Overview

overview

10

Static

static

3

806DDBB70C...20.exe

windows7-x64

10

806DDBB70C...20.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-12-2024 13:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    806DDBB70CE7CF024D8C8D7206020007B303F0FB70F67445D898517944C91A20.exe

  • Size

    3.8MB

  • MD5

    c1dc1d013b521ff6725e1e674da41209

  • SHA1

    414e10310c572e8edf7a127937033e2f23e5176d

  • SHA256

    806ddbb70ce7cf024d8c8d7206020007b303f0fb70f67445d898517944c91a20

  • SHA512

    c03f343dd4c1cd7b22e7f953ac7778116b5aebba8f47259d4773659196e6db807054aea7156a5b412a438acecf0041f07dac9a3dbbaf13105457d08029550a36

  • SSDEEP

    98304:HAI+n8ys9crUL7CKY+0lM4VI5I2mTcin9AUcPTLm17Vs+uy:gt8ysYUL7CJ+01VIcwORa+uy

Score
8/10
discoveryevasionpersistenceupx

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 20 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • UPX packed file 20 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • NSIS installer 6 IoCs
    installer
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 11 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 36 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 27 IoCs
  • Suspicious use of SetWindowsHookEx 28 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\806DDBB70CE7CF024D8C8D7206020007B303F0FB70F67445D898517944C91A20.exe
    "C:\Users\Admin\AppData\Local\Temp\806DDBB70CE7CF024D8C8D7206020007B303F0FB70F67445D898517944C91A20.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3420
    • C:\Program Files (x86)\Common Files\data-com.exe
      "C:\Program Files (x86)\Common Files\data-com.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2816
      • C:\Users\Admin\AppData\Local\Temp\netshare x86_644.exe
        "C:\Users\Admin\AppData\Local\Temp\netshare x86_644.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4556
        • C:\Users\Admin\AppData\Local\Temp\netshare x86_644.exe
          "C:\Users\Admin\AppData\Local\Temp\netshare x86_644.exe"
          4⤵
            PID:1736
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 924
            4⤵
            • Program crash
            PID:3268
        • C:\Users\Admin\AppData\Local\Temp\Office155.exe
          "C:\Users\Admin\AppData\Local\Temp\Office155.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:312
          • C:\Users\Admin\AppData\Local\Temp\Office155.exe
            "C:\Users\Admin\AppData\Local\Temp\Office155.exe"
            4⤵
              PID:444
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 312 -s 972
              4⤵
              • Program crash
              PID:1844
          • C:\Users\Admin\AppData\Local\Temp\win-tooll.exe
            "C:\Users\Admin\AppData\Local\Temp\win-tooll.exe"
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1644
            • C:\Users\Admin\AppData\Local\Temp\win-tooll.exe
              "C:\Users\Admin\AppData\Local\Temp\win-tooll.exe"
              4⤵
                PID:4176
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 924
                4⤵
                • Program crash
                PID:4608
          • C:\Users\Admin\AppData\Local\Temp\uTorrent 3.5.5 Beta (build 45916).exe
            "C:\Users\Admin\AppData\Local\Temp\uTorrent 3.5.5 Beta (build 45916).exe"
            2⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3788
            • C:\Windows\SysWOW64\mshta.exe
              "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\HYD9C12.tmp.1735132721\HTA\index.hta?utorrent" "C:\Users\Admin\AppData\Local\Temp\uTorrent 3.5.5 Beta (build 45916).exe" /CLIENTARGS "/LAUNCHBUNDLEDURL \"http://build 45916\" /LAUNCHBUNDLEDURLTYPE \"@\"" /LOG "C:\Users\Admin\AppData\Local\Temp\HYD9C12.tmp.1735132721\index.hta.log" /PID "3788" /CID "MWgYgckmBuTWDwB4" /VERSION "111850332" /BUCKET "0" /SSB "4" /COUNTRY "US" /OS "10.0" /BROWSERS "\"C:\Program Files\Mozilla Firefox\firefox.exe\",\"C:\Program Files\Google\Chrome\Application\chrome.exe\",C:\Program Files\Internet Explorer\iexplore.exe,\"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe\"" /ARCHITECTURE "64" /LANG "en" /USERNAME "Admin" /SID "S-1-5-21-2045521122-590294423-3465680274-1000" /CLIENT "utorrent"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:4996
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 1416
                4⤵
                • Program crash
                PID:2916
            • C:\Users\Admin\AppData\Roaming\uTorrent\uTorrent.exe
              uTorrent.exe /LAUNCHBUNDLEDURL http://build 45916 /LAUNCHBUNDLEDURLTYPE @ /NOINSTALL /BRINGTOFRONT
              3⤵
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • System Location Discovery: System Language Discovery
              • Checks SCSI registry key(s)
              • Modifies Internet Explorer settings
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:3884
              • C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_45916\utorrentie.exe
                "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_45916\utorrentie.exe" uTorrent_3884_00B39DF8_820744731 µTorrent4823DF041B09 uTorrent
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:3024
              • C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_45916\utorrentie.exe
                "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_45916\utorrentie.exe" uTorrent_3884_00B3A3E8_1383800684 µTorrent4823DF041B09 uTorrent
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:2168
              • C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_45916\utorrentie.exe
                "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_45916\utorrentie.exe" uTorrent_3884_00B3A3E8_1389882611 µTorrent4823DF041B09 uTorrent
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:4968
              • C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_45916\utorrentie.exe
                "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_45916\utorrentie.exe" uTorrent_3884_00B3A3E8_813769246 µTorrent4823DF041B09 uTorrent
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:3796
              • C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_45916\utorrentie.exe
                "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_45916\utorrentie.exe" uTorrent_3884_00B39DF8_650114204 µTorrent4823DF041B09 uTorrent
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:3404
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://utorrent.com/prodnews?v=3%2e5%2e5%2e0%2e45916
                4⤵
                • Enumerates system info in registry
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of WriteProcessMemory
                PID:2624
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9de6846f8,0x7ff9de684708,0x7ff9de684718
                  5⤵
                    PID:912
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,3864327166700717588,1630076810172766817,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
                    5⤵
                      PID:228
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,3864327166700717588,1630076810172766817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
                      5⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3228
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,3864327166700717588,1630076810172766817,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
                      5⤵
                        PID:3952
