52dda648edf6eab8fdb5187e2866bb337e73e9025a0e13dced7abe00f899d44e

Resubmissions

01-03-2023 19:03

230301-xqjj8ahg39 8

26-02-2023 16:12

230226-tnwj8ahc3w 8

Analysis

max time kernel
44s
max time network
71s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
01-03-2023 19:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

utorrent_installer.exe
Size

1.7MB
MD5

b6b16ce1d51baf68aedf62e35e9390c9
SHA1

428efbd8c1a3a92eac36694ef4ed0ba76801342a
SHA256

52dda648edf6eab8fdb5187e2866bb337e73e9025a0e13dced7abe00f899d44e
SHA512

996fac7d5311dd258972df0ed9e392aeefbd9a11bc38614347f296fc62b6164d039c9ae21a9e10dc49019cd8f7bcd6e2d37c89d990de23de146ee90f560bacbb
SSDEEP

24576:S4nXubIQGyxbPV0db26sdGr9Y0kpZZymuz7lnAjEHLcfVLKswfsQ:Sqe3f6b9Ynpryh71SaLcfxOfsQ

Score

8^/10

discovery evasion persistence upx

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	uTorrent.exe

Executes dropped EXE 7 IoCs

pid	Process
1668	utorrent_installer.tmp
3592	uTorrent.exe
2632	utorrent.exe
5028	uTorrent.exe
1904	utorrentie.exe
3244	utorrentie.exe
3848	MicrosoftEdgeWebView2Setup.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Wine	utorrent.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	uTorrent.exe
Key opened	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Wine	uTorrent.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	utorrent.exe

Loads dropped DLL 15 IoCs

pid	Process
1668	utorrent_installer.tmp
1668	utorrent_installer.tmp
3592	uTorrent.exe
3592	uTorrent.exe
3592	uTorrent.exe
3592	uTorrent.exe
3592	uTorrent.exe
2632	utorrent.exe
2632	utorrent.exe
2632	utorrent.exe
2632	utorrent.exe
3592	uTorrent.exe
5028	uTorrent.exe
5028	uTorrent.exe
5028	uTorrent.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0005000000023133-199.dat	upx
behavioral2/files/0x0005000000023133-205.dat	upx
behavioral2/memory/2632-213-0x0000000000400000-0x0000000000D1C000-memory.dmp	upx
behavioral2/files/0x0005000000023133-214.dat	upx
behavioral2/memory/2632-238-0x0000000000400000-0x0000000000D1C000-memory.dmp	upx
behavioral2/files/0x0001000000023141-254.dat	upx
behavioral2/memory/5028-266-0x0000000000400000-0x0000000000D1C000-memory.dmp	upx
behavioral2/files/0x0001000000023141-271.dat	upx
behavioral2/memory/5028-519-0x0000000000400000-0x0000000000D1C000-memory.dmp	upx
behavioral2/memory/5028-609-0x0000000000400000-0x0000000000D1C000-memory.dmp	upx
behavioral2/memory/5028-929-0x0000000000400000-0x0000000000D1C000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Windows\CurrentVersion\Run	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ut = "C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe /MINIMIZED"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Windows\CurrentVersion\Run	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ut = "\"C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe\" /MINIMIZED"	uTorrent.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_tr.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_bn-IN.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\psmachine_arm64.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_bg.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_ms.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_nl.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_lo.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_en.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_hr.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_gl.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_de.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_sv.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\psuser.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_cs.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_da.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_es-419.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_et.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_it.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\MicrosoftEdgeUpdateBroker.exe	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_lb.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_fil.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_ro.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_ka.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\psuser_64.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\EdgeUpdate.dat	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_ca-Es-VALENCIA.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdate.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_th.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_ml.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_pt-BR.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_sk.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_as.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_bs.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_or.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_en-GB.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_lv.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_sr-Latn-RS.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_ar.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_id.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_ur.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_az.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_fr-CA.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_sr-Cyrl-BA.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\MicrosoftEdgeComRegisterShellARM64.exe	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\psuser_arm64.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_ca.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_el.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_ko.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_mr.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_ru.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_eu.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\psmachine_64.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_bn.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_quz.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_pl.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_gd.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_tt.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_is.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_lt.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_iw.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_zh-TW.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_ne.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_nn.dll	MicrosoftEdgeWebView2Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	uTorrent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	uTorrent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	uTorrent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	uTorrent.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	uTorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\utorrentie.exe = "11000"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION	uTorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION\utorrentie.exe = "1"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CROSS_DOMAIN_REDIRECT_MITIGATION	uTorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CROSS_DOMAIN_REDIRECT_MITIGATION\utorrentie.exe = "0"	uTorrent.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\.btapp	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\.btapp\Content Type = "application/x-bittorrent-app"	utorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-appinst\Extension = ".btinstall"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\bittorrent	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\.torrent\OpenWithProgids\uTorrent	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\.btsearch	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\.btsearch\Content Type = "application/x-bittorrentsearchdescription+xml"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\bittorrent\DefaultIcon	utorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-app	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\.btskin\ = "uTorrent"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\MIME\Database\Content Type\application/x-bittorrent\Extension = ".torrent"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\uTorrent	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\uTorrent\shell	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Magnet\shell	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\bittorrent\URL Protocol	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\bittorrent\shell\ = "open"	utorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-appinst	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\.torrent\ = "uTorrent"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Magnet\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\maindoc.ico"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-app\Extension = ".btapp"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-skin\Extension = ".btskin"	utorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-key\Extension = ".btkey"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Applications	utorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\MIME\Database\Content Type\application/x-bittorrent	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\uTorrent\Content Type	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\bittorrent\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\maindoc.ico"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-app	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\FalconBetaAccount\remote_access_client_id = "4134958513"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Magnet\shell\ = "open"	utorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent\Extension = ".torrent"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Magnet\Content Type = "application/x-magnet"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\bittorrent\ = "bittorrent URI"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\.btapp\ = "uTorrent"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\.btskin\Content Type = "application/x-bittorrent-skin"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\.btsearch\OpenWithProgids	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Applications\uTorrent.exe\shell\ = "open"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\.torrent\Content Type = "application/x-bittorrent"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\.btinstall\Content Type = "application/x-bittorrent-appinst"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Applications\uTorrent.exe\shell\open\command	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\bittorrent\shell\open	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\uTorrent\shell\open\command	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Magnet\ = "Magnet URI"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-appinst\Extension = ".btinstall"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Applications\uTorrent.exe\shell	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\FalconBetaAccount	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\bittorrent\Content Type = "application/x-bittorrent-protocol"	utorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-app\Extension = ".btapp"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\.btinstall\ = "uTorrent"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-appinst	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Applications\uTorrent.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe\" \"%1\" /SHELLASSOC"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Magnet\shell\open\command	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml\Extension = ".btsearch"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Magnet\URL Protocol	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Magnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe\" \"%1\" /SHELLASSOC"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-key\Extension = ".btkey"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\.btsearch\OpenWithProgids\uTorrent	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\.btsearch\ = "uTorrent"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\uTorrent\DefaultIcon	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\uTorrent\shell\open	utorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml\Extension = ".btsearch"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\.btskin	utorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-key	utorrent.exe

