Overview

overview

8

Static

static

1

utorrent_i...er.exe

windows11-21h2-x64

8

utorrent_i...er.exe

macos-10.15-amd64

1

utorrent_i...er.exe

debian-9-mips

utorrent_i...er.exe

debian-12-armhf

utorrent_i...er.exe

ubuntu-24.04-amd64

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240508-en
  • resource tags

    arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    02/06/2024, 22:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    utorrent_installer.exe
  • Size 1.7MB
  • Sample240602-2bvfdsac66
  • SHA256 bdb05a92a4c80a2d3e186b8667c0b2f69dedd79a65160e5d8279cf50327f8c0e
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
discoveryevasionpersistencespywarestealerupx

Malware Config

Signatures

  • Drops file in Drivers directory 4 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks for any installed AV software in registry 1 TTPs 6 IoCs
  • Downloads MZ/PE file
  • Drops file in System32 directory 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 20 IoCs
  • Loads dropped DLL 21 IoCs
  • Registers COM server for autorun 1 TTPs 6 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 42 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 19 IoCs
    evasionspywaretrojan
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of FindShellTrayWindow 32 IoCs
  • Suspicious use of SendNotifyMessage 15 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\utorrent_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\utorrent_installer.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1456
    • C:\Users\Admin\AppData\Local\Temp\is-7KVAA.tmp\utorrent_installer.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-7KVAA.tmp\utorrent_installer.tmp" /SL5="$8005E,840718,816128,C:\Users\Admin\AppData\Local\Temp\utorrent_installer.exe"
      2⤵
      • Checks for any installed AV software in registry
      • Executes dropped EXE
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3412
      • C:\Users\Admin\AppData\Local\Temp\is-I3Q2C.tmp\uTorrent.exe
        "C:\Users\Admin\AppData\Local\Temp\is-I3Q2C.tmp\uTorrent.exe" /S /FORCEINSTALL 1110010101111110
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:3324
        • C:\Users\Admin\AppData\Local\Temp\nsq7A2D.tmp\utorrent.exe
          "C:\Users\Admin\AppData\Local\Temp\nsq7A2D.tmp\utorrent.exe" /S /FORCEINSTALL 1110010101111110
          4⤵
          • Identifies Wine through registry keys
          • Adds Run key to start application
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          PID:1488
      • C:\Users\Admin\AppData\Local\Temp\is-I3Q2C.tmp\component0.exe
        "C:\Users\Admin\AppData\Local\Temp\is-I3Q2C.tmp\component0.exe" -ip:"dui=15439030-dbba-449d-b460-326ebc585651&dit=20240602222521&is_silent=true&oc=ZB_RAV_Cross_Tri_NCB&p=707e&a=100&b=&se=true" -vp:"dui=15439030-dbba-449d-b460-326ebc585651&dit=20240602222521&oc=ZB_RAV_Cross_Tri_NCB&p=707e&a=100&oip=26&ptl=7&dta=true" -dp:"dui=15439030-dbba-449d-b460-326ebc585651&dit=20240602222521&oc=ZB_RAV_Cross_Tri_NCB&p=707e&a=100" -i -v -d -se=true
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4060
        • C:\Users\Admin\AppData\Local\Temp\bm4cu5aw.exe
          "C:\Users\Admin\AppData\Local\Temp\bm4cu5aw.exe" /silent
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:4940
          • C:\Users\Admin\AppData\Local\Temp\nsq920C.tmp\RAVEndPointProtection-installer.exe
            "C:\Users\Admin\AppData\Local\Temp\nsq920C.tmp\RAVEndPointProtection-installer.exe" "C:\Users\Admin\AppData\Local\Temp\bm4cu5aw.exe" /silent
            5⤵
            • Drops file in Drivers directory
            • Drops file in Program Files directory
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4752
            • C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe
              "C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -i -bn:ReasonLabs -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -dt:10
              6⤵
              • Executes dropped EXE
              PID:1372
            • C:\Windows\system32\rundll32.exe
              "C:\Windows\system32\rundll32.exe" setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Program Files\ReasonLabs\EPP\x64\rsKernelEngine.inf
              6⤵
              • Adds Run key to start application
              PID:7448
              • C:\Windows\system32\runonce.exe
                "C:\Windows\system32\runonce.exe" -r
                7⤵
                • Checks processor information in registry
                PID:7684
                • C:\Windows\System32\grpconv.exe
                  "C:\Windows\System32\grpconv.exe" -o
                  8⤵
                    PID:8132
              • C:\Windows\system32\wevtutil.exe
                "C:\Windows\system32\wevtutil.exe" im C:\Program Files\ReasonLabs\EPP\x64\rsKernelEngineEvents.xml
                6⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:7604
              • C:\Windows\SYSTEM32\fltmc.exe
                "fltmc.exe" load rsKernelEngine
                6⤵
                • Suspicious behavior: LoadsDriver
                • Suspicious use of AdjustPrivilegeToken
                PID:7904
              • C:\Windows\system32\wevtutil.exe
                "C:\Windows\system32\wevtutil.exe" im C:\Program Files\ReasonLabs\EPP\elam\evntdrv.xml
                6⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:7624
              • C:\Program Files\ReasonLabs\EPP\rsWSC.exe
                "C:\Program Files\ReasonLabs\EPP\rsWSC.exe" -i -i
                6⤵
                • Drops file in Program Files directory
                • Executes dropped EXE
                • Modifies system certificate store
                • Suspicious use of AdjustPrivilegeToken
                PID:8268
        • C:\Users\Admin\AppData\Local\Temp\is-I3Q2C.tmp\component1_extract\saBSI.exe
          "C:\Users\Admin\AppData\Local\Temp\is-I3Q2C.tmp\component1_extract\saBSI.exe" /affid 91082 PaidDistribution=true CountryCode=GB
          3⤵
          • Executes dropped EXE
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3516
          • C:\Users\Admin\AppData\Local\Temp\is-I3Q2C.tmp\component1_extract\installer.exe
            "C:\Users\Admin\AppData\Local\Temp\is-I3Q2C.tmp\component1_extract\\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade
            4⤵
            • Drops file in Program Files directory
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2892
            • C:\Program Files\McAfee\Temp2898022111\installer.exe
              "C:\Program Files\McAfee\Temp2898022111\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade
              5⤵
              • Drops file in Program Files directory
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:548
              • C:\Windows\SYSTEM32\regsvr32.exe
                regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll"
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:5028
                • C:\Windows\SysWOW64\regsvr32.exe
                  /s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll"
                  7⤵
                  • Loads dropped DLL
                  • Modifies registry class
                  PID:5304
              • C:\Windows\SYSTEM32\regsvr32.exe
                regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\x64\WSSDep.dll"
                6⤵
                • Loads dropped DLL
                • Registers COM server for autorun
                • Modifies registry class
                PID:5212
              • C:\Windows\SYSTEM32\regsvr32.exe
                regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\DownloadScan.dll"
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:900
                • C:\Windows\SysWOW64\regsvr32.exe
                  /s "C:\Program Files\McAfee\WebAdvisor\win32\DownloadScan.dll"
                  7⤵
                  • Loads dropped DLL
                  • Modifies registry class
                  PID:4852
              • C:\Windows\SYSTEM32\regsvr32.exe
                regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\x64\DownloadScan.dll"
                6⤵
                • Loads dropped DLL
                • Registers COM server for autorun
                • Modifies registry class
                PID:5340
        • C:\Users\Admin\AppData\Roaming\uTorrent\uTorrent.exe
          "C:\Users\Admin\AppData\Roaming\uTorrent\uTorrent.exe"
          3⤵
          • Identifies Wine through registry keys
          • Adds Run key to start application
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks SCSI registry key(s)
          • Modifies Internet Explorer settings
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:3660
          • C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_47084\utorrentie.exe
            "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_47084\utorrentie.exe" uTorrent_3660_03CC1FF8_554077126 µTorrent4823DF041B09 uTorrent ce unp
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:5244
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=utorrentie.exe --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --no-default-browser-check --disable-component-extensions-with-background-pages --no-first-run --disable-default-apps --noerrdialogs --embedded-browser-webview-dpi-awareness=0 --disable-features=msEnhancedTrackingPreventionEnabled --disable-popup-blocking --internet-explorer-integration=none --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --mojo-named-platform-channel-pipe=5244.5588.8833904727231263341
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:5604
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Crashpad --metrics-dir=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=90.0.818.66 --initial-client-data=0x10c,0x110,0x114,0xe8,0xa8,0x7ffb280c3cb8,0x7ffb280c3cc8,0x7ffb280c3cd8
                6⤵
                  PID:5636
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=gpu-process --field-trial-handle=1760,6417310121906852879,17913754929037848887,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msEnhancedTrackingPreventionEnabled,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1800 /prefetch:2
                  6⤵
                    PID:944
                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1760,6417310121906852879,17913754929037848887,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msEnhancedTrackingPreventionEnabled,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=2100 /prefetch:3
                    6⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3708
              • C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_47084\utorrentie.exe
                "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_47084\utorrentie.exe" uTorrent_3660_03CC35A0_1558140921 µTorrent4823DF041B09 uTorrent ce unp
                4⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:5556
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=utorrentie.exe --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --no-default-browser-check --disable-component-extensions-with-background-pages --no-first-run --disable-default-apps --noerrdialogs --embedded-browser-webview-dpi-awareness=0 --disable-features=msEnhancedTrackingPreventionEnabled --disable-popup-blocking --internet-explorer-integration=none --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --mojo-named-platform-channel-pipe=5556.5892.10174232621803839048
                  5⤵
                  • Enumerates system info in registry
                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of WriteProcessMemory
                  PID:5944
                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Crashpad --metrics-dir=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=90.0.818.66 --initial-client-data=0x110,0x114,0x118,0xec,0x1b4,0x7ffb280c3cb8,0x7ffb280c3cc8,0x7ffb280c3cd8
                    6⤵
                      PID:4716
                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=gpu-process --field-trial-handle=1824,14710531837639225409,14521549365776688911,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msEnhancedTrackingPreventionEnabled,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1836 /prefetch:2
                      6⤵
                        PID:8
                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1824,14710531837639225409,14521549365776688911,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msEnhancedTrackingPreventionEnabled,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=1904 /prefetch:3
                        6⤵
                          PID:1372
                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1824,14710531837639225409,14521549365776688911,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msEnhancedTrackingPreventionEnabled,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=2548 /prefetch:8
                          6⤵
                            PID:856
                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=renderer --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --field-trial-handle=1824,14710531837639225409,14521549365776688911,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msEnhancedTrackingPreventionEnabled,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2944 /prefetch:1
                            6⤵
                              PID:5992
                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=renderer --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --field-trial-handle=1824,14710531837639225409,14521549365776688911,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msEnhancedTrackingPreventionEnabled,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
                              6⤵
                                PID:6368
                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=renderer --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --field-trial-handle=1824,14710531837639225409,14521549365776688911,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msEnhancedTrackingPreventionEnabled,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
                                6⤵
                                  PID:6456
                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1824,14710531837639225409,14521549365776688911,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msEnhancedTrackingPreventionEnabled,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=4348 /prefetch:8
                                  6⤵
                                    PID:3516
                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --field-trial-handle=1824,14710531837639225409,14521549365776688911,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msEnhancedTrackingPreventionEnabled,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=entity_extraction --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=4816 /prefetch:8
                                    6⤵
                                      PID:5796
                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=renderer --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --field-trial-handle=1824,14710531837639225409,14521549365776688911,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msEnhancedTrackingPreventionEnabled,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
                                      6⤵
                                        PID:7652
                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1824,14710531837639225409,14521549365776688911,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msEnhancedTrackingPreventionEnabled,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=5712 /prefetch:8
                                        6⤵
                                          PID:5916
