985da1718c62ae517c25b00de7c0269efab61b4850a0becfbf04382a25730dbe9cf59825a62
SSDEEP 768:RMxowxdaCb0WaY4P8keYUej86bykBRWIsna:RM1r0NY4P80j86bHtqa
TLSH
T1EEB2E0EEEE552E4CE2F059B4962B734B8A46F022191F947832E7844E8F494C24EDE477
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001a
Size 24KB
SHA256 f254eb93b015455a3c89aaf970631bc989fe2bd387f79e871b514992359651aa
MD5 5366c57b20a86f1956780da5e26aac90
SHA1 927dca34817d3c42d9647a846854dad3cbcdb533
SHA512 15d7127970436f2510344600f3acecc19c39a05f8e82c8a7950095386382b2e2da55883a5a9faa97b84452e67315b9ac1693b6592274c8c1c35c813dfeb543a2
SSDEEP 768:ZfRLYs8uBykIQZ6yXBeQOS9JUmBgKYTbgVec:vsbmrDXwEfUmBgKYTc4c
TLSH
T18DB2D004F02ACA26E53655B371E82BD54CB6C4CAABA9935C113520AF3ED3F48C991673
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001b
Size 41KB
SHA256 a625a0c80f672eb4aaa0c66adbb173cc5263e886f3cca6acb9b19a800baf315d
MD5 a1ff3fe516f72339ea47de776680e965
SHA1 1e750921b982b087e9efe6eadac256cb5fc006cc
SHA512 ebc64a18fe10b183dfe3b074c486462f512f4c70386380c3b97269fd50eea5f05b14d8ac76eac5b095a8475f1d3311de030c6eee3024e97fc11e42793b4df129
SSDEEP 768:UONULCwo0hchsckvDtPBIphPAeRWB2QLCoPG/klUzSQmlyS0mH:UpL9/ahsXJmpZyg/2UWF
TLSH
T1B513F181FD02CBADD429D3926ADCC7BD57D8645A64B7D8290070BB4DDE265418EF0CF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001c
Size 77KB
SHA256 c99f6898633e23bd9af665a9dc5f6b42874e85a3ccdf243da1ac20d44f5c4a87
MD5 4a4467107ac005b518ac0b6242f32cbf
SHA1 a2d875fe9956fdcab7235da36fdf3436cbcfd521
SHA512 e48914e8efe3b70ea9c2d83fc70ba8fec4b1590c4ba74d6ed5ff060cde2363ddf17d133549dd6389ca34642afc5a22b7b9d4f41f9416ff3b67e95847d2c6ebac
SSDEEP 1536:ZAe1cxzQxeT6h5eQQiZalLGo5VNsKLKOfw+peimVaJKcDg:ZAeoQxPnQ6gLRNrfwOm0g
TLSH
T13F731270E7D07AD61C49AD28E185FB2F902FEDB6042D5AA8F4E30724A51F61D912BE0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 688ce948a7537447b20e5ec2aa15bbb697c88bfd20931d770744896d5bf51d6a
MD5 f3917f69c14c4d51c2f46e23c3d58af2
SHA1 cb385863b254fde2ae787e406a6f5522bf39d343
SHA512 fc6d0bae7f3fba5be00565cf8225f46de99c7d40737f0969140ae06d0930d2f92b06e149415c85645cb8328b520ff9e14593aa91a11fdaa1adbda47dd843edc2
TLSH
T16F812DD4AC0EA01EEB9B0C3429EFF7E077F1451769430F526652683AA8D13DA035708C
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 dc7fe8c2f639ec477c948b9ddc2fefdcccc918f16a7518bfc26b55d33f39287a
MD5 9f5f63e24b31d47e843bb3fe68537261
SHA1 ff96e9d5f9aa7cd3a5b51e9b2b920be088a10b51
SHA512 390ff36c0a2e7ab2719ac171584a81a9c0c09597b601518ce5a24ff0b0a51272880050084c4ac12afeb82f16fa9dfc75bd8da81dc6dbdd0be30aed44d2cf7e26
SSDEEP 384:DUHesMWxwhhc5YjmQ0x+pIFkgr71hJ0RAH2NGhqnRg6spl6gCVeXBpVpiu7NY2F4:71O8nf
TLSH
T1BA52BBF7C3D8C66D896216F5D7107F2ACE590A1482183D6AC8E5FE4F63E3471E241A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 17KB
SHA256 30cb79c5a3fb927c77593ecbfbabe549e0b00e381f40d0235bd166d4901e4963
MD5 a37f7b7a15040a3dee84a5a881ed5ba1
SHA1 bcc089a05b2783bf38b5bfb46d47763b6c1d56c7
SHA512 cf0b7a0a1172bf3316ef10737f5534d14e797575164a7c127743cb1938ac01af03e4847204454fc9101c5fac4e39eb3704c414af40705f60b246d2e8ba37b873
SSDEEP 384:DUHesMWxwhhc5YjmQ0x+ROWgjJERJm1XIFQYhqug6spl6gCVeXBpVebiu7NsfmkW:7WcYax02zgDA54XhbS7
TLSH