Script User-Agent 5 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	58	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	59	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	62	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	18	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	55	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
3592	uTorrent.exe
3592	uTorrent.exe
5028	uTorrent.exe
5028	uTorrent.exe
1904	utorrentie.exe
1904	utorrentie.exe
3244	utorrentie.exe
3244	utorrentie.exe
3244	utorrentie.exe
1904	utorrentie.exe
1904	utorrentie.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	2632	utorrent.exe
Token: SeManageVolumePrivilege	5028	uTorrent.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1668	utorrent_installer.tmp
5028	uTorrent.exe
5028	uTorrent.exe
5028	uTorrent.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5028	uTorrent.exe
5028	uTorrent.exe
5028	uTorrent.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1904	utorrentie.exe
1904	utorrentie.exe
3244	utorrentie.exe
3244	utorrentie.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 1668	3936	utorrent_installer.exe	87
PID 3936 wrote to memory of 1668	3936	utorrent_installer.exe	87
PID 3936 wrote to memory of 1668	3936	utorrent_installer.exe	87
PID 1668 wrote to memory of 3592	1668	utorrent_installer.tmp	99
PID 1668 wrote to memory of 3592	1668	utorrent_installer.tmp	99
PID 1668 wrote to memory of 3592	1668	utorrent_installer.tmp	99
PID 3592 wrote to memory of 2632	3592	uTorrent.exe	100
PID 3592 wrote to memory of 2632	3592	uTorrent.exe	100
PID 3592 wrote to memory of 2632	3592	uTorrent.exe	100
PID 1668 wrote to memory of 5028	1668	utorrent_installer.tmp	104
PID 1668 wrote to memory of 5028	1668	utorrent_installer.tmp	104
PID 1668 wrote to memory of 5028	1668	utorrent_installer.tmp	104
PID 5028 wrote to memory of 1904	5028	uTorrent.exe	106
PID 5028 wrote to memory of 1904	5028	uTorrent.exe	106
PID 5028 wrote to memory of 1904	5028	uTorrent.exe	106
PID 5028 wrote to memory of 3244	5028	uTorrent.exe	107
PID 5028 wrote to memory of 3244	5028	uTorrent.exe	107
PID 5028 wrote to memory of 3244	5028	uTorrent.exe	107
PID 5028 wrote to memory of 3848	5028	uTorrent.exe	108
PID 5028 wrote to memory of 3848	5028	uTorrent.exe	108
PID 5028 wrote to memory of 3848	5028	uTorrent.exe	108
PID 5028 wrote to memory of 3912	5028	uTorrent.exe	109
PID 5028 wrote to memory of 3912	5028	uTorrent.exe	109

C:\Users\Admin\AppData\Local\Temp\utorrent_installer.exe
"C:\Users\Admin\AppData\Local\Temp\utorrent_installer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Users\Admin\AppData\Local\Temp\is-A6RB0.tmp\utorrent_installer.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-A6RB0.tmp\utorrent_installer.tmp" /SL5="$B0160,874637,815104,C:\Users\Admin\AppData\Local\Temp\utorrent_installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Users\Admin\AppData\Local\Temp\is-M0DVF.tmp\uTorrent.exe
    "C:\Users\Admin\AppData\Local\Temp\is-M0DVF.tmp\uTorrent.exe" /S /FORCEINSTALL 1110010101111110
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3592
  - - C:\Users\Admin\AppData\Local\Temp\utorrent\utorrent.exe
      "C:\Users\Admin\AppData\Local\Temp\utorrent\utorrent.exe" /S /FORCEINSTALL 1110010101111110
      4⤵
      Executes dropped EXE
      Identifies Wine through registry keys
      Loads dropped DLL
      Adds Run key to start application
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:2632
- - C:\Users\Admin\AppData\Roaming\uTorrent\uTorrent.exe
    "C:\Users\Admin\AppData\Roaming\uTorrent\uTorrent.exe"
    3⤵
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - Adds Run key to start application
    - Checks SCSI registry key(s)
    - Modifies Internet Explorer settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:5028
  - - C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_46716\utorrentie.exe
      "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_46716\utorrentie.exe" uTorrent_5028_00D8A340_996641636 µTorrent4823DF041B09 uTorrent ie unp
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:1904
  - - C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_46716\utorrentie.exe
      "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_46716\utorrentie.exe" uTorrent_5028_03E9E080_41850294 µTorrent4823DF041B09 uTorrent ie unp
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:3244
  - - C:\Users\Admin\AppData\Roaming\uTorrent\MicrosoftEdgeWebView2Setup.exe
      MicrosoftEdgeWebView2Setup.exe /silent /install
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      PID:3848
    - - C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
        5⤵
        
        PID:3644
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        6⤵
        
        PID:1752
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        6⤵
        
        PID:2160
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.45\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.45\MicrosoftEdgeUpdateComRegisterShell64.exe"
        7⤵
        
        PID:4356
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.45\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.45\MicrosoftEdgeUpdateComRegisterShell64.exe"
        7⤵
        
        PID:756
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.45\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.45\MicrosoftEdgeUpdateComRegisterShell64.exe"
        7⤵
        
        PID:5148
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzMuNDUiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzMuNDUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MzIyRkM2RTEtMDhCRi00MDYwLTk4QTctNTVDRTNEQjc5RURCfSIgdXNlcmlkPSJ7MTA5RjA0QjktNjIyRi00QTBFLUJGNkItNzk5M0Y3NDM4NTBFfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InsxNTQzQUFEMi03Nzg1LTQyQ0MtOEEzQS04RTdGMzk3QzI5OTl9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3FXSlN6V3dQZmRjTFIrWEdJdjZ4clpmaVlPeGhQVTJzMU5XbWpXY2FGUGc9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNzMuNDUiIG5leHR2ZXJzaW9uPSIxLjMuMTczLjQ1IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0NjY1MjU2MDQzIiBpbnN0YWxsX3RpbWVfbXM9IjI4MzQiLz48L2FwcD48L3JlcXVlc3Q-
        6⤵
        
        PID:5712
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{322FC6E1-08BF-4060-98A7-55CE3DB79EDB}" /silent
        6⤵
        
        PID:5984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://utorrent.com/prodnews?v=3%2e6%2e0%2e1%2e46716&pv=0.0.0.0.0
      4⤵
      PID:3912
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc4e3846f8,0x7ffc4e384708,0x7ffc4e384718
        5⤵
        
        PID:4596
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,18427317591095947731,11706858652118789675,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
        5⤵
        
        PID:2968
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,18427317591095947731,11706858652118789675,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
        5⤵
        
        PID:1412
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,18427317591095947731,11706858652118789675,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
        5⤵
        
        PID:5088
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18427317591095947731,11706858652118789675,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
        5⤵
        
        PID:5340
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18427317591095947731,11706858652118789675,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
        5⤵
        
        PID:5376
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18427317591095947731,11706858652118789675,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
        5⤵
        
        PID:6008
  - - C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_46716\utorrentie.exe
      "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_46716\utorrentie.exe" uTorrent_5028_03E9ACA8_599245374 µTorrent4823DF041B09 uTorrent ie unp
      4⤵
      PID:1568
  - - C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_46716\utorrentie.exe
      "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_46716\utorrentie.exe" uTorrent_5028_03E82760_116514263 µTorrent4823DF041B09 uTorrent ie unp
      4⤵
      PID:5348
  - - C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_46716\utorrentie.exe
      "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_46716\utorrentie.exe" uTorrent_5028_03F22968_722489539 µTorrent4823DF041B09 uTorrent ie unp
      4⤵
      PID:5392

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}
1⤵
PID:1924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5272

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
PID:5152
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzMuNDUiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzMuNDUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MzIyRkM2RTEtMDhCRi00MDYwLTk4QTctNTVDRTNEQjc5RURCfSIgdXNlcmlkPSJ7MTA5RjA0QjktNjIyRi00QTBFLUJGNkItNzk5M0Y3NDM4NTBFfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins0MDBFOTNFQi1DNDM3LTRGQzQtQjMyMC04MURBMjM2OUJBODR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3FXSlN6V3dQZmRjTFIrWEdJdjZ4clpmaVlPeGhQVTJzMU5XbWpXY2FGUGc9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEwNi4wLjUyNDkuMTE5IiBuZXh0dmVyc2lvbj0iMTA2LjAuNTI0OS4xMTkiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSI1IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0NzAzOTM2MjUxIi8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  PID:5900

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
ae0bd70d0d7e467457b9e39b29f78410

SHA1
b4a549508cbc9f975a191434d4d20ad3c28d5028

SHA256
4d9f16b00bda1db65b68cb486f7ae1bf5b32aedf7fd335e4a8ef2fa087870986

SHA512
cbe2b5ffe647f5318edd9825ea6536d6d14dab66920def0323fb5b4dc03a4f8b6781b9209e5a557ab4d270b3f2b170797e6bd807195c93869367c0a245a3168e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\EdgeUpdate.dat

Filesize
12KB

MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\MicrosoftEdgeComRegisterShellARM64.exe

Filesize
179KB

MD5
66fcafc9f2f49c19563d76f5337788f1

SHA1
9544b0b23129dccaa43eaa5da4b5b4aa5eedf88d

SHA256
06cfede5f76e1f17f971fa265e318e22fa6d743f0ee5879dfa9b09f5f471f207

SHA512
ae1b4435e866ea4795e370940a8524a1b0bf04941612017831363b735d97184f1a125af9f7aef1e755b1b242419adbe4e5db7473ff090ca87d6669c25b76f14d