                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=renderer --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --field-trial-handle=1824,14710531837639225409,14521549365776688911,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msEnhancedTrackingPreventionEnabled,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
                                          6⤵
                                            PID:9132
                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=renderer --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --field-trial-handle=1824,14710531837639225409,14521549365776688911,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msEnhancedTrackingPreventionEnabled,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
                                            6⤵
                                              PID:6432
                                        • C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_47084\utorrentie.exe
                                          "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_47084\utorrentie.exe" uTorrent_3660_03CC1FF8_1995167019 µTorrent4823DF041B09 uTorrent ce unp
                                          4⤵
                                          • Executes dropped EXE
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of WriteProcessMemory
                                          PID:5784
                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=utorrentie.exe --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --no-default-browser-check --disable-component-extensions-with-background-pages --no-first-run --disable-default-apps --noerrdialogs --embedded-browser-webview-dpi-awareness=0 --disable-features=msEnhancedTrackingPreventionEnabled --disable-popup-blocking --internet-explorer-integration=none --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --mojo-named-platform-channel-pipe=5784.4496.12369973962469145228
                                            5⤵
                                              PID:3104
                                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
                                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Crashpad --metrics-dir=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xe0,0x1b4,0x7ffb280c3cb8,0x7ffb280c3cc8,0x7ffb280c3cd8
                                                6⤵
                                                  PID:1188
                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
                                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=gpu-process --field-trial-handle=1288,3340055756888755903,411612360494397402,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msEnhancedTrackingPreventionEnabled,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
                                                  6⤵
                                                    PID:5336
                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1288,3340055756888755903,411612360494397402,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msEnhancedTrackingPreventionEnabled,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=1964 /prefetch:3
                                                    6⤵
                                                      PID:5084
                                                • C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_47084\utorrentie.exe
                                                  "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_47084\utorrentie.exe" uTorrent_3660_03CC30D0_650385322 µTorrent4823DF041B09 uTorrent ce unp
                                                  4⤵
                                                  • Executes dropped EXE
                                                  PID:740
                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=utorrentie.exe --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --no-default-browser-check --disable-component-extensions-with-background-pages --no-first-run --disable-default-apps --noerrdialogs --embedded-browser-webview-dpi-awareness=0 --disable-features=msEnhancedTrackingPreventionEnabled --disable-popup-blocking --internet-explorer-integration=none --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --mojo-named-platform-channel-pipe=740.4508.2095363808443188795
                                                    5⤵
                                                      PID:3420
                                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
                                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Crashpad --metrics-dir=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xe0,0x1b4,0x7ffb280c3cb8,0x7ffb280c3cc8,0x7ffb280c3cd8
                                                        6⤵
                                                          PID:2192
                                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
                                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1876,17928483201224343648,12413783954071076431,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msEnhancedTrackingPreventionEnabled,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=1888 /prefetch:3
                                                          6⤵
                                                            PID:6564
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://utorrent.com/prodnews?v=3%2e6%2e0%2e1%2e47084&pv=0.0.0.0.0
                                                        4⤵
                                                        • Enumerates system info in registry
                                                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                        • Suspicious use of FindShellTrayWindow
                                                        • Suspicious use of SendNotifyMessage
                                                        PID:6220
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb280c3cb8,0x7ffb280c3cc8,0x7ffb280c3cd8
                                                          5⤵
                                                            PID:6596
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,11363588335823763541,12726192935527777761,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2044 /prefetch:2
                                                            5⤵
                                                              PID:5928
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1988,11363588335823763541,12726192935527777761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 /prefetch:3
                                                              5⤵
                                                                PID:552
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1988,11363588335823763541,12726192935527777761,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2600 /prefetch:8
                                                                5⤵
                                                                  PID:2760
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,11363588335823763541,12726192935527777761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
                                                                  5⤵
                                                                    PID:6792
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,11363588335823763541,12726192935527777761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
                                                                    5⤵
                                                                      PID:6840
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,11363588335823763541,12726192935527777761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
                                                                      5⤵
                                                                        PID:772
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,11363588335823763541,12726192935527777761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
                                                                        5⤵
                                                                          PID:6256
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,11363588335823763541,12726192935527777761,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4568 /prefetch:1
                                                                          5⤵
                                                                            PID:3584
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,11363588335823763541,12726192935527777761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
                                                                            5⤵
                                                                              PID:4080
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,11363588335823763541,12726192935527777761,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
                                                                              5⤵
                                                                                PID:7008
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,11363588335823763541,12726192935527777761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:8
                                                                                5⤵
                                                                                  PID:4980
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1988,11363588335823763541,12726192935527777761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
                                                                                  5⤵
                                                                                    PID:1740
                                                                                • C:\Users\Admin\AppData\Roaming\uTorrent\helper\helper.exe
                                                                                  "C:\Users\Admin\AppData\Roaming\uTorrent\helper\helper.exe" 56240 --hval iurpnx8PaM85UC_Q -- -pid 3660 -version 47084
                                                                                  4⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:8264
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 1788
                                                                                3⤵
                                                                                • Program crash
                                                                                PID:3600
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 1788
                                                                                3⤵
                                                                                • Program crash
                                                                                PID:6604
                                                                          • C:\Windows\SysWOW64\DllHost.exe
                                                                            C:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}
                                                                            1⤵
                                                                              PID:660
                                                                            • C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe
                                                                              "C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -bn:ReasonLabs -dt:10
                                                                              1⤵
                                                                              • Executes dropped EXE
                                                                              PID:920
                                                                            • C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe
                                                                              "C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"
                                                                              1⤵
                                                                              • Drops file in Program Files directory
                                                                              • Executes dropped EXE
                                                                              • Loads dropped DLL
                                                                              • Modifies data under HKEY_USERS
                                                                              • Modifies system certificate store
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:1636
                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3412 -ip 3412
                                                                              1⤵
                                                                                PID:5852
                                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                1⤵
                                                                                  PID:4700
                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3412 -ip 3412
                                                                                  1⤵
                                                                                    PID:3624
                                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                    1⤵
                                                                                      PID:6788
                                                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                      1⤵
                                                                                        PID:3172
                                                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                        1⤵
                                                                                          PID:6444
                                                                                        • C:\Program Files\ReasonLabs\EPP\rsWSC.exe
                                                                                          "C:\Program Files\ReasonLabs\EPP\rsWSC.exe"
                                                                                          1⤵
                                                                                          • Drops file in System32 directory
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:7244
                                                                                        • C:\Windows\system32\AUDIODG.EXE
                                                                                          C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004EC
                                                                                          1⤵
                                                                                            PID:8472
                                                                                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
                                                                                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
                                                                                            1⤵
                                                                                            • Modifies registry class
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:7924