T15082CDF7C3D8C62DC96116F59B147F1ACE190A28421C3D6AC8E5FF4BA3E2471E251A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 98995c5bd218d87dfd60463740b0def252fd185a2f0b86aab6b03de1f583bc3e
MD5 d8b55f8d0cf11cf4011d340d44391521
SHA1 974644f70dfb7b499ab54c6ae486dfb8e9864766
SHA512 d96f89e721cb9364870121f4143754dd33f204fe1a6ca228d0c2f233a6fe26373d0141436d8ca1b1a120cabf86b9ed830370c3cd4632e39657a9dbfc5c072646
SSDEEP 192:eR0cBztC5pv7dNPRpay6a1b2mO98Hsb+WNN/1SuyU4bIyGYo3etykwiEuibyVyI4:eR0mztGpLXZQuwR0oYo3eyCBieE
TLSH
T13E52D76AB91069BBACDBD219FD21B757E3F1202260D01E84EBFC992C14E3ACC711B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 058e0830869f33f144e4fd8d4398da2e09c3654a5304028b9a8948d507a694c0
MD5 19e69f174beada9851107b357c9d48c9
SHA1 a49a97aae08e75ac9c5628ceb7ff8b714aa4a00e
SHA512 bec2c84b69fbba8fc9cf5a3fd1810ec36231e5b3c9d9251cde7b7904aa895ff89d448685c4f7e91d9cb70ce8f26b1115a0b1992b4fe261eae73c2ab39e89c598
SSDEEP 192:8RkhCjDv7dAPRp2GU798Hsb+WNnhy74Ryn2detykwiEuVbyVyIsnAUge:8RkhQ7sXOuwYz2deyCBVee
TLSH
T1C342C52EBA14697BACDAD219FD217757E7F1102271D42E84EBFC8A2C10E35CC622B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 8ed65c3261f5c1f6276e138b81534327e237fc53e3c34ee91e2d360050b8f0c5
MD5 6ab572ef66fcc19d465f01e5c8025401
SHA1 da84e0c2d627807c53755c63bbab9e468d3fdef8
SHA512 6869af11cd4f0c3d432a9b917d1f25fc1dc95f7fc8321461e9cfafb5fb8b26cdd57c2bcd61151801b5f3b67a51ef791f052bd4f260cf6f7660df0bf2ed543bcb
SSDEEP 192:eR0cBztCKmpv7dNPRpay6a1b2mO98Hsb+WNN/1SuyU4bIyGYofetykwiEuibyVyN:eR0mztApLXZQuwR0oYofeyCBieE
TLSH
T18952D76AB91069BBADDBD219FD21B757E3F1102260D01E84EBFC992C14E36CC711B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d2b052cc7a9d2f7732e9ddc6934655c5a9f19891782d04dc90bccd00573f74e7
MD5 6b617f800e22c0167378b251bf99e5a8
SHA1 8a3429ae95079328e8f84f92fddc27aa1e734c00
SHA512 11665df4701c54883ee3656adbc7c159897c7e8029bb06f0b2f69213af3e3ab1be0c5fd26eea4b1bce7e03f165f6620e415330e9c7f482add35503cd51af5597
SSDEEP 192:8R0cBzhCjDv7dAPRp2GJW98Hsb+WNnhy74Ryn2detykwiEuVbyVyIsnAUge:8R0mzhQ7sXsuwYz2deyCBVee
TLSH
T13642C52EBA14697BACDAD219FD217757E7F1102261942E84EBFC8A2C10E35CC622B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 c310e521685103851e7f835cb7796ae183baa6bd05369b9e26c52a5834369b8d
MD5 bd5cddad30c83e497736e19d0ce2ec63
SHA1 ef401734ed771752b487d9ea45954846ca64922f
SHA512 f3bae2ebf508aaa901b3d94d0576689d8b5b5d366f6b4200effaa02dacf24f0b18ed2926f29a7d0f267b1bb492b1b39589115c4704f4e4af6d11924f942edd04
SSDEEP 192:8R0cBztCjDv7dAPRp2y6Jqmv98Hsb+WNLwShy74Ryn2hetykwiEugbyVyIsnAUgE:8R0mztQ7sXYuwsz2heyCBgeE
TLSH
T14F52D66EBA1069BBADDAD219FD21B757E3F1102261D02E84EBFC892C11E35CD721B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 90c2e53ef925adad50b9e6022fc9df7e0ae25f1234355de76a10364b9a41541a
MD5 86c7aae423ed557eacc33888a154c461
SHA1 b23163618c312c8ea0bdd1c814c9e911be30496a
SHA512 36428c4ce0cb7a24b2f04f88bcb930252305903200369a5cbb92b063342abccb1cd15262d504aee35a9b08755f9dba0269e7de8118de4881da62ec0aedf3f816
SSDEEP 192:eR0cBztC5Dv7dNPRpay6a1b2mO98Hsb+WNN/1SuyU4bIyGYo3etykwiEuibyVyI4:eR0mztG7LXZQuwR0oYo3eyCBieE
TLSH