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3864327166700717588,1630076810172766817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
                        5⤵
                          PID:3032
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3864327166700717588,1630076810172766817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
                          5⤵
                            PID:1964
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3864327166700717588,1630076810172766817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
                            5⤵
                              PID:4432
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,3864327166700717588,1630076810172766817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 /prefetch:8
                              5⤵
                                PID:1688
                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,3864327166700717588,1630076810172766817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 /prefetch:8
                                5⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:3040
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3864327166700717588,1630076810172766817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
                                5⤵
                                  PID:3824
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3864327166700717588,1630076810172766817,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
                                  5⤵
                                    PID:3216
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3864327166700717588,1630076810172766817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
                                    5⤵
                                      PID:4656
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3864327166700717588,1630076810172766817,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
                                      5⤵
                                        PID:3696
                                    • C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_45916\utorrentie.exe
                                      "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_45916\utorrentie.exe" uTorrent_3884_00B39DF8_1972384772 µTorrent4823DF041B09 uTorrent
                                      4⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of SetWindowsHookEx
                                      PID:1560
                                    • C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_45916\utorrentie.exe
                                      "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_45916\utorrentie.exe" uTorrent_3884_00B39DF8_2125232517 µTorrent4823DF041B09 uTorrent
                                      4⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of SetWindowsHookEx
                                      PID:2400
                                    • C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_45916\utorrentie.exe
                                      "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_45916\utorrentie.exe" uTorrent_3884_00B39DF8_755555361 µTorrent4823DF041B09 uTorrent
                                      4⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of SetWindowsHookEx
                                      PID:212
                                    • C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_45916\utorrentie.exe
                                      "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_45916\utorrentie.exe" uTorrent_3884_00B39DF8_262560569 µTorrent4823DF041B09 uTorrent
                                      4⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of SetWindowsHookEx
                                      PID:4508
                                    • C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_45916\utorrentie.exe
                                      "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_45916\utorrentie.exe" uTorrent_3884_00B39DF8_137624750 µTorrent4823DF041B09 uTorrent
                                      4⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of SetWindowsHookEx
                                      PID:4536
                                    • C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_45916\utorrentie.exe
                                      "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_45916\utorrentie.exe" uTorrent_3884_00B39DF8_200204682 µTorrent4823DF041B09 uTorrent
                                      4⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of SetWindowsHookEx
                                      PID:4088
                                    • C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_45916\utorrentie.exe
                                      "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_45916\utorrentie.exe" uTorrent_3884_00B39DF8_1962307899 µTorrent4823DF041B09 uTorrent
                                      4⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of SetWindowsHookEx
                                      PID:3188
                                    • C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_45916\utorrentie.exe
                                      "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_45916\utorrentie.exe" uTorrent_3884_00B39DF8_2115396806 µTorrent4823DF041B09 uTorrent
                                      4⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of SetWindowsHookEx
                                      PID:4996
                                    • C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_45916\utorrentie.exe
                                      "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_45916\utorrentie.exe" uTorrent_3884_00B39DF8_788292836 µTorrent4823DF041B09 uTorrent
                                      4⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of SetWindowsHookEx
                                      PID:4264
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1644 -ip 1644
                                1⤵
                                  PID:3296
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4556 -ip 4556
                                  1⤵
                                    PID:3708
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 312 -ip 312
                                    1⤵
                                      PID:3188
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4996 -ip 4996
                                      1⤵
                                        PID:3448
                                      • C:\Windows\SysWOW64\DllHost.exe
                                        C:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}
                                        1⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:704
                                      • C:\Windows\System32\CompPkgSrv.exe
                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                        1⤵
                                          PID:1308
                                        • C:\Windows\System32\CompPkgSrv.exe
                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                          1⤵
                                            PID:3128