                                                                                          Network

                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                Replay Monitor

                                                                                                Loading Replay Monitor...

                                                                                                Downloads

                                                                                                analyticsmanager.cab
                                                                                                • Path C:\Program Files\McAfee\Temp2898022111\analyticsmanager.cab
                                                                                                • Size 1.8MB
                                                                                                • SHA256 f43f800d8d85d7c5af3bbfa5b2ea13d183be8e8ad57f7a7fa4475bf603a693e9
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                analyticstelemetry.cab
                                                                                                • Path C:\Program Files\McAfee\Temp2898022111\analyticstelemetry.cab
                                                                                                • Size 58KB
                                                                                                • SHA256 27f810a794170a97e430dc29a26169dec6bcea373ee000785ac089cac058770a
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                browserhost.cab
                                                                                                • Path C:\Program Files\McAfee\Temp2898022111\browserhost.cab
                                                                                                • Size 1.2MB
                                                                                                • SHA256 b0004747c1da4ee30f93065bddda1e471338f07024d06e912cdf281333f7a0f3
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                browserplugin.cab
                                                                                                • Path C:\Program Files\McAfee\Temp2898022111\browserplugin.cab
                                                                                                • Size 4.9MB
                                                                                                • SHA256 f7f7c0fabe6d53a3e09aeb38648302523cdae1efb427205661c5567257156313
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                downloadscan.cab
                                                                                                • Path C:\Program Files\McAfee\Temp2898022111\downloadscan.cab
                                                                                                • Size 2.2MB
                                                                                                • SHA256 dce5dc71a095b82388b5945ddbdfed67a25686df0e89a3ef64681eb6a85743da
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                eventmanager.cab
                                                                                                • Path C:\Program Files\McAfee\Temp2898022111\eventmanager.cab
                                                                                                • Size 1.5MB
                                                                                                • SHA256 de0b3de2af79a643e4b7712563a486786f470574792ab2e655aeeb20686ac116
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                installer.exe
                                                                                                • Path C:\Program Files\McAfee\Temp2898022111\installer.exe
                                                                                                • Size 2.9MB
                                                                                                • SHA256 b2c1ad8af3439bc7458130400bd213dd3db5aee8f49e295027c97b11dbe6bf58
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                l10n.cab
                                                                                                • Path C:\Program Files\McAfee\Temp2898022111\l10n.cab
                                                                                                • Size 274KB
                                                                                                • SHA256 3e3df2de1e9122e6f0c556e1fd557829a6f05c1d95e56ebfe7f25865825157c7
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                logicmodule.cab
                                                                                                • Path C:\Program Files\McAfee\Temp2898022111\logicmodule.cab
                                                                                                • Size 1.5MB
                                                                                                • SHA256 2d0ae00abb55e00f80a39a155272839d315f2c874ce597c3b2c49f89e8a34321
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                logicscripts.cab
                                                                                                • Path C:\Program Files\McAfee\Temp2898022111\logicscripts.cab
                                                                                                • Size 57KB
                                                                                                • SHA256 1883bb949ed1f2f180a418b06745168a7123b378339f6bfccaae7a1acbdbfbf6
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                lookupmanager.cab
                                                                                                • Path C:\Program Files\McAfee\Temp2898022111\lookupmanager.cab
                                                                                                • Size 985KB
                                                                                                • SHA256 7b6edb3ff653a4e35d46b7df1d38758bdf818de7c11b58960933aa60d0b9906c
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                mfw-mwb.cab
                                                                                                • Path C:\Program Files\McAfee\Temp2898022111\mfw-mwb.cab
                                                                                                • Size 31KB
                                                                                                • SHA256 83f3e39419cc39af3b448b12ce9223b9f1ab344d5fce9c0bddb8553ef8058cd4
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                mfw-nps.cab
                                                                                                • Path C:\Program Files\McAfee\Temp2898022111\mfw-nps.cab
                                                                                                • Size 33KB
                                                                                                • SHA256 22ffacd39ac79e89a2b90c4e7a4a7c7cf6d9c2e08e8e3821217770a727278b45
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                mfw-webadvisor.cab
                                                                                                • Path C:\Program Files\McAfee\Temp2898022111\mfw-webadvisor.cab
                                                                                                • Size 902KB
                                                                                                • SHA256 e53a3fe148a06433db5f6b1c880a47836d7a55cabcc96eeecc1ac82df95f8c90
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                mfw.cab
                                                                                                • Path C:\Program Files\McAfee\Temp2898022111\mfw.cab
                                                                                                • Size 310KB
                                                                                                • SHA256 638278c1247e614fcdcc34892738a8e43f39c0d8b44848b4debf9021e4888903
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                resourcedll.cab
                                                                                                • Path C:\Program Files\McAfee\Temp2898022111\resourcedll.cab
                                                                                                • Size 50KB
                                                                                                • SHA256 f39012b54ba8ab45afeb81257fee103d8e96f74eee8abfdad1156dce80f19254
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                servicehost.cab
                                                                                                • Path C:\Program Files\McAfee\Temp2898022111\servicehost.cab
                                                                                                • Size 317KB
                                                                                                • SHA256 88a6f34ca571ecbcefdb56ca59d1772cc4db96856a67a3f4b00c4f4841919508
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                settingmanager.cab
                                                                                                • Path C:\Program Files\McAfee\Temp2898022111\settingmanager.cab
                                                                                                • Size 788KB
                                                                                                • SHA256 6ed8c980565ef3f3a091e4a8cf314dddca86e38465b62450a9c6ab153811c8e2
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                taskmanager.cab
                                                                                                • Path C:\Program Files\McAfee\Temp2898022111\taskmanager.cab
                                                                                                • Size 1.2MB
                                                                                                • SHA256 ddccc80534f3a777be411a85e123a1e9e5a027a667099de9eb8079012b15c11d
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                telemetry.cab
                                                                                                • Path C:\Program Files\McAfee\Temp2898022111\telemetry.cab
                                                                                                • Size 90KB
                                                                                                • SHA256 bf80c0e6f1b2ed8e7f2d72d8f4fda1c6fdb35f60aa75914e8b4867175b981759
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                uihost.cab
                                                                                                • Path C:\Program Files\McAfee\Temp2898022111\uihost.cab
                                                                                                • Size 312KB
                                                                                                • SHA256 96143a282e06a937a511619cabba7cef75b236b1e0c3e110b41efba47e9f2f9d
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                uimanager.cab
                                                                                                • Path C:\Program Files\McAfee\Temp2898022111\uimanager.cab
                                                                                                • Size 1.7MB
                                                                                                • SHA256 d1ccfa367f07a6e271ed67f1f3f8f3936edfb6274d66a80086e9cdbb47931e0c
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                uninstaller.cab
                                                                                                • Path C:\Program Files\McAfee\Temp2898022111\uninstaller.cab
                                                                                                • Size 970KB
                                                                                                • SHA256 adc108549827342ae93ed7163a61cca1296824b3be54e266dc5c779f8a7a87c0
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                updater.cab
                                                                                                • Path C:\Program Files\McAfee\Temp2898022111\updater.cab
                                                                                                • Size 951KB
                                                                                                • SHA256 4939f02ac5bef2bf850dfde34902dc84101125b0ac3cb0ed71b2dcb9459b833e
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                wataskmanager.cab
