Malware analysis qBittorrent.html Malicious activity | ANY.RUN

analyze malware

Huge database of samples and IOCs
Custom VM setup
Unlimited submissions
Interactive approach

Add for printing

download:	qBittorrent.html
Full analysis:	https://app.any.run/tasks/0e7e9dd1-df53-4c2e-ab21-d2813d263121
Verdict:	Malicious activity
Analysis date:	August 05, 2019 at 04:29:47
OS:	Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME:	text/html
File info:	HTML document, UTF-8 Unicode text, with very long lines
MD5:	510CB7FE88E8829774BA9333ABE6F72A
SHA1:	487007C6B3EC1D20D9CA4957CB7F4DCD2AE6CF28
SHA256:	0BFCDFCC93322166AA3A17811FEEAC2559EE04648366173EC1BF4F953BF5EA5A
SSDEEP:	1536:wzGDHSMGIwIRnXlIII26tFfL7BlKRVJz9WTYJ/x80EK9vTprJtoMz+rOvrFElMF8:wQXIEoPbo1+Z

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 300 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: 240 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 8.0.7601.17514 undefined
Adobe Acrobat Reader DC MUI (15.023.20070)
Adobe Flash Player 26 ActiveX (26.0.0.131)
Adobe Flash Player 26 NPAPI (26.0.0.131)
Adobe Flash Player 26 PPAPI (26.0.0.131)
Adobe Refresh Manager (1.8.0)
CCleaner (5.35)
FileZilla Client 3.36.0 (3.36.0)
Google Chrome (75.0.3770.100)
Google Update Helper (1.3.34.7)
Java 8 Update 92 (8.0.920.14)
Java Auto Updater (2.8.92.14)
Microsoft .NET Framework 4.7.2 (4.7.03062)
Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Professional 2010 (14.0.6029.1000)
Microsoft Office Proof (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (French) 2010 (14.0.6029.1000)
Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Single Image 2010 (14.0.6029.1000)
Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.21.27702 (14.21.27702.2)
Microsoft Visual C++ 2019 X86 Additional Runtime - 14.21.27702 (14.21.27702)
Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.21.27702 (14.21.27702)
Mozilla Firefox 68.0.1 (x86 en-US) (68.0.1)
Notepad++ (32-bit x86) (7.5.1)
Opera 12.15 (12.15.1748)
Skype version 8.29 (8.29)
Update for Microsoft .NET Framework 4.7.2 (KB4087364) (1)
VLC media player (2.2.6)
WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

Client LanguagePack Package
Client Refresh LanguagePack Package
CodecPack Basic Package
Foundation Package
IE Troubleshooters Package
InternetExplorer Optional Package
KB2534111
KB2999226
KB4019990
KB976902
LocalPack AU Package
LocalPack CA Package
LocalPack GB Package
LocalPack US Package
LocalPack ZA Package
ProfessionalEdition
UltimateEdition