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
ae0bd70d0d7e467457b9e39b29f78410

SHA1
b4a549508cbc9f975a191434d4d20ad3c28d5028

SHA256
4d9f16b00bda1db65b68cb486f7ae1bf5b32aedf7fd335e4a8ef2fa087870986

SHA512
cbe2b5ffe647f5318edd9825ea6536d6d14dab66920def0323fb5b4dc03a4f8b6781b9209e5a557ab4d270b3f2b170797e6bd807195c93869367c0a245a3168e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
ae0bd70d0d7e467457b9e39b29f78410

SHA1
b4a549508cbc9f975a191434d4d20ad3c28d5028

SHA256
4d9f16b00bda1db65b68cb486f7ae1bf5b32aedf7fd335e4a8ef2fa087870986

SHA512
cbe2b5ffe647f5318edd9825ea6536d6d14dab66920def0323fb5b4dc03a4f8b6781b9209e5a557ab4d270b3f2b170797e6bd807195c93869367c0a245a3168e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Filesize
212KB

MD5
a0a6fe642213826a1613a5208a008055

SHA1
e9059ce64a1ee047d299c88a9c64edf61cdc0504

SHA256
f87c42f298612bb4cdaba4d56cbc1fde4856648bb1b771651b985b5d0f163cba

SHA512
bfa27c53eda95fea35e2b732fae85760f4c260999a646d951a7c2c0ad34f1c7af0a8d90916f4f99ba1cb1951801dfee01d0f7f2775e4491519187fa8b9718d5b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\MicrosoftEdgeUpdateCore.exe

Filesize
257KB

MD5
465c5a2eae01ad9cc32ed0c5348fc2dc

SHA1
aaccb9ae7aa82c8ed62a43571596c3a965b658b6

SHA256
ff9b8963958042a650acf2f13a3697e5bb1c5ff2cab55d06166f5527de626021

SHA512
605d9f9d12b981f218d0636912e048d4a76f01c960793ae9f6e1dd59f49c1fc2e615b51d919605d433467bb2fe9b9fa5fdb979432085a88f568b3b4cf876af44

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\NOTICE.TXT

Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdate.dll

Filesize
2.1MB

MD5
6545c51ed0d062d63c7dd5a6f00a32c6

SHA1
b6b7e5f44cb3c11f76a46e18fa7d80be9f6fdbd3

SHA256
f9431d85c0869faf740220f88b2d8db61b53d9fb324da995d938412caaed0f3e

SHA512
c99b0333b4e598fd9cad556a2fd60c725ae4c4ae45d53a45a7e051d106e3e24c401fd8686eb707d8357f01d899734889271ea3fda28bb55b7d35dcd338db7fb2

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdate.dll

Filesize
2.1MB

MD5
6545c51ed0d062d63c7dd5a6f00a32c6

SHA1
b6b7e5f44cb3c11f76a46e18fa7d80be9f6fdbd3

SHA256
f9431d85c0869faf740220f88b2d8db61b53d9fb324da995d938412caaed0f3e

SHA512
c99b0333b4e598fd9cad556a2fd60c725ae4c4ae45d53a45a7e051d106e3e24c401fd8686eb707d8357f01d899734889271ea3fda28bb55b7d35dcd338db7fb2

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_af.dll

Filesize
28KB

MD5
fa5578b2efc78389b459ab88b58c9abd

SHA1
980ed1ceab5063849eef96deb26825d66aaec16d

SHA256
79dca4ee4b15d9e599ccd7e12529a8b4d453d51c2b9ecd54d50bb280f0f5be7b

SHA512
a4146ef506737eba5a7c373a51059abe4569d41b7030f75a9fa1228c729fa8465e22f0c2739af2690e9408d76f43c343e4ccdb92e6110505d2655bed5844ab67

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_am.dll

Filesize
24KB

MD5
e59264b8cdedc5590fb6d3abb52569c9

SHA1
2fa3c37ac3c81bbce1d1e2c6b9861b36715eb14f

SHA256
5426cd930a651e304aed15fc8d693dd809f994cb195ca023608317efa7ef69f9

SHA512
3d16943726526929678d7b4d9ab30b291643bf28c93fc010371a68af24f3a169d5da8b3e75413dae8279681092a558eba36ccc6fad177bd9b39a13728d3f3737

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_ar.dll

Filesize
26KB

MD5
bcfb450a64ce92040d69e4fb5930762c

SHA1
944a72d0072ea260e8927e6309de6ae4a4796ff6

SHA256
a09fe2478e1662bcab92b41c8ecbe73d6bdeff386f0789c59236588ae2f887b7

SHA512
210a39a25db954636e8da1ed6b1a9e3608f19ac3b154ec9f274694d3fb8617af69abf7516ea00d62a5b100b5121bd7de32ff5afec7632f697dece7d8a201e5ad

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_as.dll

Filesize
28KB

MD5
ff972d54852866ec3a43f11d7eeebd3e

SHA1
d3aaa7122de308be3fdfe27eaf7e22e0c0a02852

SHA256
b7862bb1d69e0e720db9fc1c498ed30f309dcaba73b304d239c1847441c5fd3d

SHA512
a4141404d4873bbef1a522e63644fdf37c6118a6314624541e367855e7d7bebf4bdf736295857a6e5c28db79ac6f51ff94123fb7119e05a48fbe3ac77505624a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_az.dll

Filesize
29KB

MD5
75188196b6f7149d5ee776b95ff56ee4

SHA1
ad80c3fbb83d67c96fc4c3276747678d78d71359

SHA256
fddd8aba9fee226a935ace41d0f6707f1fae84d88f703bfa50ae9a13cd22610b

SHA512
08ee04a6a95b5b7c2396dc60dad24f2dcd46259a6318a15596581cf86ca66a47cd7a6685c94a746e88ccacf3f5ae051894dd2eaf2d09f04fde94524fcf63d952

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_bg.dll

Filesize
29KB

MD5
1820cfa69f244a787a0af9a4935e94a3

SHA1
65dbdda6e072b7f7b60e5740468be3374d5783a9

SHA256
9fbc74077908ad444da57cabe2f070dfb1c4f902b6917ce539cb2728612324b8

SHA512
c7f3d33c0b0a8b0a68ebf7a2e79936b07ba7fd43bacd67dacc549a5856f7fd0495dd8922d0c12e5bcb774d67267c5ee8bad63ca12012c95311cae42d878b42d0

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_bn-IN.dll

Filesize
29KB

MD5
aba517fc0076e621244645abfdf2d60f

SHA1
3c1226b3fd9ae38967f8f3fc81d5c8014eab8ff3

SHA256
17e4f7edf396f0b4d8f64b46c5530260558ab0637cafba8c93c8e928c2b6de43

SHA512
5e3e48c8a97d10eac726b964716aa3524388474a7271c03657868fe8f1575ff0bde8911b91f6e874011e0c93581bd7a8d0d2920a140fdb47f37bb0d831befe45

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_bn.dll

Filesize
29KB

MD5
933d66b54eaf05bc5aaab7c681da0b36

SHA1
a86effdbcc468df187d74f5b5e9d42d88e3197d1

SHA256
0e472bcc13ccfa83096e11217fefcb0e5aed3fa7ed8f1bfca7f2b7c151691b06

SHA512
628ca72071bd072bab9f81a10c6ba79a3b9d48c60dda1b58d4245d24841ca1288fb253e9212ff2cf721e366ea0aff0a068b08372a0cdf9279b298825ec8d2086

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_bs.dll

Filesize
28KB

MD5
0961601651370bc0ad92ae34c745455e

SHA1
25b29bd74f6c5b5d16fb178cd6a53ea981309457

SHA256
5443ff8250092985e0ea1ab213eebff92bf0a40d908051915ead8d1ae0e97a5d

SHA512
d81053a2bb8ebdcbcc8d55671371a71af68c5d2cc309cb92d79dbd20203285846887da7c59453f38cb721fc164768a0b92bfaf62f78eb264acd37142df5f4e5e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_ca-Es-VALENCIA.dll

Filesize
29KB

MD5
1a1ddb1f95ecca9d13139ad436c3fe48

SHA1
bee6baf32a15188f5d64df3df3bacc12dcc56845

SHA256
515a028bfc6dbd7d1aa1819f1ef70dc6382337318f907656f3768d1c66cdd53b

SHA512
6e1bcb85d15a43757e6f3f75fb78cfedc4a8dd099c334415996cac7ea29f7e1577b8152c709192820d2b78b48b6cab7bf4015f741d4f1a2d845c6ec2376e5c54