                                                                                                • Path C:\Program Files\McAfee\Temp2898022111\wataskmanager.cab
                                                                                                • Size 2.8MB
                                                                                                • SHA256 f4670f2db3e33f2130b636af2faa495a52532ec304a58014ae2128242aea5047
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                webadvisor.cab
                                                                                                • Path C:\Program Files\McAfee\Temp2898022111\webadvisor.cab
                                                                                                • Size 22KB
                                                                                                • SHA256 b436cf419f88f409a7d27b43b5932c6e381c5b6a93a323b64051cd7c5ef59ce5
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                wssdep.cab
                                                                                                • Path C:\Program Files\McAfee\Temp2898022111\wssdep.cab
                                                                                                • Size 586KB
                                                                                                • SHA256 4d49923aaaadf6a7dd4f9c093dbb6878a00363a3e0a18e5bcc54e61175aa8d80
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                dataConfig.cab
                                                                                                • Path C:\Program Files\McAfee\WebAdvisor\Analytics\dataConfig.cab
                                                                                                • Size 72KB
                                                                                                • SHA256 b92f20569bcb06eb12a87d278592af03f564281ad9803eb8ee748eed0c4afbf2
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                InstallerLib.dll
                                                                                                • Path C:\Program Files\ReasonLabs\EPP\InstallerLib.dll
                                                                                                • Size 335KB
                                                                                                • SHA256 f1ca17b57265e90f6c506aba656e30085374103bff4e80f4422209c1f9ec1aad
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                rsElam.sys
                                                                                                • Path C:\Program Files\ReasonLabs\EPP\elam\rsElam.sys
                                                                                                • Size 19KB
                                                                                                • SHA256 8bcc210669bc5931a3a69fc63ed288cb74013a92c84ca0aba89e3f4e56e3ae51
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                mc.dll
                                                                                                • Path C:\Program Files\ReasonLabs\EPP\mc.dll
                                                                                                • Size 1.1MB
                                                                                                • SHA256 9a2ff6264bace4dcefb1b45d3cab70cd1b773f4a1e0021fe2b5a005ced8f0897
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                rsEngine.Core.dll
                                                                                                • Path C:\Program Files\ReasonLabs\EPP\rsEngine.Core.dll
                                                                                                • Size 347KB
                                                                                                • SHA256 4a47e9ec4aafa07fce1765a62546934728a129b4deb633655ebed41f6a451d9b
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                rsEngine.config
                                                                                                • Path C:\Program Files\ReasonLabs\EPP\rsEngine.config
                                                                                                • Size 5KB
                                                                                                • SHA256 2f4d851bcb6c5b36c16bc1abdf6cc65019412f3a163e56095f75f22e9fca59a3
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                rsWSC.InstallLog
                                                                                                • Path C:\Program Files\ReasonLabs\EPP\rsWSC.InstallLog
                                                                                                • Size 370B
                                                                                                • SHA256 115a74ccd1f7c937afe3de7fa926fe71868f435f8ab1e213e1306e8d8239eca3
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                rsWSC.InstallLog
                                                                                                • Path C:\Program Files\ReasonLabs\EPP\rsWSC.InstallLog
                                                                                                • Size 606B
                                                                                                • SHA256 19537ccffeb8552c0d4a8e0f22a859b4465de1723d6db139c73c885c00bd03e0
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                EPP.exe
                                                                                                • Path C:\Program Files\ReasonLabs\EPP\ui\EPP.exe
                                                                                                • Size 2.2MB
                                                                                                • SHA256 fd17a55e4fd758e6afb3d4dee02c45a785c91d798245369aaebc0137a8680fb6
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                log_00200057003F001D0006.txt
                                                                                                • Path C:\ProgramData\McAfee\WebAdvisor\TaskManager.dll\log_00200057003F001D0006.txt
                                                                                                • Size 1KB
                                                                                                • SHA256 8851565dadb05bc3d8aa0cd6a4b38590241a7a7d41b07cc42494db0ae9414234
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                log_00200057003F001D0006.txt
                                                                                                • Path C:\ProgramData\McAfee\WebAdvisor\TaskManager.dll\log_00200057003F001D0006.txt
                                                                                                • Size 3KB
                                                                                                • SHA256 4545ad81ac201536451ac1d467fb43755281f959a485fe1ce86e329622ee6fbd
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                log_00200057003F001D0006.txt
                                                                                                • Path C:\ProgramData\McAfee\WebAdvisor\TaskManager.dll\log_00200057003F001D0006.txt
                                                                                                • Size 4KB
                                                                                                • SHA256 8d4ae078ba741100ffa5d1376e761e4b5dd3d21656b352106e12ab0f3703d353
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                settings.dat
                                                                                                • Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Crashpad\settings.dat
                                                                                                • Size 152B
                                                                                                • SHA256 bfd7ab70a3cd91a7eea6d9d67cdc9e9c6ae8c34126f824896b2d6d2644f0a927
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                settings.dat
                                                                                                • Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Crashpad\settings.dat
                                                                                                • Size 152B
                                                                                                • SHA256 a5ed4a5a8cb503d22258fa6d41a22729b22a1e644d33a1ad28879001c511946e
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                settings.dat
                                                                                                • Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Crashpad\settings.dat
                                                                                                • Size 152B
                                                                                                • SHA256 7cb36dc3d81201021173ae4ad4e6c16e7ea39edfc7ef575d0c1ff75fad38620c
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                f_000002
                                                                                                • Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Default\Cache\f_000002
                                                                                                • Size 42KB
                                                                                                • SHA256 f4f5c0691db49e2f3b5fe39e9e71b99b8e675feffa1449c6928f5e9abb8576b7
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                f_000003
                                                                                                • Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Default\Cache\f_000003
                                                                                                • Size 71KB
                                                                                                • SHA256 e7e7dc3ddc0a2288a2b4408622479f5f6ec672281860460a63ced1ff9da9d913
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                f_00001a
                                                                                                • Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Default\Cache\f_00001a
                                                                                                • Size 65KB
                                                                                                • SHA256 a05eb596c6f88207364bb712803feaa283d5d0acb87c1d5cf2ca15e433419df9
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                f_00001b
                                                                                                • Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Default\Cache\f_00001b
                                                                                                • Size 145KB
                                                                                                • SHA256 3df64eb9db4f7c5200aa288fd48ef9b93615380ad0edb210302848ed3a2b1db5
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                the-real-index
                                                                                                • Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                                                                                • Size 48B
                                                                                                • SHA256 c31362a8cb740950abd0f73c7b84c0b151fcb3eb04ac495edacbda9902f66d0c
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                the-real-index
                                                                                                • Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                                                                                • Size 1KB
                                                                                                • SHA256 029d5f0111b0f19070ac22edb3e7e0a5611baca52f1ce1d1dd015ed957ed2824
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                MANIFEST-000001
                                                                                                • Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Default\Local Storage\leveldb\MANIFEST-000001
                                                                                                • Size 41B
                                                                                                • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                Preferences