T17852D76AB91069BBADDBD219FD21B757E3F1202260D01E84EBFC992C14E36CD711B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 c3e61feb229d4661f81e1711877692c7dbf8feed2f1796c8b4904ba416ec9e5d
MD5 4d022d9881937b2011f4204831ad77af
SHA1 8f4b9eb7daaa49afad867031d3613be93e9a41b3
SHA512 a37f370967ea387b9e8ea2729084459b6950947db8ec8f3cc78f1c04872bbf9fd4ba0a6a491544a314c356c632a25eeb571a323c003a1256541957d21dd0bebc
SSDEEP 192:tR0cBztCRDv7dNPRpay6k5mO98Hsb+WNLwS7yRBpynWpetykwiEuibyVyIsnAUgE:tR0mztu7LXluwwmWpeyCBieE
TLSH
T13D52C66AB91069BBACDED229FD21B757E3F5102261D02E84EBFC892C14E35CD721B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 76fb462ae46a50f66650b9f1e4cb8452f0135327002e1342e57b126071b824a7
MD5 2a72bfaff105911ac94a0ea0431fc98e
SHA1 34a698dbd6ce36cb8d3ad17950ef4305aa6e8617
SHA512 67542bfffa47ad44bb0fe7b319835c04eb3d8801b4538a4f31bcca98826c8001c2f0fefc49f101d6e0f23c0bfe180ab5c0063b0d792325032e22f6587694b3cb
SSDEEP 384:Majm97KxkXqKf/pUZNCgVLH2HfgslN1XODmd+ErU3vZHG8t2rCgM2:MKm97KxkXqKf/pUZNCgVLH2HfgsLROqP
TLSH
T12C52F767684D9A7B0FD8C98CDC276F8FACB602576278092456FB5D0803A57CB114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 042ab4ce8ef04d3c086039f22594bac75f0dc5531448a215a0f5967856637179
MD5 f2042aac9e1a7d1fbfdfd918931ef8de
SHA1 debac42d810feb374abd4b3f625ddc0157073349
SHA512 7e4c51650da29f5c17d1df2658eb066261c127054210e2830155ccdc25869ab5c74e1a097d48b452e8820960c3ffa0f38454f47c115075fbc9a8542407ab301d
TLSH
T159A002E055404021E41942B520964646362A897256950321C1A208CCD8601A08222E04
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 72c564dce546740090e0f7de893a59f2d227bac018f9fcbfb5053b9631ca95db
MD5 289325d05345ed7d759968201a0926bd
SHA1 0aad720f5a20760ed90d3c28ab7051d0acd8259a
SHA512 3254ffd73ce793bf28a3c68512345030ac2bf3f11614b305d8638696ea0e43b3b9a50f907571f2c973d1137e865e0a476f80db94aa4ad9833e3013dedd7cf385
TLSH
T111B002A0D00B0027D90573F160C798653F750E3A87CB4212C59621EEFC282D5C217561
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 b85c52cf61bb21f8d5b860cd7d38c5387da8a66e3249049a965e377fb6443bab
MD5 445e76bc833a132fe0db0a2e4e0062c6
SHA1 b6e68cb4ac6dd5bf16985999454c2e6f1731cd61
SHA512 4b15c3c15824ba7e5895c618b2979f5889482167223686264307ab13b03cd07b1827ac50ac019d28813abe0300fde06ac44c8cb8dd028d95ce5a2abdd69051db
TLSH
T1B3A0021051C04517ED05527465638745737148651AA5470B94970C49D95B9D14A12555
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599b7b.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe599b7b.TMP
Size 48B
SHA256 55330d3f9ed06d2be2b119b03826ed9e77c6abcfbfb614b86e324146d3e67858
MD5 187f0a466e3c0ffb048c6a47483d7617
SHA1 62da4349e623a7c1993e721f603287ad4ad71dc5
SHA512 bb6136a526f98f0604dbd15dac6a60c3910377be4563ce3a0929d6740f1e6b6e7603abc8d2101a88afd4562a9d6f6205b70f0dcd14543f93da638a2148612628
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 e632e684081d2216df8d7bf65d642ce07df2637706ac4db266093f309688ed65
MD5 cc8b45f73154bdf01a6a7fa66f20b340
SHA1 8505bc41eb8c61a435bfd422a19523c244046ffa
SHA512 9ae3a59efcd50c94c87dc3657e0462bfc30dad9918aad66562a6d79deab512c71fe2e5933a15e57300172c893a0ed11fa4f767dc11616f844aff1612cb29fbda
SSDEEP 96:5KC0d+oJm4V0FH+pqf+HBKyoytsRDotok5eHDeB6eGyvkonrob1v4a:MC0HJm5FHuPgXDUD8eW8nrobZ