                                          Network

                                          MITRE ATT&CK Enterprise v15

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Program Files (x86)\Common Files\data-com.exe
                                            Filesize

                                            1.7MB

                                            MD5

                                            11ce0a152fdbf1997778a2a0d11200aa

                                            SHA1

                                            b728d7df96a888eb6b61a20d4daa4e71445bab68

                                            SHA256

                                            dcaf19328afff04eb26fa9d8edcbe16fe0ede4785830a6a8b66b68e9e23290f8

                                            SHA512

                                            5f3e889de15dddc4d77715b5a90c6db736ac045384fa03b604e9f9bf64e961d522a4ce1057fbcdf766fac7d01344c6fd1cbd2db085c9e2b8d4d7e833d579eceb

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                            Filesize

                                            152B

                                            MD5

                                            443a627d539ca4eab732bad0cbe7332b

                                            SHA1

                                            86b18b906a1acd2a22f4b2c78ac3564c394a9569

                                            SHA256

                                            1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

                                            SHA512

                                            923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                            Filesize

                                            152B

                                            MD5

                                            99afa4934d1e3c56bbce114b356e8a99

                                            SHA1

                                            3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

                                            SHA256

                                            08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

                                            SHA512

                                            76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                            Filesize

                                            456B

                                            MD5

                                            8619eb1b11ae1c2a2ce1ab4cbfad4e92

                                            SHA1

                                            38fdbaca32b8fdadd31f927121efb3f5cc285feb

                                            SHA256

                                            b3281de1302d6312bd37babfa273d53b77fbd6f2c7d7ecbc916fbc92197622b7

                                            SHA512

                                            5cbdf1bf17271c88f2e93f5d15f59987f01dbb45a1d722e17d37b2263c47f8a1ede2a41da08dc0dca9c7dc02b584cfb0b56ab98e16be1bb2785a96f67e827d3d

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                            Filesize

                                            1KB

                                            MD5

                                            cd0818feac6cadc54e2b0a9e932feef2

                                            SHA1

                                            5dacfa77fa56e35d82e91d7e552d46b2a9d37ec8

                                            SHA256

                                            2c7d2dc5d56c4d35ed82f292c80234fa416139393926c472a727a1c8f125352a

                                            SHA512

                                            0193114b50fa4dfbdeeed83bc12d8ec8defa0b309c69f7aaae8dc400ad27eaba1e81182eafa2d020979a8f13a61d93d166b5e6ea94eff2ee1a315b503075152a

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                            Filesize

                                            5KB

                                            MD5

                                            c05d498e8a48c5a97ba0ed18ae8d2b33

                                            SHA1

                                            d0b3f469116046e1ef571adea6eff76428ef0f1f

                                            SHA256

                                            884d64c8e479758fe8df973083c5e6766432378f60683c20cc4aa6fe43056c5f

                                            SHA512

                                            28e6807c4268bfba7679d1d08b328080b726d5e528664fb119014c4412a4fa005a1765ff5944043e8dbe1e642d585a3bb43e862714db15827ba430a9f32df9b7