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_ca.dll

Filesize
30KB

MD5
140f6d23813e344ab06afe865699c0c0

SHA1
527abdec73c8add2f9baf9d8de5c7d454512710d

SHA256
390c60bbf529ffe7174f6e1f7cde2af1455d618f5eb16f6bc3a48cf2bdf51d27

SHA512
b51988055a11eeff7a07b9b97a5055c0e0b8ce60f5a7aca94adcaa62472f63a9620d4f34eae75a772674eaa9e9461d716ba39989c1d6708e3846b92807f6c4f5

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_cs.dll

Filesize
28KB

MD5
90d8f09d6e68940399ebb1215c521511

SHA1
06d2a1a3a08cc2bf519ba83dbe08e4f240b60a4a

SHA256
2c27a8c3653aae163bebe05f010a5d73aa47f0b58aad14bd1811b2300fe564dc

SHA512
34cf592dbebf2055451b967d27cae5849896b26ef161bfc07aada6cf7757d39ac8b8fc9c003d3770f72aa046c132280be0646f9ae101e0ec36e3b6d95aa6a89d

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_cy.dll

Filesize
28KB

MD5
cd2d40775ef0773519afcaa17509324e

SHA1
0ccc30932a50991937af5a16bd7ef92787eeb57b

SHA256
a20e03e1c56dd2438c85b52e94f54839596e5352ba4b3a406b2daeab5fd24c0d

SHA512
5d8aab4054c17720f9ea9dc28754efd440c06bf22b31c00c9020418a1ddea7bc9f5db285b2916af2e659c33649549a363af281563dff296275c4c8e2a7faf8d3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_da.dll

Filesize
28KB

MD5
dd517584ac41b7c185c1258a13143062

SHA1
60da459099559e30908938b742d6f5c1d0f99a4b

SHA256
904481a7bc079a6734dbce692d756952e7ffecebecb2f743568defc19f9f9e1b

SHA512
f96a73ad75e8d9adc01841a3f7a552c3115ff643d1cba669511e17012f892cb352cd77963044029ff7a7243b941e9f29e53a4ec51ba52977d05af20ab6d44779

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_de.dll

Filesize
30KB

MD5
c4ec05491b1585b7a3aa50375f5e4368

SHA1
cb37296d111b4c6d0456e88b94b482de4582161a

SHA256
a1d616c002ae667321cb3d78958877dfa47bdaa83a43d374d8e3628ec6ae18d5

SHA512
6392f6b349804243965b2ab83e80ee9a80627f9acaf5803aade67ab49c78647e3c8983b38fe7d1f55fefa0c90d2ca3b0cedf3d820c32a700eacd747fc4c72401

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_el.dll

Filesize
30KB

MD5
7ed8de68978a390eeda6b9f4145f8fec

SHA1
d4553ca5efd8801608196c81649dcd045e8beacf

SHA256
6ddf0517c8e51150048ee6ac66d5659559ecd4e6c3343245068ea1b8a3350878

SHA512
61806df41a9f2df86c71880be3e5e338ac35dad2a4964856e42a6d821b3d432b4412daa7a849cbbb3cb05228be777948387d90f6a4ed2276c537656098636e71

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_en-GB.dll

Filesize
27KB

MD5
f0a758482ae88ee848215489129ec7bc

SHA1
d1298f7e6e60f4a2c11a61c137200665aabdb3ad

SHA256
2d76f0bf2669c672d1fa6c46417e65ac9a160a01d11990804ca40d3a3d9dbe76

SHA512
0ec2be7863d2a7f187e831529ab959ffb9c90b4d90d45ad86a9e3522d77af86c12eef4bf9a5cdfadb7957e3e8fd8fd3841f4c301865b823bfaf99e1b55182bfd

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_en.dll

Filesize
27KB

MD5
dde9aacccb335e8a14bc4c0f2ac28eab

SHA1
8dfd19ecafda06c7e760e8fc17cc1dc43b9f3508

SHA256
c701a69236db5927f925a7d2d9845ca22cd59e03e83bfaabe5c4db35d373c056

SHA512
37de0760864b0e25277664ef8d8c4ac0df1f90ec6caa37f6e527be3b6af7a977b58453d26095fdede13ea9383166a9e60e9e0fdb9d8856eb54632a2943c1fada

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU57E4.tmp\msedgeupdateres_es.dll

Filesize
28KB

MD5
4c3382b9bb276730ac626a30904420f6

SHA1
622af5199231a82a88fc70af89474f55af5fc2ed

SHA256
430a568d7d001f4dbd4c3473838146542f06e8b7a0e8a8f41dec5de94feb9f84

SHA512
1248bf0a772a7ad2264dfc3ddc6d0ffd278c83c335c8a4a1468ddee742fb6a0fa033ffd40bdd135c2604ce35c12f882951cdfd6ea728709ed287294e5fc149ec

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
149KB

MD5
ad0146ffcb3aed3a966a68e570d9a7c9

SHA1
d951e80f50383dd37b8eff9e4e68f96e08e34d64

SHA256
8148ef88ac83f7c475fc63de846ff83d16f10c0ad9748173e864af91ac9ff3cf

SHA512
8e17a4279723015e383be78ed11afad35b2f401798acdf8ce582ed79768baa410d685f429e71dd0d93f0f53d1b33d8ba4cf8b5495707b67a84a1799cdf46c062

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\I4W3YYOL\video.rainberrytv[1].xml

Filesize
1KB

MD5
b719fc6c118861af8db4461efed0f569

SHA1
037a8503f2b8a5ea9a5539db836bfa5081fd7d47

SHA256
4c1ad37029c6bf1ee7bd14cb65a784f16a3e711b8d405c4088901b80a9422aec

SHA512
0bd8b361c1697143b98e2ba7da76b1f8a1539acf88045674fa0eedc94bd91194582502418c415388f72bc9f85416164b58c6d7fa92465fe92580833bfcbd8246

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\I4W3YYOL\video.rainberrytv[1].xml

Filesize
2KB

MD5
826703136fee79d6967e527066c6c8de

SHA1
8c7d0e06cfaec01b6adb11e5c0a65a414fd8f600

SHA256
ac48f0df6116b397f9436ac64e27a9b76085d1f835623f26b8283f0c04da9ed6

SHA512
ef3cdac59ea8c1237750baeb6ab57e28b2e06f874b7c24bb03f870f46fd7d09fcc157db5516d46d807eca135029db340e4d11d05b0b21e385ba81a9e94ce948d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\I4W3YYOL\video.rainberrytv[1].xml

Filesize
2KB

MD5
0ca773743f4b91cbb41b2747c44a0583

SHA1
cff53d128eee8479fd8f8726867d00e90c71ac7b

SHA256
0913e20daf9db9c046c47b36e9fe381306c09349c095a8d5af774d1b0ac83612

SHA512
0c0dfa644ff47c48ff057323d00f4a3583027e424fb340d5378ca0dd1c3da39f0a8387c844e8e6c0417b964421945c13c1e6dc48ca020f2ea2dc03f8a55a13b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\I4W3YYOL\video.rainberrytv[1].xml

Filesize
2KB

MD5
b65df90165a60930245247bdf472ce45

SHA1
0b145441d75ff95fb51b41afa61d0c27ce07792d

SHA256
e18cd270c8d16553d968d78ab6569652adf858b9cf9d775d718d4bb9413a721a

SHA512
a5af2f8c501db4fe21c1db23dc055a9d28924c329e1d397d13979c6d4adda2cae825682b7297ccd88894d57fbdcd9895d2fab05229bf10d8441668efa48d0eae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\I4W3YYOL\video.rainberrytv[1].xml

Filesize
2KB

MD5
b65df90165a60930245247bdf472ce45

SHA1
0b145441d75ff95fb51b41afa61d0c27ce07792d

SHA256
e18cd270c8d16553d968d78ab6569652adf858b9cf9d775d718d4bb9413a721a

SHA512
a5af2f8c501db4fe21c1db23dc055a9d28924c329e1d397d13979c6d4adda2cae825682b7297ccd88894d57fbdcd9895d2fab05229bf10d8441668efa48d0eae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\I4W3YYOL\video.rainberrytv[1].xml