TLSH
T11CA12CF164794CBB69B7D345F8823A83DEA4A2277990EF80D9DD1E0C11F31D81342927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 92ac108419259be18b229f5326066b7008dd417f1ca7da636ee537fea8702288
MD5 8da366bd4c0ce2bac4542a63ad4888aa
SHA1 612c1c0800b0052c20aab91a0fce1d805aeab701
SHA512 e1c9c710ca209998d2c64ea786a1d733def055b0027942da5b293fb171b7dad8d19c5a1eb22efceb37f4aab38e254e06b4e003a4b061017aa95fb330cada6dce
SSDEEP 3072:KiuCTcrs6Wumx+9JjMu4jtYsymwusCbDFyVBvoCAFLf:gXs6p2+TITPP6BwCoLf
TLSH
T18DD302F2A9DE1D6F03FB85CDE00B5E174DB4222A9A32AF5E0BA05F1501985DD1117F8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 7cf284edb806ed6a2a4b011767899b701a1667676e71373805204a8e839f702e
MD5 74c6f545a7594362329b39550c66abea
SHA1 580547577ab3dadd1cfb77ad8129c1ff03734a96
SHA512 be6779661cf8c59266faab9a43db186df24c0e974f396664049fc742e99ba02d24c1b230904004a76fba655c99f9e855d58e5a2de94230295c5b2dd163944335
SSDEEP 3072:+iuCTcrs6Wumx+9JjMu4jtYsymwusCbDFyVBvoCAFLf:8Xs6p2+TITPP6BwCoLf
TLSH
T12DD302F2A9DE1D6F03FB85CDE00B5E178DB4222A9A32AF5E0FA05F15019859D1117F8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 5148ab6c82b016a87b0cbd91573373732ad757f718a2e6033c8b86065cdad740
MD5 2db29743e5ce4caa44565eafb90be4e6
SHA1 47e17c3d6580f332ad92d901c5e166f44fc6372b
SHA512 fb64c5db886415cd642de172b9d0325962f7d39921b7fa5cf41abd7905fe2f466da3ed91449f45ee336c7cfba7d2bfe7357951308abe0451a47cf92357d25cb4
SSDEEP 96:5zC0d+oJm4V0FH+pqf+HBKyoNtXbSl8h4otop5eoDeB6qGyvkfFl65zrtFnGrG0D:hC0HJm5FHuPgBiU2Ne6zFl6hHnGrGU5
TLSH
T104C10BB1A86CACB769F7D745F4432983CDB4626B6980AE508ED90F1C01E71D92343937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 a42e82c8ebaccbfe44ab365199ed6980874285a569fc6748a353803a59b81878
MD5 4c7f51ed2d16c090984b2ff250476168
SHA1 cc14203bddc7ab544913547419b77f0e75bbb3c3
SHA512 a458498ffb5a35e411e2eac7e0d6984747de229f328ef1e8104011251db38db5493efe28c8a53285041adb0c4e25ff06ee5a02a4f20eacfe18366b93c926386b
SSDEEP 3072:HiuCTcrs6Wumx+9JjMu4jtYsymwusCbDFyVBvoCAFLf:1Xs6p2+TITPP6BwCoLf
TLSH
T1AFD302F2EAD95E2F03EBC5DDE00B5A1B8EB4222595329F5F0BA05E2502985DD2113F4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 b87e19026faf3c60f8e0403ec2845a76acdd04c47c7eee00ad3855ec2a188607
MD5 8bfe05bb82c4ad513ea595ffd0f7c220
SHA1 b8ff593ec47c16b39fa7b3003ddc09f33baaf63b
SHA512 dd2061206b33f448a87c3dcc36e19dc47dddfea5a5add63f12d8675e55ef9917b27127d9d1b5e9651dfe311aa5ac2a13da1c6b0f031a327a8fadd0a6e8c5f332
SSDEEP 3072:miuCTcrs6Wumx+9JjMu4jtYsymwusCbDFyVBvoCAFLf:EXs6p2+TITPP6BwCoLf
TLSH
T198D302F2A9DE1D6F03FB85CDE00B5E178DB4222A9A32AF5E0BA05F1501985DD1117F8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FindProcDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu970E.tmp\FindProcDLL.dll
Size 3KB
SHA256 c0948b2ec36a69f82c08935fac4b212238b6792694f009b93b4bdb478c4f26e3
MD5 b4faf654de4284a89eaf7d073e4e1e63
SHA1 8efcfd1ca648e942cbffd27af429784b7fcf514b
SHA512 eef31e332be859cf2a64c928bf3b96442f36fe51f1a372c5628264a0d4b2fc7b3e670323c8fb5ffa72db995b8924da2555198e7de7b4f549d9e0f9e6dbb6b388
TLSH
T1E07186BA56E54FFDD1541A3030CE7003EBDE75B416AB625AC93B261A7BD0191D83CA22
MD5 SHA1 SHA512 TLSH