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                            Filesize

                                            6KB

                                            MD5

                                            06bea9e38279f86c5210d11bc0350978

                                            SHA1

                                            8207150f1cd636d09015f13e070df309ec5a3e63

                                            SHA256

                                            ff4143f2f9da823295de59f19d77ff89ac5bfa4e545471fedc69fa6f20e9b58c

                                            SHA512

                                            f8c35374a6e59b18bf5859bfe86dc5c316ac453c6d8744622094c45b2ae454ad862e140107829fb02d89e5c1616f0ed9ad920e8a83234727d387c5e52d658e17

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                            Filesize

                                            16B

                                            MD5

                                            206702161f94c5cd39fadd03f4014d98

                                            SHA1

                                            bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                            SHA256

                                            1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                            SHA512

                                            0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                            Filesize

                                            16B

                                            MD5

                                            46295cac801e5d4857d09837238a6394

                                            SHA1

                                            44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                            SHA256

                                            0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                            SHA512

                                            8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                            Filesize

                                            10KB

                                            MD5

                                            f9bc51fd76ea676b7336d8cc1ceff3f4

                                            SHA1

                                            8699d6ee4f91934b62bfcdd89af10620b884ba15

                                            SHA256

                                            568f3529c0c7b1ce4610bc3095d429c1544517fd5352d206d0e33be6081866cb

                                            SHA512

                                            4b86f478837fc99ccf903413091f3c646112531f83cb3183d6179bb8de0010cc78704305bea09eb1bc070e159419ed01720bbd4f6a47353ef8d40ef9eac272d3

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\HYD9C12.tmp.1735132721\HTA\images\main_utorrent.ico
                                            Filesize

                                            104KB

                                            MD5

                                            44d122c9473107fc36412de81418c84a

                                            SHA1

                                            a0072c789a9cd50ba561683c69af8602927cf4a8

                                            SHA256

                                            7c7279daebd88f6a34246603db9c0ecf9bbfa35ef820edd3278e5bc53f9e7680

                                            SHA512

                                            b4294b80edc0566744dd98a5ab3e2ac64a4ce4851192d5610ee13f12dc24947f51b7d5b5629f7bff6004d74e5a2b728913cda1b3386cf878ab7fb365490d8067

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\HYD9C12.tmp.1735132721\HTA\index.hta
                                            Filesize

                                            522B

                                            MD5

                                            76903930c0ade2285f1ab1bf54be660d

                                            SHA1

                                            0fdd5990ca58cf6c49985ffd2075baa09cd728ce

                                            SHA256

                                            61acd6e7405fad348433f8de4b12ed97b42caccbcf28fe0e4ba4b4a5d2ea707e

                                            SHA512

                                            c66c7f9f488a0ac58fc1b7c6560edb4bc6df71a3504c2567ac54f4f89aee40a7073865e67e508baf4e055555bbc2f461d5b558a427ab6ac602b9fe0b1f9f8c71

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\HYD9C12.tmp.1735132721\HTA\install.1735132721.zip
                                            Filesize

                                            743KB

                                            MD5

                                            b95e97108189f7babf89539f08186890

                                            SHA1

                                            bf8e669ff37c68d86eafd239bd82684b0bce00a0

                                            SHA256

                                            52bd756b898a3e7dd1c0ec8d3ef76db5f68b9fc5953ca61c493df01eec61ca12

                                            SHA512

                                            cca151213d0062d529d267f31af39236527399b96b019f0c6a68b68bfbcb0bbd7fa747ad24b8d7db9c900e08ed47cfbe79fdd88e1ff97e0ab7eafc5fe228c649

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\HYD9C12.tmp.1735132721\HTA\scripts\common.js
                                            Filesize

                                            337KB

                                            MD5

                                            78b4d4390bff0f011ebd271c9bebeec5

                                            SHA1

                                            12f0f137a8173be5791187a583256894d68bea26

                                            SHA256

                                            2f2edf2bd12ae6c6553042c30cb73b967e9066babad5f18f5ff054e708ffd19c

                                            SHA512

                                            a83f8133f26fca263070b278879582268d5bc02a4bad5028f5c80517c069bdc9915b21bcdea31f4f81df04ab891e9b5858109d80e2e4421812af64ae1c12a67b