Filesize
2KB

MD5
53f2ea091d9a2fa45bc0c03db6f544f9

SHA1
4fd5fb4cf0e0c8c5bed818d926087723fec33e42

SHA256
f5f2f681a0b773f063fe2e0c6f5f7efec0665d27b97b1a742e14753788b40222

SHA512
20963c5d44f3b716410b9e83e6cf9300691d06b00834db826375753740c6705bcd9ec14ec955541ecce35e83676d689966ce024dd6aa1e7912ddb3855ed79e02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\I4W3YYOL\video.rainberrytv[1].xml

Filesize
2KB

MD5
53f2ea091d9a2fa45bc0c03db6f544f9

SHA1
4fd5fb4cf0e0c8c5bed818d926087723fec33e42

SHA256
f5f2f681a0b773f063fe2e0c6f5f7efec0665d27b97b1a742e14753788b40222

SHA512
20963c5d44f3b716410b9e83e6cf9300691d06b00834db826375753740c6705bcd9ec14ec955541ecce35e83676d689966ce024dd6aa1e7912ddb3855ed79e02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\I4W3YYOL\video.rainberrytv[1].xml

Filesize
454B

MD5
92236b8b3f78c3e2e7044944cc33c6ad

SHA1
6fce28d024bd27d2fc263a77daea1252fe831f9e

SHA256
08cb23d87c7dcbf93ba7659441d5e47053bbdc412c09c1e2fb98e02dea555697

SHA512
e55c9f634a0da0c0113732debfcc98104667f3a3ab0b9118ccab7dad6fca335383a5e0642712c69d1015634aaa873d6cc7c76aeb88716e47ebfc2c574f74a5f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\I4W3YYOL\video.rainberrytv[1].xml

Filesize
454B

MD5
31f9fc71ee329294eb7978dc5c7eb954

SHA1
7db1abe25c304c613f25355eeaa76017e8076215

SHA256
2915e5a17ba05b8eb4b44a5bd50ee804e8df9b7774e366a4bc7ed5fb1453b4c5

SHA512
cceb23eecc0474ec7b61b41ec44a05ce3fddebb609a8167234e68b6ce69d1cea7722e5155473da810327ffc5b7e359ed27c560dc6755bb92ed7b0b2bc3d85b74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\I4W3YYOL\video.rainberrytv[1].xml

Filesize
454B

MD5
55322a88341210ae7f73bb7adb49287f

SHA1
76d819fe4d1ef55f9e2605bd79534b59f1ed659d

SHA256
bab71fe47fe0935949f30f5d025a4aebe48a8e8f54aef94157f868a3b41c498c

SHA512
6e31d791d6283a5c3567b6723ee2ad759b40a8b102d33b2c166a2a64fcf9f97a0834bf1fb7d7594ecab444efeab4534b11052621d795a2ccf4a420430192943e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
462f3c1360a4b5e319363930bc4806f6

SHA1
9ba5e43d833c284b89519423f6b6dab5a859a8d0

SHA256
fec64069c72a8d223ed89a816501b3950f5e4f5dd88f289a923c5f961d259f85

SHA512
5584ef75dfb8a1907c071a194fa78f56d10d1555948dffb8afcacaaa2645fd9d842a923437d0e94fad1d1919dcef5b25bf065863405c8d2a28216df27c87a417

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d2642245b1e4572ba7d7cd13a0675bb8

SHA1
96456510884685146d3fa2e19202fd2035d64833

SHA256
3763676934b31fe2e3078256adb25b01fdf899db6616b6b41dff3062b68e20a1

SHA512
99e35f5eefc1e654ecfcf0493ccc02475ca679d3527293f35c3adea66879e21575ab037bec77775915ec42ac53e30416c3928bc3c57910ce02f3addd880392e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
78d031262233b4636ce214d084b1d776

SHA1
4273cad1619f7bd09fd6eaf1e72e41e7c0ea1bc3

SHA256
e7e743f2345874e4b8b46f2879595817b21e84cc245df7069a1ce58ceec92d08

SHA512
0cee08efe2e3c531bdf8482c17dd8f263e8d6231edac520a474fcfe0cffe353ed74c02509e4a56ebb2dc1a328a5dbe4f65866bd0a965208e862057551ab0de71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe578fbd.TMP

Filesize
48B

MD5
51110cd81fa8e6566cb123f1737de980

SHA1
15b92a60b8d462f5fdb42a29c3a76443ec8a2307

SHA256
fdf1ba7c3fa1d31823bda32d2b7de9ee5fecce6f11022736da4710088304293c

SHA512
69e99d156e6cf492d946d6fe6b76a3ff7487b3bc33b553eaffe1a06c559227ee925da8d874125d952fee3eb0c170723ea64330118f67d574561cd3dfbbe22745

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
e4fe4f6453bb92100c6cee2fb47e57cd

SHA1
3ea91e8c9e9c76f3eedf789b8dbe8f9bae98a35b

SHA256
3bf1b096d56a7f111547e60f8e5aa1f8d3c4f16e5e309c0d8ce479f88c131efb

SHA512
a88c3ee91d28a9c3d9662eefc83bfb9c86211c17b89bd6ee39ab716af04a03a34a0b6c3fc03050a2a9e6e79474204f7f05d308dc127730cdbd7b146dcabec3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
06c7a2525168cf8ffbbc71c1866041ab

SHA1
11240b1350fb6be816b437ba2d6c12bd5ae3fe43

SHA256
8976969ff42f8a119cbac001d37dba273ba03e84077bc412046057b1c05cf1f7

SHA512
4808f521a15ea6ea08588022bf660ede824e6ec5b94e060da9d7a350e20b7a3eb853cc97669f5de071d77908a0d4ce2b62d746580c6aca0da583165f89c6c34d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a78964b6430bba55aea4731a1f1de960

SHA1
3c53fbc041c09dc538204b688da2ebdcd6c3489c

SHA256
7a7553b8539ed8cb012216544f8899465d32b40673d9794f33ddd7f6b7afac31

SHA512
ae02e7b34cd7358d1e18f16ee7e62eff8889fd30608a42fb8f6996fe874e4603e5e07a55941dd6c8dd36a1e4420129e981ac8d8e4ef1125d09ac294b850232af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2d682820a14e9fddfc0dedd1ef472c43

SHA1
f43b84337fa835233e835075fbcca99132e90ae0

SHA256
1e71e0e165b2fc95165a1b3f1d0124c3625875ab1c77758cc5c025a55fe0a4f6

SHA512
c0bd2d8e969f54f7579c8d1a4f681c50223aa6dee4e65a0e7d32847676f91610d860e6d844e88ed923551283d3284e0dbaed8b357f4ed0070b51ec5053a89355

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
130644a5f79b27202a13879460f2c31a

SHA1
29e213847a017531e849139c7449bce6b39cb2fa

SHA256
1306a93179e1eaf354d9daa6043ae8ffb37b76a1d1396e7b8df671485582bcd1

SHA512
fbc8606bf988cf0a6dea28c16d4394c9b1e47f6b68256132b5c85caf1ec7b516c0e3d33034db275adf267d5a84af2854f50bd38a9ed5e86eb392144c63252e01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
920b2b930e84d05d8e6bd84c54e267b8

SHA1
8ce4ff1876953f3b740f22f80a742b2f9589cbef

SHA256
16cb60e9c4e6679d08e9b35b4932e64e63255491f39f57375fea8d11e4d4a537

SHA512
db5c2e3c36c767084f339819489185428ef739cbbc9104699f4438621a0a3c441dc209d9d8d6adf848b48b637d2d790ca46792c009ce5c99c4ac406e9aeb66c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Low\IE\S88SFQ2H\minified[1].js

Filesize
164KB

MD5
d688e107942685903e200e625e2cfa59

SHA1
56135b7e1ebb74e467268c105b4dc675a337e5f0

SHA256
4ceaa006ce87c5cb4149baa955e65ea1d5267457db45eb9bf4e22f726b4e910f

SHA512
884aaeda3af3423ceeeb32cee6d10fe2ff469570063d740c178d08c76f40228b354cdaaefff357b6a4cedc0769338b4db7ad6e8453ef719d7bc058de5744127f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Low\IE\SPCKSXD7\smart[1].htm