                                                                                                • Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Default\Preferences
                                                                                                • Size 342KB
                                                                                                • SHA256 03a3d8950764732f33ba60eb36115803b7404561833bfecf6c8ca41fcb5b20fd
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                Preferences~RFe5934c2.TMP
                                                                                                • Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Default\Preferences~RFe5934c2.TMP
                                                                                                • Size 4KB
                                                                                                • SHA256 26cbbdfb11f80b9294b4b424ce6370432624274b0ae38b70a0109a47c0aa6b64
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                CURRENT
                                                                                                • Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
                                                                                                • Size 16B
                                                                                                • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                TransportSecurity
                                                                                                • Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Default\TransportSecurity
                                                                                                • Size 1KB
                                                                                                • SHA256 83ca433e4b246a3542fb8f0769497a89353ecfa00eb16d31ab80eec36c6d368b
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                TransportSecurity
                                                                                                • Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Default\TransportSecurity
                                                                                                • Size 1KB
                                                                                                • SHA256 05b8467e40a545ef4bb1d138592d167c9050684e18afe3272fe92692865dbb51
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                TransportSecurity~RFe5938aa.TMP
                                                                                                • Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Default\TransportSecurity~RFe5938aa.TMP
                                                                                                • Size 1KB
                                                                                                • SHA256 8d82b69be9115abd5259e7a7d6cd1e8a7ae01a1e165c2848c2bb769f71bec9f4
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                CURRENT
                                                                                                • Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                • Size 16B
                                                                                                • SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                Local State
                                                                                                • Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Local State
                                                                                                • Size 8KB
                                                                                                • SHA256 d9ae4614faf7eff3a7b229486810d65e6d27edac46dff29a843aabcbb38fc511
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                Local State
                                                                                                • Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Local State
                                                                                                • Size 8KB
                                                                                                • SHA256 f5ba572a447d9e40286458ec3f01550f7146cfba82aa4d2107c06c14f8715410
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                Local State
                                                                                                • Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Local State
                                                                                                • Size 1KB
                                                                                                • SHA256 4cb55c91552c5e6639fbbe6d11014e3c52634ec6691f9746363a19eac7b019c5
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                Local State
                                                                                                • Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Local State
                                                                                                • Size 1KB
                                                                                                • SHA256 df1293f63ffa9fd91be68a4756df0a82efbad801d749b2acece13f45ee7f1a80
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                data_0
                                                                                                • Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\ShaderCache\GPUCache\data_0
                                                                                                • Size 8KB
                                                                                                • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                data_1
                                                                                                • Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\ShaderCache\GPUCache\data_1
                                                                                                • Size 264KB
                                                                                                • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                data_2
                                                                                                • Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\ShaderCache\GPUCache\data_2
                                                                                                • Size 8KB
                                                                                                • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                data_3
                                                                                                • Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\ShaderCache\GPUCache\data_3
                                                                                                • Size 8KB
                                                                                                • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                ab823176-0c9b-4e8e-a570-cce19a583085.tmp
                                                                                                • Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\ab823176-0c9b-4e8e-a570-cce19a583085.tmp
                                                                                                • Size 1KB
                                                                                                • SHA256 4bda96aebdad61d471dc3864acb325681f6cdbdf814b43d3b484bc0339d02e8e
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                settings.dat
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                • Size 152B
                                                                                                • SHA256 03dbdb03799f9e37c38f6d9d498ad09f7f0f9901430ff69d95aa26cae87504d3
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                settings.dat
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                • Size 152B
                                                                                                • SHA256 296db8c9361efb62e23be1935fd172cfe9fbcd89a424f34f347ec3cc5ca5afad
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                f_00000e
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e
                                                                                                • Size 20KB
                                                                                                • SHA256 e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                the-real-index
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                • Size 432B
                                                                                                • SHA256 c5ce8f13ef1a76c0e714d0479372bd1c0ce16c4f89c12fbe640b9a7fde0b56e7
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                Preferences
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                • Size 6KB
                                                                                                • SHA256 240628a9e8ec2e3588da708bb6e7db3152a472f04027a3f0041ba207cbb3a8d8
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                Preferences
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                • Size 5KB
                                                                                                • SHA256 ed416a0c5b6f7ec211830e1551bc2ff0685f710d0562caa9133a196a8b29ef84
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                Local State
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                • Size 11KB
                                                                                                • SHA256 49846883729d3787c0a87ed0e1c4f98ce3319c39fb99e04b58a1272c4d8c5a2c
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                Local State
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                • Size 11KB
                                                                                                • SHA256 a078903dca124b6ed647a74ed98b386f9f2498b3df7cf8c610d95731de33bd42
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                SearchHoverUnifiedTileModelCache.dat
                                                                                                • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
                                                                                                • Size 10KB
                                                                                                • SHA256 95a29bd42f83c10f6e6cde302b27c51d6c4d976fe559b77cc2eaf5c717052606
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                bm4cu5aw.exe
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\bm4cu5aw.exe
                                                                                                • Size 1.9MB
                                                                                                • SHA256 74d6d71b9433bfc0988643eed614934400cc0bd7ef3e52dfd10f3e2f0a74f3b8
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                utorrent_installer.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\is-7KVAA.tmp\utorrent_installer.tmp
                                                                                                • Size 3.0MB
                                                                                                • SHA256 314409d53fb1a917c32867be5852e6ba7711d52f13c61f1ed958fabda8101622
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                Opera_new.png
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\is-I3Q2C.tmp\Opera_new.png
                                                                                                • Size 65KB
                                                                                                • SHA256 3c1235a59c023bad329532d2c559350b40536ef859c00fb36425f76f348e82ab
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                RAV_Cross.png
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\is-I3Q2C.tmp\RAV_Cross.png
                                                                                                • Size 74KB
                                                                                                • SHA256 b92a31d4853d1b2c4e5b9d9624f40b439856d0c6a517e100978cbde8d3c47dc8