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\HYD9C12.tmp.1735132721\HTA\scripts\initialize.js
                                            Filesize

                                            1005B

                                            MD5

                                            2a65c76b51a2c15eebeefa662d511af9

                                            SHA1

                                            3c5f93d39fdd573e43c7a451836d425bc1b07a5d

                                            SHA256

                                            31fc706ae4bd5093aecb6a0b7f9d3b686feb284076b1122aaff978779612dc06

                                            SHA512

                                            85b012dca5bbdbdd929de859ae41ed817c7f1e02eae70aaaf687f9ba381f696fa7751e3f2262d48c14f49c9090f106a6bb9652962d38bb7fab93214a2466e8ed

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\HYD9C12.tmp.1735132721\HTA\scripts\install.js
                                            Filesize

                                            5KB

                                            MD5

                                            36f8dbcbdeed01079dcd0abdf481ffd7

                                            SHA1

                                            354d8fa00c37255d15a07a8b93f99ec2821ed1a2

                                            SHA256

                                            8d41b55c7626eccd4369418e4d0a1cfc2c7ca56b6424ac7b04e50ebc883837c9

                                            SHA512

                                            3a9ace6ed03f59599739bba74271aac5f4bdd589cbc2727285dd26fe390c8febebd9915c0d72e809e09c47f3d6ec12709acbd99c69796672775f5c0159c4a4d1

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\HYD9C12.tmp.1735132721\HTA\styles\common.css
                                            Filesize

                                            99KB

                                            MD5

                                            8a94d780401556cceabf35058bbd4b5a

                                            SHA1

                                            19ee91b1629f4ccf0fca1f664405a1eee9dacc5a

                                            SHA256

                                            086a7e44de35a235bc258bf1107e22a7dc27932cb4d7e3ebcd1f368acc000caa

                                            SHA512

                                            b02fdc9b46f6fa8424660f462bb290c60c0635ad5cb9fa1b386a55d85d4368d06ae5611d355f8dc0db76477c2e332b0501e70cbbba77c45aa027e1cac59ca182

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\Office155.exe
                                            Filesize

                                            650KB

                                            MD5

                                            e1719a774dafed6ca894ec6b1d0fd457

                                            SHA1

                                            13651637cf5477d3103410cf9829999285d9eebe

                                            SHA256

                                            78474b2f484a98ec6375e8389adb097afd942181fef9dfc2550f54ece30edcbf

                                            SHA512

                                            38ecde8ec5833c1f3ad207dfe14ff71792632b29c9ee6ea954563243020b755bc1fe8547d54eeb91bc25d7f32f204d891f6c865735af781049741efa15e1baee

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\netshare x86_644.exe
                                            Filesize

                                            718KB

                                            MD5

                                            7443707310e3a6b120beb1e61b34d25a

                                            SHA1

                                            1fa6806ee6553931532cc6e2bb49e42d8655734d

                                            SHA256

                                            afe09a1fd24c633424b2ba1aa1df9cc80431c6f9558a48b933063fd18d055fb1

                                            SHA512

                                            37f673558b6d4953f807f18bf14a6a1fde7d39fa3d82c733e98809c7732d30591ac52b17dcb9a80d87418d8b797bec67fa511b1666ad18a5afb276d64f07a721

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\nsd9B18.tmp\t7f2wc.dll
                                            Filesize

                                            129KB

                                            MD5

                                            0e2d5c75d97e0ea879e12dacbf91a6df

                                            SHA1

                                            a61ffac27eca63ebb0075e842a460e80326a5092

                                            SHA256

                                            d40c71ea25575e573284a6763e5530cfd395b3b75a45db4cff8f7a298e84cc74

                                            SHA512

                                            08acde739b4e1caa22fcdfaab508d2ef3b6db78191b0f4a2cedc1d5c0a1de68fb9d8dff72b8de2e129ef011073abd18bdcbf172a99e862bca76e71c7046bab51

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\nsi9B37.tmp\8x0pq8gq9j.dll
                                            Filesize

                                            669KB

                                            MD5

                                            2064ea94df92b42740c547aa2c610dd1

                                            SHA1

                                            9ad300e310ce27c2a0d94131ca182fd74edb5f62

                                            SHA256

                                            cd43f332905d74b8d8926ae6288888cf843666db0a5b703f2123afbd63c5f2cd

                                            SHA512

                                            607f19c5cc1eb57a1bb81c82aefc84761f532df08c3538140db94b06005163678199e7841e9e78cf457e289ea307f96c78507e948d6bd9137a756e7ff74d3090