Filesize
12KB

MD5
df8e0f07c63a022b1925ca383bfd0625

SHA1
f98051694ad3d0b124e0ee13e6a23c8728f8a58d

SHA256
fa12adb52e6c2a345aa2a99bc72e6ca22aaba7dd738f27ebc2da8d4d0a459b06

SHA512
6e926f365fd9e897439410372d8edf0ade0ddca99ecd1fe0e306c96fe429542bbc61598332a8b0b8eb280714b26475f627abc5256f920c4e554597c42e36862c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Low\IE\SPCKSXD7\utclassic-content[2].htm

Filesize
3KB

MD5
90e93def6a7893eb4197d2daed5223df

SHA1
e595402777e382e8b047866bf75e33d743232273

SHA256
012f1466a2ab239ff02fb56f4b3c2973641e247bf182c49d0f52c66ce849e770

SHA512
02136c4c61c8188785aa4ddf7dcfe22ae9a810f1ad7873ef9aaa69953917769f70ecb9838145b4c3903c5bf07d3e425cb77b9c992b7d516d02cb2dc0300c5ee1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Low\IE\UJ0OTRU5\loader[1].js

Filesize
6KB

MD5
5c89ae83bd68e42a71f4d636f519ae71

SHA1
6ff2dd7c2c1c2913ff9a817e78daacf7e0f94621

SHA256
bcb8e4cb1e062a712bc6355654775f361fe8c915dab0e4654ee37d49b4e41606

SHA512
12864dc0bfc0982a73042af9e7311b55a918e807c6b51e068ce08e2003c85f960d65077a6a084a7a9cacb1a9ee6528b6e5f3f29847b672142a05246f52cf97af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Low\IE\UJ0OTRU5\smartUtil[1].js

Filesize
18KB

MD5
c4964c648fdc9429346e385f60849709

SHA1
4daf6c13f362b859d119eeeaca0b95c5cf5564f4

SHA256
0d512e0b353c0bafc915014dd1157e9d60b308c1f0f3d1447353789432fe64da

SHA512
01f65c6f4db6b4fa5df03991a365000eaca5b77fc1fb15eb0ddfa1f81f3944a4734d6a3f8db5793cc1fcd619359bbb04f79901fa91cbb59b2060788e2d406bdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Low\IE\UJ0OTRU5\yaml.min[1].js

Filesize
42KB

MD5
ac9cc2b3e4e8abab70f374326b12113f

SHA1
7a3667ebb746b67111d41c2071b40568b2e87faa

SHA256
f4f5c0691db49e2f3b5fe39e9e71b99b8e675feffa1449c6928f5e9abb8576b7

SHA512
0a136ee598e02c9070231540754b0be9d919479deb4e19f9e00b8994b6148217f2428448114b87c60d12c8da85ccedc1988d02568eea0416b1d2b50d57da8557

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-A6RB0.tmp\utorrent_installer.tmp

Filesize
3.0MB

MD5
bee3a3ae058047dbe5d147b30d11c331

SHA1
3eba7c30a4bded07d58cf057781a4348a8313942

SHA256
1ff0cefbfe0905f845ef0e0f2f2b20d5f131ae126ba4acfbd368a6be879dd5c7

SHA512
b8128e25e45419a3fbef7874335ad25d959a7eb491545c819fcd7d48357e26b4df78452dbda7295a27c68dd7f1dd4c72b90b4ffa817be84535426f3fca37ba3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-M0DVF.tmp\Logo.png

Filesize
7KB

MD5
5424804c80db74e1304535141a5392c6

SHA1
6d749f3b59672b0c243690811ec3240ff2eced8e

SHA256
9b7e2ea77e518b50e5dd78e0faec509e791949a7c7f360a967c9ee204a8f1412

SHA512
6c7364b9693ce9cbbdbca60ecef3911dfe3d2d836252d7650d34506d2aa41fc5892028ba93f2619caf7edb06576fddae7e5f91f5844b5c3a47f54ca39f84cc6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-M0DVF.tmp\botva2.dll

Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-M0DVF.tmp\botva2.dll

Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-M0DVF.tmp\uTorrent.exe

Filesize
16.0MB

MD5
db5a4011b86ce680fc16120b8b2fdaba

SHA1
242a0c539ec1f3bf7755be69386a6213af61d580

SHA256
70d8024dbe50a74714ac6a2e316e0c3f58fe7db94c2ac2e6ccd513759e4bd386

SHA512
1502bca6ca1f87e466c58f8e8449712a81d3151919e208e9a25907929b7594e92f0268436ef80f395fe7b36a7d132d6f891b65081889be09eca287896bee62f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-M0DVF.tmp\uTorrent.exe

Filesize
16.0MB

MD5
db5a4011b86ce680fc16120b8b2fdaba

SHA1
242a0c539ec1f3bf7755be69386a6213af61d580

SHA256
70d8024dbe50a74714ac6a2e316e0c3f58fe7db94c2ac2e6ccd513759e4bd386

SHA512
1502bca6ca1f87e466c58f8e8449712a81d3151919e208e9a25907929b7594e92f0268436ef80f395fe7b36a7d132d6f891b65081889be09eca287896bee62f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-M0DVF.tmp\uTorrent.exe

Filesize
16.0MB

MD5
db5a4011b86ce680fc16120b8b2fdaba

SHA1
242a0c539ec1f3bf7755be69386a6213af61d580

SHA256
70d8024dbe50a74714ac6a2e316e0c3f58fe7db94c2ac2e6ccd513759e4bd386

SHA512
1502bca6ca1f87e466c58f8e8449712a81d3151919e208e9a25907929b7594e92f0268436ef80f395fe7b36a7d132d6f891b65081889be09eca287896bee62f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nswBF7.tmp\FindProcDLL.dll

Filesize
3KB

MD5
b4faf654de4284a89eaf7d073e4e1e63

SHA1
8efcfd1ca648e942cbffd27af429784b7fcf514b

SHA256
c0948b2ec36a69f82c08935fac4b212238b6792694f009b93b4bdb478c4f26e3

SHA512
eef31e332be859cf2a64c928bf3b96442f36fe51f1a372c5628264a0d4b2fc7b3e670323c8fb5ffa72db995b8924da2555198e7de7b4f549d9e0f9e6dbb6b388

Download Submit
C:\Users\Admin\AppData\Local\Temp\nswBF7.tmp\INetC.dll

Filesize
24KB

MD5
640bff73a5f8e37b202d911e4749b2e9

SHA1
9588dd7561ab7de3bca392b084bec91f3521c879

SHA256
c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502

SHA512
39c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nswBF7.tmp\INetC.dll

Filesize
24KB

MD5
640bff73a5f8e37b202d911e4749b2e9

SHA1
9588dd7561ab7de3bca392b084bec91f3521c879

SHA256
c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502

SHA512
39c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nswBF7.tmp\INetC.dll

Filesize
24KB

MD5
640bff73a5f8e37b202d911e4749b2e9

SHA1
9588dd7561ab7de3bca392b084bec91f3521c879

SHA256
c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502

SHA512
39c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nswBF7.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
C:\Users\Admin\AppData\Local\Temp\nswBF7.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
C:\Users\Admin\AppData\Local\Temp\nswBF7.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
C:\Users\Admin\AppData\Local\Temp\nswBF7.tmp\nsisFirewall.dll

Filesize
8KB

MD5
f5bf81a102de52a4add21b8a367e54e0

SHA1
cf1e76ffe4a3ecd4dad453112afd33624f16751c

SHA256
53be5716ad80945cb99681d5dbda60492f5dfb206fbfdb776b769b3eeb18d2c2

SHA512
6e280a75f706474ad31b2ce770fa34f54cb598528fac4477c466200a608b79c0f9b84011545595d9ba94331ad08e2f51bd42de91f92379db27686a28ba351256

Download Submit
C:\Users\Admin\AppData\Local\Temp\utorrent\datachannel.dll

Filesize
1.3MB

MD5
a66e57bc9944aa9a77637cf128a6cdd9

SHA1
43825d7240f4ad8173eda05ef2482ce8db231e9f

SHA256
9aebb962e38cfd5197cdaefc6d4b057792d5775a1428d20f505671c162ba7265

SHA512
2a93371ccf4a0a6922618fc28ba1cec652688c89159e75e55c219dad3a8be1bebf5016ca1c6a40f418207f5b854832850ea34bc9239092207df8e3063c5fee7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\utorrent\datachannel.dll