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                WebAdvisor.png
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\is-I3Q2C.tmp\WebAdvisor.png
                                                                                                • Size 47KB
                                                                                                • SHA256 0c430e56d69435d8ab31cbb5916a73a47d11ef65b37d289ee7d11130adf25856
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                component0.exe
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\is-I3Q2C.tmp\component0.exe
                                                                                                • Size 44KB
                                                                                                • SHA256 35c0efdf1e888a66597bbe76d2974b613a91f6058b8befac80cdb96117616a7d
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                component1.zip
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\is-I3Q2C.tmp\component1.zip
                                                                                                • Size 515KB
                                                                                                • SHA256 cc6f4faf4e8a9f4d2269d1d69a69ea326f789620fb98078cc98597f3cb998589
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                installer.exe
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\is-I3Q2C.tmp\component1_extract\installer.exe
                                                                                                • Size 28.0MB
                                                                                                • SHA256 c19df49f177f0fecf2d406ef7801a8d0e5641cb8a38b7b859cbf118cb5d0684e
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                saBSI.exe
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\is-I3Q2C.tmp\component1_extract\saBSI.exe
                                                                                                • Size 1.1MB
                                                                                                • SHA256 f5aa950381fbcea7d730aa794974ca9e3310384a95d6cf4d015fbdbd9797b3e4
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                uTorrent.exe
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\is-I3Q2C.tmp\uTorrent.exe
                                                                                                • Size 3.7MB
                                                                                                • SHA256 0c8db28daadcd988a8eab8b9d8ac21c3503a5198ba2e35b116a06e7fb53b01c5
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                mwaB9E5.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\mwaB9E5.tmp
                                                                                                • Size 161KB
                                                                                                • SHA256 1f5a798dde9e1b02979767e35f120d0c669064b9460c267fb5f007c290e3dceb
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                INetC.dll
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsq7A2D.tmp\INetC.dll
                                                                                                • Size 24KB
                                                                                                • SHA256 c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                System.dll
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsq7A2D.tmp\System.dll
                                                                                                • Size 12KB
                                                                                                • SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                bt_datachannel.dll
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsq7A2D.tmp\bt_datachannel.dll
                                                                                                • Size 4.1MB
                                                                                                • SHA256 d4c4e05fade7e76f4a2d0c9c58a6b9b82b761d9951ffddd838c381549368e153
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                nsisFirewall.dll
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsq7A2D.tmp\nsisFirewall.dll
                                                                                                • Size 8KB
                                                                                                • SHA256 53be5716ad80945cb99681d5dbda60492f5dfb206fbfdb776b769b3eeb18d2c2
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                utorrent.exe
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsq7A2D.tmp\utorrent.exe
                                                                                                • Size 2.2MB
                                                                                                • SHA256 ace0be5f95df26cab3eaf5ad4a9eaab804e35b7fc6e01b14517fd22fe9045ec0
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                System.dll
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsq920B.tmp\System.dll
                                                                                                • Size 12KB
                                                                                                • SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                Microsoft.Win32.TaskScheduler.dll
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsq920C.tmp\Microsoft.Win32.TaskScheduler.dll
                                                                                                • Size 340KB
                                                                                                • SHA256 c9e3f36781204ed13c0adad839146878b190feb07df41f57693b99ca0a3924e3
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                RAVEndPointProtection-installer.exe
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsq920C.tmp\RAVEndPointProtection-installer.exe
                                                                                                • Size 538KB
                                                                                                • SHA256 1bbba4dba3eb631909ba4b222d903293f70f7d6e1f2c9f52ae0cfca4e168bd0b
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                rsAtom.dll
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsq920C.tmp\rsAtom.dll
                                                                                                • Size 156KB
                                                                                                • SHA256 58fec0c60d25f836d17e346b07d14038617ae55a5a13adfca13e2937065958f6
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                rsJSON.dll
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsq920C.tmp\rsJSON.dll
                                                                                                • Size 217KB
                                                                                                • SHA256 1b55a9dd09b1cd51a6b1d971d1551233fa2d932bdea793d0743616a4f3edb257
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                rsLogger.dll
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsq920C.tmp\rsLogger.dll
                                                                                                • Size 176KB
                                                                                                • SHA256 61e85b501cf8c0f725c5b03c323320e6ee187e84f166d8f9deaf93b2ea6ca0ef
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                rsStubLib.dll
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsq920C.tmp\rsStubLib.dll
                                                                                                • Size 248KB
                                                                                                • SHA256 944259d12065d301955931c79a8ae434c3ebccdcbfad5e545bab71765edc9239
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                rsSyncSvc.exe
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsq920C.tmp\rsSyncSvc.exe
                                                                                                • Size 795KB
                                                                                                • SHA256 688533610facdd062f37ff95b0fd7d75235c76901c543c4f708cfaa1850d6fac
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                rsLogger.DLL
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsq920C.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\dl3\38d6c902\fb624eff_3bb5da01\rsLogger.DLL
                                                                                                • Size 179KB
                                                                                                • SHA256 7039ccc46f16683c06784a479d0667849fee62ed66804766175fb91eeb62eb50
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                rsServiceController.DLL
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsq920C.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\dl3\66b90ec6\95b04eff_3bb5da01\rsServiceController.DLL
                                                                                                • Size 174KB
                                                                                                • SHA256 7d012c6f6ee34f136d0138de48434bdf4839028a4e4d8b51efb1bc8101f4586c
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                rsAtom.DLL
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsq920C.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\dl3\843ad3d9\b3c544ff_3bb5da01\rsAtom.DLL
                                                                                                • Size 158KB
                                                                                                • SHA256 bc29bbf32b7935cc81c612ce6aba2f8fe7bccd3cf79c6ba9d598652c811f5bc7
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                rsJSON.DLL
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsq920C.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\dl3\f7395edf\873b4eff_3bb5da01\rsJSON.DLL
                                                                                                • Size 220KB
                                                                                                • SHA256 3c336093dd7f4b9991890ba90051b0bea79b78d56d7502f69316db246a93a716
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                uninstall.ico
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsq920C.tmp\uninstall.ico
                                                                                                • Size 170KB
                                                                                                • SHA256 0d3a05e1b06403f2130a6e827b1982d2af0495cdd42deb180ca0ce4f20db5058
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                helper.exe
                                                                                                • Path C:\Users\Admin\AppData\Roaming\utorrent\helper\helper.exe
                                                                                                • Size 5.3MB
                                                                                                • SHA256 47ee0ff9320b915a908419652c6fa197c274355cb1bef9709361f2bee8d0e614
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                helper_web_ui.btinstall
                                                                                                • Path C:\Users\Admin\AppData\Roaming\utorrent\helper_web_ui.btinstall
                                                                                                • Size 5.1MB
                                                                                                • SHA256 3a6a9ace416abc4bdb3ddebf0c6260f6937f4d6c7a12efe1e43311ad8f8b4941
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                settings.dat
                                                                                                • Path C:\Users\Admin\AppData\Roaming\utorrent\settings.dat
                                                                                                • Size 8KB
                                                                                                • SHA256 02ebb11bc0519ad1e07395ded2b9d378889e4e8becba9ff2c99cd0133c439705
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                memory/548-584-0x00007FF7B8ED0000-0x00007FF7B8EE0000-memory.dmp
                                                                                                Download