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\nsy9BE3.tmp\7aew68vt0q.dll
                                            Filesize

                                            586KB

                                            MD5

                                            fd826e8cb4ced9c11498351c5d602c35

                                            SHA1

                                            81295b8b5146668e5b1e97ed414cd5807c5b83a4

                                            SHA256

                                            8202d16efc125121e836db33f3a71b265a87740c1407a79b2e6ba796c028a9e8

                                            SHA512

                                            00b2a3c2a392844680819d7106b70e586ff207de9d5c7c90290fbfba72fa4b6e9a5ac59164cc67026e7a1467c69feb2e796440078dcf48e75f61c6ece922b9ae

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\uTorrent 3.5.5 Beta (build 45916).exe
                                            Filesize

                                            2.1MB

                                            MD5

                                            758ad638d4fc0acffbad183d5eccea99

                                            SHA1

                                            440b462c9d1d40ea4b0f226f458cbc0cf222a801

                                            SHA256

                                            d75c4115426b6cae2da95f065af3a38c93bf68169bb66f725a9cc6144a1c49db

                                            SHA512

                                            4e694720f0c2c061cfeff564891d7f3d6a35f2723918b9ac44330bc39879970c251e7a452e21c8479d49c856b54a267c31f929dcf287106df0e95732caf26417

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\win-tooll.exe
                                            Filesize

                                            177KB

                                            MD5

                                            cb7cac7a65b31662f2116d75d65d010a

                                            SHA1

                                            92869d6a5a06114c2c571fe583d744708b401be4

                                            SHA256

                                            dfcff668b6a257948fd604e9346b570d91d8e1602d8058548d2141f0e7c5ac2b

                                            SHA512

                                            6cf8db0a4a54d0cd6d2c85135173cf520a1b574e111babc42d154325251bf7ef0ba2b4adaa071492adc85039e96204f6893ab7e1f7f526062bde0103869bbc4f

                                            Download Submit

                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2045521122-590294423-3465680274-1000\1f91d2d17ea675d4c2c3192e241743f9_896de533-e5fb-4eb9-8f2b-d363f3584dc5
                                            Filesize

                                            1KB

                                            MD5

                                            90b966a7ad37756abb8d41f411e3d80b

                                            SHA1

                                            25ec4ff2e890cb968e8cb3fb881de9266750abf0

                                            SHA256

                                            ccdd6d58bf39d34bbbf4125815bafd8abc53fe16412b1e1e8e4f751674c7626a

                                            SHA512

                                            bcaa8baf0fea693c6f6e0822c11614f8c9640f0557b9bae1309fe2d6a43bec86e709fcf32124a0723e3f4c5a8984190ed12e7e363476b53ab16c878f6135101b

                                            Download Submit

                                          • C:\Users\Admin\AppData\Roaming\uTorrent\helper_web_ui.btinstall
                                            Filesize

                                            5.6MB

                                            MD5

                                            96b220a306b716a01d8c6d1fe6de719a

                                            SHA1

                                            07ea647454d25acf0ebf6f56b9741656d92fec08

                                            SHA256

                                            a44c00f9ebefdaa26c5f53b8091a1adc71ad73be51494c208cd7ecfc2ba00400

                                            SHA512

                                            2d500a17a5bf3f653a3a500d01fee2392c37fa7fb26871bdf15b03b6acb0bbe21342bfa48297c5354627ebc1a9900c4f88bf7cbb9de4ca0c0f752e264db779ff

                                            Download Submit

                                          • C:\Users\Admin\AppData\Roaming\uTorrent\settings.dat
                                            Filesize

                                            8KB

                                            MD5

                                            41996a3a746b9c55dfc8fae6c817da73

                                            SHA1

                                            9c495aec1d1fae45e39935ac30f359bf0a3c8874

                                            SHA256

                                            daef639750889d3d5f07a2eaff14d725960d9a7f661dd498ee497b9b2d481d63

                                            SHA512

                                            abf8280bcf1591d3fe9bad741f438dbcc45d19992667892785568afc36479509beaf0b138992347b01915cdd550daee680efc71a60eb08fc30116f33e6ee6b71