Filesize
1.3MB

MD5
a66e57bc9944aa9a77637cf128a6cdd9

SHA1
43825d7240f4ad8173eda05ef2482ce8db231e9f

SHA256
9aebb962e38cfd5197cdaefc6d4b057792d5775a1428d20f505671c162ba7265

SHA512
2a93371ccf4a0a6922618fc28ba1cec652688c89159e75e55c219dad3a8be1bebf5016ca1c6a40f418207f5b854832850ea34bc9239092207df8e3063c5fee7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\utorrent\libcrypto-3.dll

Filesize
3.6MB

MD5
a6ad50c212af59dd55540c0f2d0aa726

SHA1
790987aba7e05bf7ef3112ea3c281b89f95bc9ed

SHA256
fe0d5ae8d42c622fcbff51ba0f5f33a1e46413f98993e7d216f7b463887f399c

SHA512
2b253ffe0edd35bb0fe822c81daeb206509b01c28a05d2d8f82273ce7f702adfcc5481c00ea0c2fc96db6a891a370ded7aec6c41f4f5e7313c3f8172481b865c

Download Submit
C:\Users\Admin\AppData\Local\Temp\utorrent\libcrypto-3.dll

Filesize
3.6MB

MD5
a6ad50c212af59dd55540c0f2d0aa726

SHA1
790987aba7e05bf7ef3112ea3c281b89f95bc9ed

SHA256
fe0d5ae8d42c622fcbff51ba0f5f33a1e46413f98993e7d216f7b463887f399c

SHA512
2b253ffe0edd35bb0fe822c81daeb206509b01c28a05d2d8f82273ce7f702adfcc5481c00ea0c2fc96db6a891a370ded7aec6c41f4f5e7313c3f8172481b865c

Download Submit
C:\Users\Admin\AppData\Local\Temp\utorrent\libcrypto-3.dll

Filesize
3.6MB

MD5
a6ad50c212af59dd55540c0f2d0aa726

SHA1
790987aba7e05bf7ef3112ea3c281b89f95bc9ed

SHA256
fe0d5ae8d42c622fcbff51ba0f5f33a1e46413f98993e7d216f7b463887f399c

SHA512
2b253ffe0edd35bb0fe822c81daeb206509b01c28a05d2d8f82273ce7f702adfcc5481c00ea0c2fc96db6a891a370ded7aec6c41f4f5e7313c3f8172481b865c

Download Submit
C:\Users\Admin\AppData\Local\Temp\utorrent\libssl-3.dll

Filesize
605KB

MD5
f0a84546ec2e90432b4640602b955dc0

SHA1
51deb3ad7d178c043084160a58fe4a3b9ae0bb97

SHA256
e036ede168df29fe641519dee38f62048f5992adeb3aafc65fd353db52280326

SHA512
d292ffe34893d16a93a282a1fefb3298e3cd605e54784bcd37c70d4e9b66d40b33a292337dcd741bab6425158d18f800fd5d942120d770cecbb022ccf4601ae2

Download Submit
C:\Users\Admin\AppData\Local\Temp\utorrent\libssl-3.dll

Filesize
605KB

MD5
f0a84546ec2e90432b4640602b955dc0

SHA1
51deb3ad7d178c043084160a58fe4a3b9ae0bb97

SHA256
e036ede168df29fe641519dee38f62048f5992adeb3aafc65fd353db52280326

SHA512
d292ffe34893d16a93a282a1fefb3298e3cd605e54784bcd37c70d4e9b66d40b33a292337dcd741bab6425158d18f800fd5d942120d770cecbb022ccf4601ae2

Download Submit
C:\Users\Admin\AppData\Local\Temp\utorrent\utorrent.exe

Filesize
2.6MB

MD5
dabe3bd054cd2268b23a42a49acd2ac9

SHA1
0ed81ad1371eb5651e79b0e4c3fb95a45093d25a

SHA256
cd7681bc3495a1746a84c0b2e4dece79c9e4ae478be859ff4771795a9a765063

SHA512
1eb2cad9acabd1867c35c68aabd67f5bd5fb6ff57d77673de84da7ad72433919f1862a8d1b2345b1e7e1563d49c583b1ae3096078c815fb5fb469573ddf5d83e

Download Submit
C:\Users\Admin\AppData\Local\Temp\utorrent\utorrent.exe

Filesize
2.6MB

MD5
dabe3bd054cd2268b23a42a49acd2ac9

SHA1
0ed81ad1371eb5651e79b0e4c3fb95a45093d25a

SHA256
cd7681bc3495a1746a84c0b2e4dece79c9e4ae478be859ff4771795a9a765063

SHA512
1eb2cad9acabd1867c35c68aabd67f5bd5fb6ff57d77673de84da7ad72433919f1862a8d1b2345b1e7e1563d49c583b1ae3096078c815fb5fb469573ddf5d83e

Download Submit
C:\Users\Admin\AppData\Local\Temp\utorrent\utorrent.exe

Filesize
2.6MB

MD5
dabe3bd054cd2268b23a42a49acd2ac9

SHA1
0ed81ad1371eb5651e79b0e4c3fb95a45093d25a

SHA256
cd7681bc3495a1746a84c0b2e4dece79c9e4ae478be859ff4771795a9a765063

SHA512
1eb2cad9acabd1867c35c68aabd67f5bd5fb6ff57d77673de84da7ad72433919f1862a8d1b2345b1e7e1563d49c583b1ae3096078c815fb5fb469573ddf5d83e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-144354903-2550862337-1367551827-1000\1f91d2d17ea675d4c2c3192e241743f9_76cff8be-8f86-4613-9a47-5d5870acb67c

Filesize
1KB

MD5
36de2f945068fefe010a10eaff66deb2

SHA1
e7d4a2b4fa05b742a738af8803b8925d1c66cfb2

SHA256
ae6db53fcc8b85b2b4c4d205b367cea8b00f824d968e18ec1cf16cbb33bc8a60

SHA512
c6e1ef0d424368c1c18d8449f9aab3c8aac48e6545f80272c7246a2ac5c892b0e7c72e2e7eb70a6c23d8c87b43d4a3e72d0cda5c2b562031fecb4c1c0684f331

Download Submit
C:\Users\Admin\AppData\Roaming\uTorrent\MicrosoftEdgeWebView2Setup.exe

Filesize
1.5MB

MD5
b32d72daeee036e2b8f1c57e4a40e87a

SHA1
564caa330d077a3d26691338b3e38ee4879a929d

SHA256
65f6efdf6df4095971a95f4bf387590ae63109388344632a22458265ab7dd289

SHA512
b5d62ce1462d786c01d38e13d030ad6236ce63321819cf860cc6169f50f6309e627bc7709b305422851779e37dbae9fb358008aad8d6c124cd33cdec730288d5

Download Submit
C:\Users\Admin\AppData\Roaming\uTorrent\datachannel.dll

Filesize
1.3MB

MD5
a66e57bc9944aa9a77637cf128a6cdd9

SHA1
43825d7240f4ad8173eda05ef2482ce8db231e9f

SHA256
9aebb962e38cfd5197cdaefc6d4b057792d5775a1428d20f505671c162ba7265

SHA512
2a93371ccf4a0a6922618fc28ba1cec652688c89159e75e55c219dad3a8be1bebf5016ca1c6a40f418207f5b854832850ea34bc9239092207df8e3063c5fee7d

Download Submit
C:\Users\Admin\AppData\Roaming\uTorrent\libcrypto-3.dll

Filesize
3.6MB

MD5
a6ad50c212af59dd55540c0f2d0aa726

SHA1
790987aba7e05bf7ef3112ea3c281b89f95bc9ed

SHA256
fe0d5ae8d42c622fcbff51ba0f5f33a1e46413f98993e7d216f7b463887f399c

SHA512
2b253ffe0edd35bb0fe822c81daeb206509b01c28a05d2d8f82273ce7f702adfcc5481c00ea0c2fc96db6a891a370ded7aec6c41f4f5e7313c3f8172481b865c