Add for printing

MALICIOUS
- Application was dropped or rewritten from another process
  - qbittorrent_4.1.7_x64_setup.exe (PID: 2764)
  - qbittorrent_4.1.7_x64_setup.exe (PID: 2288)
  - qbittorrent_4.1.7_setup.exe (PID: 3840)
  - qbittorrent_4.1.7_setup.exe (PID: 456)
  - qbittorrent.exe (PID: 2620)
- Loads dropped or rewritten executable
  - qbittorrent_4.1.7_x64_setup.exe (PID: 2288)
  - qbittorrent_4.1.7_x64_setup.exe (PID: 2764)
  - qbittorrent_4.1.7_setup.exe (PID: 3840)
  - qbittorrent_4.1.7_setup.exe (PID: 456)
SUSPICIOUS
- Executable content was dropped or overwritten
  - chrome.exe (PID: 2380)
  - chrome.exe (PID: 3752)
  - qbittorrent_4.1.7_x64_setup.exe (PID: 2764)
  - qbittorrent_4.1.7_x64_setup.exe (PID: 2288)
  - chrome.exe (PID: 2308)
  - qbittorrent_4.1.7_setup.exe (PID: 3840)
  - chrome.exe (PID: 916)
  - qbittorrent_4.1.7_setup.exe (PID: 456)
- Modifies files in Chrome extension folder
  - chrome.exe (PID: 3752)
- Application launched itself
  - qbittorrent_4.1.7_x64_setup.exe (PID: 2764)
  - qbittorrent_4.1.7_setup.exe (PID: 3840)
- Modifies the open verb of a shell class
  - qbittorrent_4.1.7_setup.exe (PID: 456)
  - qbittorrent_4.1.7_setup.exe (PID: 3840)
- Creates a software uninstall entry
  - qbittorrent_4.1.7_setup.exe (PID: 456)
- Creates files in the user directory
  - qbittorrent.exe (PID: 2620)
- Creates files in the program directory
  - qbittorrent_4.1.7_setup.exe (PID: 456)
INFO
- Changes internet zones settings
  - iexplore.exe (PID: 1568)
- Manual execution by user
  - chrome.exe (PID: 3752)
  - chrome.exe (PID: 2308)
- Reads internet explorer settings
  - iexplore.exe (PID: 1992)
- Application launched itself
  - iexplore.exe (PID: 1568)
  - chrome.exe (PID: 3752)
  - chrome.exe (PID: 2308)
- Reads Internet Cache Settings
  - chrome.exe (PID: 3752)
  - chrome.exe (PID: 2308)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.html	\|	HyperText Markup Language (100)

EXIF

HTML

ContentType:	text/html; charset=utf-8
HTTPEquivXUACompatible:	IE=Edge
appleMobileWebAppCapable:	yes
appleMobileWebAppStatusBarStyle:	#033465
appleMobileWebAppTitle:	FOSSHUB
appleMobileWebAppOrientations:	portrait-any
formatDetection:	date=no
viewport:	user-scalable=no,initial-scale=1,maximum-scale=1,minimum-scale=1,width=device-width,height=device-height
language:	en-US
Author:	FOSSHUB
Distribution:	global
Rating:	safe for kids
dctermsRightsHolder:	FOSSHUB
dctermsRights:	All rights reserved.
dctermsDateCopyrighted:	2018
version:	1.0.2
Title:	Download qBittorrent Free Software.
Description:	Free, Open-Source, cross-platform torrent client based on the Qt toolkit and libtorrent-rasterbar library.
Abstract:	Security Software Download.
Keywords:	torrent, manager, alternative, Qt toolkit, libtorrent-rasterbar
news_keywords:	torrent, manager, alternative, Qt toolkit, libtorrent-rasterbar
referrer:	origin
Robots:	index, follow
RevisitAfter:	1 day
themeColor:	#ffffff
twitterCard:	summary
twitterSite:	@Foss_Hub
twitterCreator:	@Foss_Hub
twitterDescription:	Free, Open-Source, cross-platform torrent client based on the Qt toolkit and libtorrent-rasterbar library.
twitterTitle:	qBittorrent
applicationName:	FOSSHUB
msapplicationNavbuttonColor:	#2b5797
msapplicationTileColor:	#2b5797
msapplicationTileImage:	qBittorrent
msapplicationTooltip:	qBittorrent: Free software download for windows, linux, osx.
msapplicationWindow:	width=1280;height=800
msapplicationSquare70x70logo:	/media/favicon/mstile-70x70.png
msapplicationSquare150x150logo:	/media/favicon/mstile-150x150.png
msapplicationWide310x150logo:	/media/favicon/mstile-310x150.png
msapplicationSquare310x310logo:	/media/favicon/mstile-310x310.png

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

276

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1036,2107547833900519239,14757768810025504302,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=5273248873501157299 --mojo-platform-channel-handle=1016 --ignored=" --type=renderer " /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

—

chrome.exe

User:

admin

Company:

Google LLC

Integrity Level:

LOW

Description:

Google Chrome

Exit code:

Version:

75.0.3770.100

Modules

Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll

356

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2876 --on-initialized-event-handle=312 --parent-handle=316 /prefetch:6

C:\Program Files\Google\Chrome\Application\chrome.exe

—

chrome.exe

User:

admin

Company:

Google LLC

Integrity Level:

MEDIUM

Description:

Google Chrome

Exit code:

Version:

75.0.3770.100

Modules

Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll

456

"C:\Users\admin\Downloads\qbittorrent_4.1.7_setup.exe" /UAC:F01C2 /NCRC

C:\Users\admin\Downloads\qbittorrent_4.1.7_setup.exe

qbittorrent_4.1.7_setup.exe

User:

admin

Company:

The qBittorrent project

Integrity Level:

HIGH

Description:

qBittorrent - A Bittorrent Client

Exit code:

Version:

4.1.7

Modules

Images
c:\users\admin\downloads\qbittorrent_4.1.7_setup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll

872

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1036,2107547833900519239,14757768810025504302,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=15730437143115757836 --mojo-platform-channel-handle=3356 --ignored=" --type=renderer " /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

—

chrome.exe

User:

admin

Company:

Google LLC

Integrity Level:

LOW

Description:

Google Chrome

Exit code:

Version:

75.0.3770.100

Modules

Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll

900

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1036,2107547833900519239,14757768810025504302,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=5619904291624358441 --mojo-platform-channel-handle=3620 --ignored=" --type=renderer " /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

—

chrome.exe

User:

admin

Company:

Google LLC

Integrity Level:

LOW

Description:

Google Chrome

Exit code:

Version:

75.0.3770.100

Modules

Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll

916

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1020,7792034887528170435,5955707041088931179,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=3272876930818083432 --mojo-platform-channel-handle=1568 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

chrome.exe

User:

admin

Company:

Google LLC

Integrity Level:

MEDIUM

Description:

Google Chrome

Exit code:

Version:

75.0.3770.100

Modules

Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll

1128

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1036,2107547833900519239,14757768810025504302,131072 --enable-features=PasswordImport --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=5418743432392233312 --mojo-platform-channel-handle=2528 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

—

chrome.exe

User:

admin

Company:

Google LLC

Integrity Level:

MEDIUM

Description:

Google Chrome

Exit code:

Version:

75.0.3770.100

Modules

Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll

1344

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1020,7792034887528170435,5955707041088931179,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=14860661990741016247 --mojo-platform-channel-handle=3520 --ignored=" --type=renderer " /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

—

chrome.exe

User:

admin

Company:

Google LLC

Integrity Level:

LOW

Description:

Google Chrome

Exit code:

Version:

75.0.3770.100

Modules

Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll

1364

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1020,7792034887528170435,5955707041088931179,131072 --enable-features=PasswordImport --lang=en-US --no-sandbox --service-request-channel-token=16701940849319089298 --mojo-platform-channel-handle=3056 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

—

chrome.exe

User:

admin

Company:

Google LLC

Integrity Level:

MEDIUM

Description:

Google Chrome

Exit code:

Version:

75.0.3770.100

Modules

Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll

1568

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Temp\qBittorrent.html

C:\Program Files\Internet Explorer\iexplore.exe

explorer.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Internet Explorer

Exit code:

Version:

8.00.7600.16385 (win7_rtm.090713-1255)

Modules

Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll

Add for printing

Total events

2 791

Read events

2 538

Write events

243

Delete events

Modification events


(PID) Process:	(1568) iexplore.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:	write	Name:	CompatibilityFlags
Value: 0
(PID) Process:	(1568) iexplore.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	UNCAsIntranet
Value: 0
(PID) Process:	(1568) iexplore.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	AutoDetect
Value: 1
(PID) Process:	(1568) iexplore.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:	write	Name:	SecuritySafe
Value: 1
(PID) Process:	(1568) iexplore.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:	write	Name:	ProxyEnable
Value: 0
(PID) Process:	(1568) iexplore.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:	write	Name:	SavedLegacySettings
Value: 4600000092000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:	(1568) iexplore.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:	write	Name:	{B5210613-B739-11E9-9885-5254004A04AF}
Value: 0
(PID) Process:	(1568) iexplore.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:	write	Name:	Type
Value: 4
(PID) Process:	(1568) iexplore.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:	write	Name:	Count
Value: 2
(PID) Process:	(1568) iexplore.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:	write	Name:	Time
Value: E30708000100050004001E000A00CB02