                                            Download Submit

                                          • C:\Users\Admin\AppData\Roaming\uTorrent\settings.dat.old
                                            Filesize

                                            7KB

                                            MD5

                                            66f498702ed14a462d532d13dc33ca03

                                            SHA1

                                            9fc37d7d14b9d83399ee1f288b0a417683db4757

                                            SHA256

                                            dac2e74853236829cd52fce0c4d4dc34f7f3009d94fa2fafc92552f366f37c4b

                                            SHA512

                                            b4502f086f4f37185a05a10dc3cac06a93f7f10993fd8184a6c8aa17721278b7ee339b9b19ebb77277f1ede328b490e61095a25390b50492155f00808084cba4

                                            Download Submit

                                          • C:\Users\Admin\AppData\Roaming\uTorrent\settings.dat.old
                                            Filesize

                                            8KB

                                            MD5

                                            4049908a72273da9c7f2172935b85305

                                            SHA1

                                            472da921fcd17caf748ff9251934e2c4b0091232

                                            SHA256

                                            9d65b4984ae86edd0bd4114b4638789fe7dc9bbd6666a89c4e05145e40aed805

                                            SHA512

                                            874acc3733476884f8a99517658caeda6087bd1e61d845ff5040c054526245c33c9a7d46e9de850764123d46417f9ff0d1a935ea8a23eb57913be7683cef6b14

                                            Download Submit

                                          • C:\Users\Admin\AppData\Roaming\uTorrent\toolbar.benc.new
                                            Filesize

                                            170B

                                            MD5

                                            1bbab9a65a84f0c5a77efab25d51753a

                                            SHA1

                                            3fa06fe1f5f2da54a597fdcfab69b1edb7c6855d

                                            SHA256

                                            73cacf6b1d614e2b1163ff426cc9af68ede8b9922a6c68ec2f543743529e8336

                                            SHA512

                                            a30e1998dd3a292d1cd0850ca18a3da1cb490e5962682acd492c169ab07f87359a17df59c8454b9da70919501cd218e8cbe30da7676840522d3e43ef12735ef7

                                            Download Submit

                                          • C:\Users\Admin\AppData\Roaming\uTorrent\updates.dat
                                            Filesize

                                            344B

                                            MD5

                                            067bd2f861cdfb7814b27a3a501d286f

                                            SHA1

                                            9454f73d9c460ecfc39f190325a102dabcd898a2

                                            SHA256

                                            19ea05c43f37d79a56cb14cfe75196328f2dfaaeafb71791c2d90bcc071f1ee8

                                            SHA512

                                            448b97d9f4552640e5186f355f97a882e0c3283c3f66ea38e101ce2381e970dfe5f148c36625af638b455c8bc5ca15acae6e2094781c3e912db1da90c7105b79

                                            Download Submit

                                          • C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_45916\utorrentie.exe
                                            Filesize

                                            538KB

                                            MD5

                                            5760e6b8e1ed38e95358bc911124ca45

                                            SHA1

                                            4822bb14b33fa87d7f3a1a1b8da3acdb371846ab

                                            SHA256

                                            7191ca24568965590522c0a5459100b5056328f62af6d0b7ab4117a3b4e43cce

                                            SHA512

                                            8fa768993d2e680af18235c5d11253530bb292b169aad75f11c2ffe3600aee4c27197606dd0712fb11c1c00f503527c50d35dd8d339f56ef68a1a2e97797acc9

                                            Download Submit

                                          • C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_46640.exe
                                            Filesize

                                            16.1MB

                                            MD5

                                            66e830f3f7d9639e0170f6a681e70412

                                            SHA1

                                            e0b107dbb9b4d88221914c26ccad68d7c144cb50

                                            SHA256

                                            aeeeb1299b5f4e040d04b5c0d1422d007c2e2968aedfae27b197e17021377525

                                            SHA512

                                            194beeb48f077227bd1022d7268d53ff432a03529892d0f3f659d740fed99f20a9f8e39ee56ea38e36c7ac0b3cb34d02d5dfe43e417a413b9e4a9533fa6e59fc

                                            Download Submit

                                          • C:\Users\Admin\Desktop\µTorrent.lnk
                                            Filesize