Submit Download

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu970E.tmp\LangDLL.dll
Size 5KB
SHA256 4cf25411f28f639f72156c24b0f66ea42f5aee5973f6c137d901da6ae42d5b7e
MD5 4b8a750993567ac9a350ba9768fabfa0
SHA1 7ee7a8c313b292d62561b085c9d490c0f8065624
SHA512 c2a06e352815a2f5340e8244cf2c5a4a5cd7e7848ea67e454ab207262cb33130008491e83d053c778bea97720f7387de737bf15355db3cd5477b94f3571107bb
SSDEEP 48:S46+/TTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8mkGofjLl:zxuPbO5tCZBVEAWyMEFv2CmqL
TLSH
T171C1A370B3D248B9D591413778AB33D36612AE746784500FDB6311AA3820AE7AD3EBC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu970E.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu970E.tmp\UAC.dll
Size 14KB
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
TLSH
T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsu970E.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu970E.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsisFirewallW.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu970E.tmp\nsisFirewallW.dll
Size 8KB
SHA256 53be5716ad80945cb99681d5dbda60492f5dfb206fbfdb776b769b3eeb18d2c2
MD5 f5bf81a102de52a4add21b8a367e54e0
SHA1 cf1e76ffe4a3ecd4dad453112afd33624f16751c
SHA512 6e280a75f706474ad31b2ce770fa34f54cb598528fac4477c466200a608b79c0f9b84011545595d9ba94331ad08e2f51bd42de91f92379db27686a28ba351256
SSDEEP 96:8SMPv+eLDUDp+weLv2lstU+0IgNB2Aa20kdArfOwJKbFrMiRsuHdRYL:wnxLDUwp6sgN2RDrzJMMmsuYL
TLSH
T16DF1F936B7E18171C26F02B09F4F569DE1F8E66067E0013377628B5D2EB029DE836526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1968_329288586\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