Download Submit
C:\Users\Admin\AppData\Roaming\uTorrent\libssl-3.dll

Filesize
605KB

MD5
f0a84546ec2e90432b4640602b955dc0

SHA1
51deb3ad7d178c043084160a58fe4a3b9ae0bb97

SHA256
e036ede168df29fe641519dee38f62048f5992adeb3aafc65fd353db52280326

SHA512
d292ffe34893d16a93a282a1fefb3298e3cd605e54784bcd37c70d4e9b66d40b33a292337dcd741bab6425158d18f800fd5d942120d770cecbb022ccf4601ae2

Download Submit
C:\Users\Admin\AppData\Roaming\uTorrent\settings.dat

Filesize
8KB

MD5
36d08c6e5731df4f2dfefdda75d93eb5

SHA1
1330f619f8e837af3ccfb88d18cf77107baea33c

SHA256
ca721926d61f12e786f0124a9d1953eac3606073b77b25c080b7f7cbc886860f

SHA512
a8bc2c33cad4488aff5d8dc6dc7b3cd9e7f215807ca42b27b2ee633ce94407d3b1ac1461e53943fd8ae19bdc16e91e0fe51456ba63dfac5fc4906d3e2bbe421d

Download Submit
C:\Users\Admin\AppData\Roaming\uTorrent\uTorrent.exe

Filesize
2.6MB

MD5
dabe3bd054cd2268b23a42a49acd2ac9

SHA1
0ed81ad1371eb5651e79b0e4c3fb95a45093d25a

SHA256
cd7681bc3495a1746a84c0b2e4dece79c9e4ae478be859ff4771795a9a765063

SHA512
1eb2cad9acabd1867c35c68aabd67f5bd5fb6ff57d77673de84da7ad72433919f1862a8d1b2345b1e7e1563d49c583b1ae3096078c815fb5fb469573ddf5d83e

Download Submit
C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_46716\utorrentie.exe

Filesize
407KB

MD5
ac3aa3016d9b5759376edbb332dc8954

SHA1
b1d03fd9d82bf8ecfb5d63de7a6f1c4db5d7f88e

SHA256
db9cec3aab02ae12bd2346f5f25c2c34d32ae6a3eac75208a310f009eb1ea110

SHA512
9899b45b6fc584a77294b62b86d89b82326b3e73f84001f3387042911434399597c722a10eab44f091d947c1d61820737e0d1405f5ed5d77ad7ddc3821a41b27

Download Submit
C:\Users\Admin\AppData\Roaming\utorrent\MicrosoftEdgeWebView2Setup.exe

Filesize
1.5MB

MD5
b32d72daeee036e2b8f1c57e4a40e87a

SHA1
564caa330d077a3d26691338b3e38ee4879a929d

SHA256
65f6efdf6df4095971a95f4bf387590ae63109388344632a22458265ab7dd289

SHA512
b5d62ce1462d786c01d38e13d030ad6236ce63321819cf860cc6169f50f6309e627bc7709b305422851779e37dbae9fb358008aad8d6c124cd33cdec730288d5

Download Submit
C:\Users\Admin\AppData\Roaming\utorrent\datachannel.dll

Filesize
1.3MB

MD5
a66e57bc9944aa9a77637cf128a6cdd9

SHA1
43825d7240f4ad8173eda05ef2482ce8db231e9f

SHA256
9aebb962e38cfd5197cdaefc6d4b057792d5775a1428d20f505671c162ba7265

SHA512
2a93371ccf4a0a6922618fc28ba1cec652688c89159e75e55c219dad3a8be1bebf5016ca1c6a40f418207f5b854832850ea34bc9239092207df8e3063c5fee7d

Download Submit
C:\Users\Admin\AppData\Roaming\utorrent\libcrypto-3.dll

Filesize
3.6MB

MD5
a6ad50c212af59dd55540c0f2d0aa726

SHA1
790987aba7e05bf7ef3112ea3c281b89f95bc9ed

SHA256
fe0d5ae8d42c622fcbff51ba0f5f33a1e46413f98993e7d216f7b463887f399c

SHA512
2b253ffe0edd35bb0fe822c81daeb206509b01c28a05d2d8f82273ce7f702adfcc5481c00ea0c2fc96db6a891a370ded7aec6c41f4f5e7313c3f8172481b865c

Download Submit
C:\Users\Admin\AppData\Roaming\utorrent\libssl-3.dll

Filesize
605KB

MD5
f0a84546ec2e90432b4640602b955dc0

SHA1
51deb3ad7d178c043084160a58fe4a3b9ae0bb97

SHA256
e036ede168df29fe641519dee38f62048f5992adeb3aafc65fd353db52280326

SHA512
d292ffe34893d16a93a282a1fefb3298e3cd605e54784bcd37c70d4e9b66d40b33a292337dcd741bab6425158d18f800fd5d942120d770cecbb022ccf4601ae2

Download Submit
C:\Users\Admin\AppData\Roaming\utorrent\uTorrent.exe

Filesize
2.6MB

MD5
dabe3bd054cd2268b23a42a49acd2ac9

SHA1
0ed81ad1371eb5651e79b0e4c3fb95a45093d25a

SHA256
cd7681bc3495a1746a84c0b2e4dece79c9e4ae478be859ff4771795a9a765063

SHA512
1eb2cad9acabd1867c35c68aabd67f5bd5fb6ff57d77673de84da7ad72433919f1862a8d1b2345b1e7e1563d49c583b1ae3096078c815fb5fb469573ddf5d83e

Download Submit
C:\Users\Admin\AppData\Roaming\utorrent\updates\3.6.0_46716\utorrentie.exe

Filesize
407KB

MD5
ac3aa3016d9b5759376edbb332dc8954

SHA1
b1d03fd9d82bf8ecfb5d63de7a6f1c4db5d7f88e

SHA256
db9cec3aab02ae12bd2346f5f25c2c34d32ae6a3eac75208a310f009eb1ea110

SHA512
9899b45b6fc584a77294b62b86d89b82326b3e73f84001f3387042911434399597c722a10eab44f091d947c1d61820737e0d1405f5ed5d77ad7ddc3821a41b27

Download Submit
C:\Users\Admin\AppData\Roaming\utorrent\updates\3.6.0_46716\utorrentie.exe

Filesize
407KB

MD5
ac3aa3016d9b5759376edbb332dc8954

SHA1
b1d03fd9d82bf8ecfb5d63de7a6f1c4db5d7f88e

SHA256
db9cec3aab02ae12bd2346f5f25c2c34d32ae6a3eac75208a310f009eb1ea110

SHA512
9899b45b6fc584a77294b62b86d89b82326b3e73f84001f3387042911434399597c722a10eab44f091d947c1d61820737e0d1405f5ed5d77ad7ddc3821a41b27

Download Submit
C:\Users\Admin\AppData\Roaming\utorrent\updates\3.6.0_46716\utorrentie.exe

Filesize
407KB

MD5
ac3aa3016d9b5759376edbb332dc8954

SHA1
b1d03fd9d82bf8ecfb5d63de7a6f1c4db5d7f88e

SHA256
db9cec3aab02ae12bd2346f5f25c2c34d32ae6a3eac75208a310f009eb1ea110

SHA512
9899b45b6fc584a77294b62b86d89b82326b3e73f84001f3387042911434399597c722a10eab44f091d947c1d61820737e0d1405f5ed5d77ad7ddc3821a41b27

Download Submit
memory/1412-455-0x00007FFC6B390000-0x00007FFC6B391000-memory.dmp

Filesize
4KB

Download
memory/1568-921-0x00000000083F0000-0x00000000084F0000-memory.dmp

Filesize
1024KB

Download
memory/1668-267-0x0000000000400000-0x000000000070E000-memory.dmp

Filesize
3.1MB

Download
memory/1668-157-0x0000000000D00000-0x0000000000D01000-memory.dmp

Filesize
4KB

Download
memory/1668-156-0x00000000038D0000-0x00000000038DF000-memory.dmp

Filesize
60KB

Download
memory/1668-155-0x0000000000400000-0x000000000070E000-memory.dmp

Filesize
3.1MB

Download
memory/1668-148-0x00000000038D0000-0x00000000038DF000-memory.dmp

Filesize
60KB

Download
memory/1668-173-0x0000000000400000-0x000000000070E000-memory.dmp

Filesize
3.1MB

Download
memory/1668-141-0x0000000000D00000-0x0000000000D01000-memory.dmp

Filesize
4KB

Download
memory/2632-238-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2632-213-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/3936-154-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/3936-133-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/3936-269-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/5028-929-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/5028-609-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/5028-266-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/5028-519-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download