                                            903B

                                            MD5

                                            c3e7d668ff2837cd1fccb9aa661b238a

                                            SHA1

                                            8f265a51f18afe82486500b01ff8828c46ce88c6

                                            SHA256

                                            1878034561f0ecdd7b2ccde0400ae84ed3656454801e063cdc127d395e93d668

                                            SHA512

                                            d8e9f098a2ea9eca4a42a61cc339f87a0da7934725aca5f45ba380c5225a547cd6ff40201bbe8c9db054b98d925da639a2e82131025eb0d5c5a2d28314af9942

                                            Download Submit

                                          • memory/312-96-0x0000000010000000-0x0000000010006000-memory.dmp

                                            Filesize

                                            24KB

                                            Download

                                          • memory/312-102-0x0000000010000000-0x0000000010006000-memory.dmp

                                            Filesize

                                            24KB

                                            Download

                                          • memory/1644-85-0x0000000010000000-0x0000000010006000-memory.dmp

                                            Filesize

                                            24KB

                                            Download

                                          • memory/3420-29-0x0000000000400000-0x0000000000434000-memory.dmp

                                            Filesize

                                            208KB

                                            Download

                                          • memory/3788-31-0x0000000000400000-0x000000000098B000-memory.dmp

                                            Filesize

                                            5.5MB

                                            Download

                                          • memory/3788-206-0x0000000000400000-0x000000000098B000-memory.dmp

                                            Filesize

                                            5.5MB

                                            Download

                                          • memory/3788-174-0x0000000000400000-0x000000000098B000-memory.dmp

                                            Filesize

                                            5.5MB

                                            Download

                                          • memory/3788-181-0x0000000000400000-0x000000000098B000-memory.dmp

                                            Filesize

                                            5.5MB

                                            Download

                                          • memory/3884-365-0x0000000000400000-0x000000000098B000-memory.dmp

                                            Filesize

                                            5.5MB

                                            Download

                                          • memory/3884-436-0x0000000000400000-0x000000000098B000-memory.dmp

                                            Filesize

                                            5.5MB

                                            Download

                                          • memory/3884-511-0x0000000000400000-0x000000000098B000-memory.dmp

                                            Filesize

                                            5.5MB

                                            Download

                                          • memory/3884-231-0x0000000000400000-0x000000000098B000-memory.dmp

                                            Filesize

                                            5.5MB

                                            Download

                                          • memory/3884-207-0x0000000000400000-0x000000000098B000-memory.dmp

                                            Filesize

                                            5.5MB

                                            Download

                                          • memory/3884-388-0x0000000000400000-0x000000000098B000-memory.dmp

                                            Filesize

                                            5.5MB

                                            Download

                                          • memory/3884-241-0x0000000000400000-0x000000000098B000-memory.dmp

                                            Filesize

                                            5.5MB

                                            Download

                                          • memory/3884-234-0x0000000000400000-0x000000000098B000-memory.dmp

                                            Filesize

                                            5.5MB

                                            Download

                                          • memory/3884-432-0x0000000000400000-0x000000000098B000-memory.dmp

                                            Filesize

                                            5.5MB

                                            Download

                                          • memory/3884-232-0x0000000000400000-0x000000000098B000-memory.dmp

                                            Filesize

                                            5.5MB

                                            Download

                                          • memory/3884-444-0x0000000000400000-0x000000000098B000-memory.dmp

                                            Filesize

                                            5.5MB

                                            Download

                                          • memory/3884-459-0x0000000000400000-0x000000000098B000-memory.dmp

                                            Filesize

                                            5.5MB

                                            Download

                                          • memory/3884-471-0x0000000000400000-0x000000000098B000-memory.dmp

                                            Filesize

                                            5.5MB

                                            Download

                                          • memory/3884-472-0x0000000000D20000-0x0000000000D21000-memory.dmp

                                            Filesize

                                            4KB

                                            Download

                                          • memory/3884-238-0x0000000000400000-0x000000000098B000-memory.dmp

                                            Filesize

                                            5.5MB

                                            Download

                                          • memory/3884-498-0x0000000000400000-0x000000000098B000-memory.dmp

                                            Filesize

                                            5.5MB

                                            Download

                                          • memory/4556-101-0x0000000010000000-0x0000000010006000-memory.dmp

                                            Filesize

                                            24KB

                                            Download

                                          • memory/4556-86-0x0000000010000000-0x0000000010006000-memory.dmp

                                            Filesize

                                            24KB

                                            Download