qbittorrent.log

Path C:\Users\Admin\AppData\Local\qBittorrent\logs\qbittorrent.log
Size 2KB
SHA256 e03c0f7cfdf1b7c13732c6598579a0326a5f8a8f5c15b84f05a0d1218a025944
MD5 818f26070c83205d1c54096f8c08b58a
SHA1 7acb3fa4431f7a190f0ec0fc8a450ae2fc6cfb90
SHA512 15b7267ba641820faec0ba8d6dc8c352aa7e602a21864498fef5e8b5e522e526e6a489d3afa05290de9a8c69a1a282f152fc52a42dddd7ac9b6c2fafb7580827
TLSH
T14A41539D06F583893DE745D7ECB5085A7F40B09E92C23836AA0D47DA3102AEEFFE2445
MD5 SHA1 SHA512 TLSH

Submit Download

lockfile

Path C:\Users\Admin\AppData\Roaming\qBittorrent\lockfile
Size 64B
SHA256 09bf810a5696bcfef453e1edea41aac4fa5fba870f1169ebf641702329b1666f
MD5 7c661ef7b7dff19373e1f103325e0b02
SHA1 e5fdfed4f79c762cd80e17012a8552c164041a8e
SHA512 d5ac5e0eea8a8e07013f34294d79329d449f70d073cca83712a64973095bc88e5a540122bcad34a4f542474b3b8076f71c54a191fb27e4012f9d2ce7654a5b82
TLSH
T13AA0029592570D096635421090B4B2261D16A6386A5C3BF0CD04615162275B1D351E45
MD5 SHA1 SHA512 TLSH

Submit Download

qBittorrent.ini

Path C:\Users\Admin\AppData\Roaming\qBittorrent\qBittorrent.ini
Size 1KB
SHA256 b298e52c12461835074399106d6f0e6b578b20616334edee26984e737fd184a0
MD5 bab0288659ba257be076b30805d2acab
SHA1 e74f366d1ec0923c6a18c0ee86d2956dae589c34
SHA512 b09df3a2c1e3ec4abd0db7b4c84c92b969dab4a872ff2ce3c796f519653a9db1332106f854f7f2a3005af81a9bbe0e82b9c51715e07f91cbe8ee5cf846724c07
TLSH
T14341A242D701716AC0DCC3055FF8C763A2378A0EE880F00BAE80B126EE0C7E014ACCC4
MD5 SHA1 SHA512 TLSH

Submit Download

qbittorrent_5.2.3_x64_setup.exe

Path C:\Users\Admin\Downloads\qbittorrent_5.2.3_x64_setup.exe
Size 41.1MB
SHA256 ff508e2f912d59c9eabaf03633ebacfd45c2049f38dcac027b8a7d7ad867ab2f
MD5 c4c58fa22842733f566c4ef47306bfd3
SHA1 d0990ba2596e7d3e57eae438d8769aec29ff7060
SHA512 c4bd6dd7db10c4e39f07ee019e54de52d3c8e718a572f112503749c0900d76f0c09da2d727123c4f8e897d34932901ebb1dc43985a9728c6e8f777a96d2ea845
SSDEEP 786432:g5mgiFGe/+eNyHgHb/LwQaPYgEqM6oRKU5etJMr5ycxkeX+K7PchrPSXZxu1pvI:gA3oeDIOb/LFawgXM6jGetJMrQGH+LKJ
TLSH
T14C9733BA2776E630D6EF41B5482CCA451A1F684EE451633AFFC22109F894D3CFE65E81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download