Add for printing

Executable files

Suspicious files

Text files

327

Unknown types

Dropped files

PID	Process	Filename		Type
1568	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico		—
		MD5:—	SHA256:—
1568	iexplore.exe	C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico		—
		MD5:—	SHA256:—
1568	iexplore.exe	C:\Users\admin\AppData\Local\Temp\~DF9878352669052551.TMP		—
		MD5:—	SHA256:—
1568	iexplore.exe	C:\Users\admin\AppData\Local\Temp\~DF972140D1AA5B0BC9.TMP		—
		MD5:—	SHA256:—
1568	iexplore.exe	C:\Users\admin\AppData\Local\Temp\~DF390F1F0EBE881D93.TMP		—
		MD5:—	SHA256:—
3752	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\6215412d-2b10-4c69-9ed7-6882d4358432.tmp		—
		MD5:—	SHA256:—
3752	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000020.dbtmp		—
		MD5:—	SHA256:—
1568	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\RecoveryStore.{B5210615-B739-11E9-9885-5254004A04AF}.dat		binary
		MD5:78DEB822EF9DEC2AA13631728E7132FF	SHA256:D0F575124C2D1AB39B66DA099B02E822C14FFC0F1AFDF2E9EB4C752D73B8D653
1568	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\{B5210616-B739-11E9-9885-5254004A04AF}.dat		binary
		MD5:C8943196F25CC8B748CF165C17974185	SHA256:8EC4BB7D1182FA5946B66AA3B5A610FDBD81A6520A84FBEC825CE7C477176F58
1568	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{B5210614-B739-11E9-9885-5254004A04AF}.dat		binary
		MD5:E9D1567493A9C725A1209FE6E37E3FC6	SHA256:19D6FFC5F566955CF45B7BACC500D9306FDB99F8E7CA86262210D8387BC29350

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

303

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
2620	qbittorrent.exe	GET	—	176.31.225.118:80	http://tracker.trackerfix.com/announce?info_hash=%23(%f8%9dU%d28%099%9e%f7-%0c%ad%a7J%0ey%f7%3a&peer_id=-qB4170-_lF0.qv(lo!b&port=8999&uploaded=0&downloaded=0&left=16384&corrupt=0&key=FEDB2163&event=started&numwant=200&compact=1&no_peer_id=1&supportcrypto=1&redundant=0	FR	—	—	suspicious
2620	qbittorrent.exe	GET	—	176.31.225.118:80	http://tracker.trackerfix.com/announce?info_hash=%23(%f8%9dU%d28%099%9e%f7-%0c%ad%a7J%0ey%f7%3a&peer_id=-qB4170-vPJO7P0*dXZ2&port=8999&uploaded=0&downloaded=0&left=278241037&corrupt=0&key=A65E37CF&event=started&numwant=200&compact=1&no_peer_id=1&supportcrypto=1&redundant=0	FR	—	—	suspicious
2620	qbittorrent.exe	GET	—	176.31.225.118:80	http://tracker.trackerfix.com/announce?info_hash=%23(%f8%9dU%d28%099%9e%f7-%0c%ad%a7J%0ey%f7%3a&peer_id=-qB4170-_lF0.qv(lo!b&port=8999&uploaded=0&downloaded=0&left=16384&corrupt=0&key=FEDB2163&event=started&numwant=200&compact=1&no_peer_id=1&supportcrypto=1&redundant=0	FR	—	—	suspicious
2380	chrome.exe	GET	302	172.217.22.14:80	http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOWVmQUFXS041NV9ZVXlJVWwxbGc5TUM4dw/7519.422.0.3_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx	US	html	514 b	whitelisted
2380	chrome.exe	GET	200	173.194.139.6:80	http://r1---sn-aigzrn7k.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOWVmQUFXS041NV9ZVXlJVWwxbGc5TUM4dw/7519.422.0.3_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx?cms_redirect=yes&mip=185.43.110.12&mm=28&mn=sn-aigzrn7k&ms=nvh&mt=1564979356&mv=m&mvi=0&pl=23&shardbypass=yes	US	crx	862 Kb	whitelisted
1568	iexplore.exe	GET	200	204.79.197.200:80	http://www.bing.com/favicon.ico	US	image	237 b	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
1568	iexplore.exe	204.79.197.200:80	www.bing.com	Microsoft Corporation	US	whitelisted
4	System	104.19.197.151:445	cdnjs.cloudflare.com	Cloudflare Inc	US	shared
4	System	104.19.196.151:445	cdnjs.cloudflare.com	Cloudflare Inc	US	shared
4	System	104.19.195.151:445	cdnjs.cloudflare.com	Cloudflare Inc	US	shared
4	System	104.19.195.151:139	cdnjs.cloudflare.com	Cloudflare Inc	US	shared
4	System	104.19.199.151:445	cdnjs.cloudflare.com	Cloudflare Inc	US	shared
2380	chrome.exe	172.217.23.173:443	accounts.google.com	Google Inc.	US	whitelisted
2380	chrome.exe	172.217.22.99:443	www.google.com.ua	Google Inc.	US	whitelisted
2380	chrome.exe	172.217.18.10:443	fonts.googleapis.com	Google Inc.	US	whitelisted
2380	chrome.exe	172.217.16.163:443	fonts.gstatic.com	Google Inc.	US	whitelisted