                                                                                                memory/548-466-0x00007FF786400000-0x00007FF786410000-memory.dmp
                                                                                                Download

                                                                                                memory/548-488-0x00007FF786400000-0x00007FF786410000-memory.dmp
                                                                                                Download

                                                                                                memory/548-487-0x00007FF786400000-0x00007FF786410000-memory.dmp
                                                                                                Download

                                                                                                memory/548-486-0x00007FF786400000-0x00007FF786410000-memory.dmp
                                                                                                Download

                                                                                                memory/548-485-0x00007FF786400000-0x00007FF786410000-memory.dmp
                                                                                                Download

                                                                                                memory/548-484-0x00007FF786400000-0x00007FF786410000-memory.dmp
                                                                                                Download

                                                                                                memory/548-483-0x00007FF786400000-0x00007FF786410000-memory.dmp
                                                                                                Download

                                                                                                memory/548-482-0x00007FF786400000-0x00007FF786410000-memory.dmp
                                                                                                Download

                                                                                                memory/548-481-0x00007FF786400000-0x00007FF786410000-memory.dmp
                                                                                                Download

                                                                                                memory/548-480-0x00007FF786400000-0x00007FF786410000-memory.dmp
                                                                                                Download

                                                                                                memory/548-538-0x00007FF7B8ED0000-0x00007FF7B8EE0000-memory.dmp
                                                                                                Download

                                                                                                memory/548-568-0x00007FF7B8ED0000-0x00007FF7B8EE0000-memory.dmp
                                                                                                Download

                                                                                                memory/548-491-0x00007FF786400000-0x00007FF786410000-memory.dmp
                                                                                                Download

                                                                                                memory/548-476-0x00007FF786400000-0x00007FF786410000-memory.dmp
                                                                                                Download

                                                                                                memory/548-570-0x00007FF7B8ED0000-0x00007FF7B8EE0000-memory.dmp
                                                                                                Download

                                                                                                memory/548-572-0x00007FF7B8ED0000-0x00007FF7B8EE0000-memory.dmp
                                                                                                Download

                                                                                                memory/548-574-0x00007FF7B8ED0000-0x00007FF7B8EE0000-memory.dmp
                                                                                                Download

                                                                                                memory/548-490-0x00007FF786400000-0x00007FF786410000-memory.dmp
                                                                                                Download

                                                                                                memory/548-515-0x00007FF7DB860000-0x00007FF7DB870000-memory.dmp
                                                                                                Download

                                                                                                memory/548-586-0x00007FF7B8ED0000-0x00007FF7B8EE0000-memory.dmp
                                                                                                Download

                                                                                                memory/548-474-0x00007FF786400000-0x00007FF786410000-memory.dmp
                                                                                                Download

                                                                                                memory/548-468-0x00007FF786400000-0x00007FF786410000-memory.dmp
                                                                                                Download

                                                                                                memory/548-489-0x00007FF786400000-0x00007FF786410000-memory.dmp
                                                                                                Download

                                                                                                memory/548-463-0x00007FF786400000-0x00007FF786410000-memory.dmp
                                                                                                Download

                                                                                                memory/548-511-0x00007FF782730000-0x00007FF782740000-memory.dmp
                                                                                                Download

                                                                                                memory/548-460-0x00007FF786400000-0x00007FF786410000-memory.dmp
                                                                                                Download

                                                                                                memory/548-449-0x00007FF786400000-0x00007FF786410000-memory.dmp
                                                                                                Download

                                                                                                memory/548-451-0x00007FF786400000-0x00007FF786410000-memory.dmp
                                                                                                Download

                                                                                                memory/548-453-0x00007FF786400000-0x00007FF786410000-memory.dmp
                                                                                                Download

                                                                                                memory/548-456-0x00007FF786400000-0x00007FF786410000-memory.dmp
                                                                                                Download

                                                                                                memory/548-457-0x00007FF786400000-0x00007FF786410000-memory.dmp
                                                                                                Download

                                                                                                memory/548-439-0x00007FF786400000-0x00007FF786410000-memory.dmp
                                                                                                Download

                                                                                                memory/548-440-0x00007FF786400000-0x00007FF786410000-memory.dmp
                                                                                                Download

                                                                                                memory/548-441-0x00007FF786400000-0x00007FF786410000-memory.dmp
                                                                                                Download

                                                                                                memory/548-442-0x00007FF786400000-0x00007FF786410000-memory.dmp
                                                                                                Download

                                                                                                memory/548-501-0x00007FF7AA770000-0x00007FF7AA780000-memory.dmp
                                                                                                Download

                                                                                                memory/548-560-0x00007FF7B8ED0000-0x00007FF7B8EE0000-memory.dmp
                                                                                                Download

                                                                                                memory/548-492-0x00007FF786400000-0x00007FF786410000-memory.dmp
                                                                                                Download

                                                                                                memory/548-526-0x00007FF7DC370000-0x00007FF7DC380000-memory.dmp
                                                                                                Download

                                                                                                memory/548-529-0x00007FF773CE0000-0x00007FF773CF0000-memory.dmp
                                                                                                Download

                                                                                                memory/548-558-0x00007FF7B8ED0000-0x00007FF7B8EE0000-memory.dmp
                                                                                                Download

                                                                                                memory/1456-0-0x0000000000400000-0x00000000004D4000-memory.dmp
                                                                                                Download

                                                                                                memory/1456-11-0x0000000000400000-0x00000000004D4000-memory.dmp
                                                                                                Download

                                                                                                memory/1456-2-0x0000000000401000-0x00000000004B7000-memory.dmp
                                                                                                Download

                                                                                                memory/1488-117-0x0000000000400000-0x00000000009C2000-memory.dmp
                                                                                                Download

                                                                                                memory/1488-92-0x0000000000400000-0x00000000009C2000-memory.dmp
                                                                                                Download

                                                                                                memory/3412-258-0x0000000000400000-0x000000000070F000-memory.dmp
                                                                                                Download

                                                                                                memory/3412-27-0x0000000000400000-0x000000000070F000-memory.dmp
                                                                                                Download

                                                                                                memory/3412-42-0x0000000000400000-0x000000000070F000-memory.dmp
                                                                                                Download

                                                                                                memory/3412-7-0x0000000000400000-0x000000000070F000-memory.dmp
                                                                                                Download

                                                                                                memory/3412-2085-0x0000000000400000-0x000000000070F000-memory.dmp
                                                                                                Download

                                                                                                memory/3412-12-0x0000000000400000-0x000000000070F000-memory.dmp
                                                                                                Download

                                                                                                memory/3412-41-0x0000000000400000-0x000000000070F000-memory.dmp
                                                                                                Download

                                                                                                memory/3412-22-0x0000000000400000-0x000000000070F000-memory.dmp
                                                                                                Download

                                                                                                memory/3412-26-0x00000000042C0000-0x0000000004400000-memory.dmp
                                                                                                Download

                                                                                                memory/3412-43-0x0000000000400000-0x000000000070F000-memory.dmp
                                                                                                Download

                                                                                                memory/3412-31-0x00000000042C0000-0x0000000004400000-memory.dmp
                                                                                                Download

                                                                                                memory/3412-37-0x0000000000400000-0x000000000070F000-memory.dmp
                                                                                                Download

                                                                                                memory/3412-32-0x0000000000400000-0x000000000070F000-memory.dmp
                                                                                                Download

                                                                                                memory/3412-36-0x00000000042C0000-0x0000000004400000-memory.dmp
                                                                                                Download

                                                                                                memory/3660-4893-0x0000000000400000-0x00000000009C2000-memory.dmp
                                                                                                Download

                                                                                                memory/3660-803-0x0000000000400000-0x00000000009C2000-memory.dmp
                                                                                                Download

                                                                                                memory/4060-144-0x000001E76F300000-0x000001E76F828000-memory.dmp
                                                                                                Download

                                                                                                memory/4060-143-0x000001E754840000-0x000001E754848000-memory.dmp
                                                                                                Download

                                                                                                memory/4752-254-0x000002466DAE0000-0x000002466DB1A000-memory.dmp
                                                                                                Download

                                                                                                memory/4752-248-0x0000024653520000-0x00000246535A8000-memory.dmp
                                                                                                Download

                                                                                                memory/4752-256-0x000002466DCE0000-0x000002466DD0A000-memory.dmp
                                                                                                Download

                                                                                                memory/4752-266-0x000002466DD90000-0x000002466DDE8000-memory.dmp
                                                                                                Download

                                                                                                memory/4752-2807-0x000002466E290000-0x000002466E2E6000-memory.dmp
                                                                                                Download

                                                                                                memory/4752-4441-0x000002466E3A0000-0x000002466E3DA000-memory.dmp
                                                                                                Download

                                                                                                memory/4752-4455-0x000002466E420000-0x000002466E450000-memory.dmp
                                                                                                Download

                                                                                                memory/4752-4483-0x000002466E560000-0x000002466E58E000-memory.dmp
                                                                                                Download

                                                                                                memory/4752-252-0x0000024653A00000-0x0000024653A30000-memory.dmp
                                                                                                Download

                                                                                                memory/4752-4468-0x000002466E480000-0x000002466E4AA000-memory.dmp
                                                                                                Download

                                                                                                memory/4752-250-0x000002466D9E0000-0x000002466DA20000-memory.dmp
                                                                                                Download

                                                                                                memory/7244-4549-0x00000288B4150000-0x00000288B44B6000-memory.dmp
                                                                                                Download

                                                                                                memory/7244-4550-0x00000288B3FB0000-0x00000288B412C000-memory.dmp
                                                                                                Download

                                                                                                memory/7244-4551-0x000002889B500000-0x000002889B51A000-memory.dmp
                                                                                                Download

                                                                                                memory/7244-4552-0x000002889B680000-0x000002889B6A2000-memory.dmp
                                                                                                Download

                                                                                                memory/8268-4526-0x0000021916590000-0x00000219165A2000-memory.dmp
                                                                                                Download

                                                                                                memory/8268-4513-0x0000021914950000-0x000002191497E000-memory.dmp
                                                                                                Download

                                                                                                memory/8268-4512-0x0000021914950000-0x000002191497E000-memory.dmp
                                                                                                Download

                                                                                                memory/8268-4527-0x000002192EE10000-0x000002192EE4C000-memory.dmp
                                                                                                Download