DNS requests

Domain	IP	Reputation
cdnjs.cloudflare.com	104.19.196.151 104.19.197.151 104.19.198.151 104.19.199.151 104.19.195.151	whitelisted
www.bing.com	204.79.197.200 13.107.21.200	whitelisted
clientservices.googleapis.com	172.217.23.131	whitelisted
accounts.google.com	172.217.23.173	shared
www.google.com.ua	172.217.22.99	whitelisted
fonts.googleapis.com	172.217.18.10	whitelisted
www.gstatic.com	172.217.16.131	whitelisted
fonts.gstatic.com	172.217.16.163	whitelisted
apis.google.com	172.217.22.110	whitelisted
clients2.google.com	172.217.22.46	whitelisted

Threats

PID	Process	Class	Message
—	—	Potential Corporate Privacy Violation	ET P2P BitTorrent DHT ping request
—	—	Potential Corporate Privacy Violation	ET P2P Vuze BT UDP Connection (5)
—	—	Potentially Bad Traffic	ET DNS Query for .to TLD
—	—	Potential Corporate Privacy Violation	GPL P2P BitTorrent announce request
—	—	Potential Corporate Privacy Violation	GPL P2P BitTorrent announce request
—	—	Potential Corporate Privacy Violation	GPL P2P BitTorrent transfer
—	—	Potential Corporate Privacy Violation	ET P2P BitTorrent peer sync
—	—	Potential Corporate Privacy Violation	ET P2P BitTorrent peer sync
—	—	Potential Corporate Privacy Violation	GPL P2P BitTorrent announce request
—	—	Potential Corporate Privacy Violation	ET P2P BitTorrent peer sync

Add for printing

Process	Message
qbittorrent.exe	QObject::startTimer: Timers cannot have negative intervals

General Info

qBittorrent.html

510CB7FE88E8829774BA9333ABE6F72A

487007C6B3EC1D20D9CA4957CB7F4DCD2AE6CF28

0BFCDFCC93322166AA3A17811FEEAC2559EE04648366173EC1BF4F953BF5EA5A

1536:wzGDHSMGIwIRnXlIII26tFfL7BlKRVJz9WTYJ/x80EK9vTprJtoMz+rOvrFElMF8:wQXIEoPbo1+Z

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Application was dropped or rewritten from another process

Loads dropped or rewritten executable

SUSPICIOUS

Executable content was dropped or overwritten

Modifies files in Chrome extension folder

Application launched itself

Modifies the open verb of a shell class

Creates a software uninstall entry

Creates files in the user directory

Creates files in the program directory

INFO

Changes internet zones settings

Manual execution by user

Reads internet explorer settings

Application launched itself

Reads Internet Cache Settings

Malware configuration

Static information

TRiD

EXIF

HTML

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings