285127f8530fcdb0166cf37c97e60a13ecff7d57d3f0066e7cec0e89188e9ae2

Analysis

user interaction
yes
max time kernel
31s
max time network
48s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
21/08/2026, 18:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PLUGINSDIR/utorrent.exe
Size 3.5MB
Sample260821-xeszhsch93
SHA256 285127f8530fcdb0166cf37c97e60a13ecff7d57d3f0066e7cec0e89188e9ae2
MD5 657775f666c15e8ac34687e994dba93c
SHA1 7462a199219a13700b48b3bfb094dcb6273d29cf
SHA512 a8ac6aa8ec3453c7d098b42f4b163ae8fe04c335213a9dd7ed39be76758064064b71d4d0dc1573c575f2a3d7df6a62cbf22323220dddfbd2d74220580375065f
SSDEEP 98304:O12+yYUKanBkVVZHvXzSoInsqsCBVCpTLNMYuA4FGPsI:O1BU5nC1bS1dspTBuNy
TLSH
T179063392DE312E84E0FE52F514694AA84121EE4A7D5C1F334231763D5F360C2EABADE7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery persistence spyware trojan upx

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
4992	uTorrent.exe
2188	utorrentie.exe
2412	uTorrent.exe
2052	utorrentie.exe
2068	utorrentie.exe
4944	utorrentie.exe

Identifies Wine through registry keys 2 TTPs 6 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\Software\Wine	utorrent.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	uTorrent.exe
Key opened	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\Software\Wine	uTorrent.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	uTorrent.exe
Key opened	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\Software\Wine	uTorrent.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	utorrent.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ut = "C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe /MINIMIZED"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ut = "\"C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe\" /MINIMIZED"	uTorrent.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 4 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	utorrentie.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	utorrentie.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	utorrentie.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	utorrentie.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral6/memory/3148-0-0x0000000000400000-0x0000000000D17000-memory.dmp	upx
behavioral6/memory/3148-23-0x0000000000400000-0x0000000000D17000-memory.dmp	upx
behavioral6/memory/3148-24-0x0000000000400000-0x0000000000D17000-memory.dmp	upx
behavioral6/files/0x00070000000285e5-30.dat	upx
behavioral6/memory/3148-37-0x0000000000400000-0x0000000000D17000-memory.dmp	upx
behavioral6/memory/4992-45-0x0000000000400000-0x0000000000D17000-memory.dmp	upx
behavioral6/memory/2412-72-0x0000000000400000-0x0000000000D17000-memory.dmp	upx
behavioral6/memory/3148-81-0x0000000000400000-0x0000000000D17000-memory.dmp	upx
behavioral6/memory/4992-387-0x0000000000400000-0x0000000000D17000-memory.dmp	upx
behavioral6/memory/4992-388-0x0000000000400000-0x0000000000D17000-memory.dmp	upx
behavioral6/memory/3148-560-0x0000000000400000-0x0000000000D17000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	utorrentie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	utorrentie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	utorrent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	utorrentie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	utorrentie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uTorrent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uTorrent.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5136	msedge.exe
5320	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	uTorrent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	uTorrent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	uTorrent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	uTorrent.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CROSS_DOMAIN_REDIRECT_MITIGATION	uTorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CROSS_DOMAIN_REDIRECT_MITIGATION\utorrentie.exe = "0"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	uTorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\utorrentie.exe = "11000"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION	uTorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION\utorrentie.exe = "1"	uTorrent.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\.torrent\OpenWithProgids	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\.torrent\OpenWithProgids\uTorrent	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Magnet\ = "Magnet URI"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Magnet\URL Protocol	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\bittorrent\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\maindoc.ico"	utorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-key	utorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-key\Extension = ".btkey"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\.torrent\Content Type = "application/x-bittorrent"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\uTorrent\Content Type\ = "application/x-bittorrent"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\.btsearch\ = "uTorrent"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\.btkey	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\FalconBetaAccount	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\.btskin\Content Type = "application/x-bittorrent-skin"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\uTorrent	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\MIME	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\.btsearch	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Magnet\shell\open\command	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Magnet\shell\open	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Magnet\shell\ = "open"	utorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-skin\Extension = ".btskin"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\.btkey\ = "uTorrent"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\uTorrent\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\maindoc.ico"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\MIME\Database	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\uTorrent\Content Type	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Magnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe\" \"%1\" /SHELLASSOC"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\.btskin\ = "uTorrent"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-skin	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\.btsearch\OpenWithProgids\uTorrent	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Applications	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\uTorrent\shell\ = "open"	utorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Magnet\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\maindoc.ico"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\bittorrent\shell	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\.btapp\Content Type = "application/x-bittorrent-app"	utorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-app	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\.btskin	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Applications\uTorrent.exe	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\.torrent	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\MIME\Database\Content Type\application/x-bittorrent	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml\Extension = ".btsearch"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Magnet\DefaultIcon	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\bittorrent	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\bittorrent\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe\" \"%1\" /SHELLASSOC"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Applications\uTorrent.exe\shell\open\command	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Applications\uTorrent.exe\shell	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\uTorrent\DefaultIcon	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Magnet	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\.btapp\ = "uTorrent"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-app\Extension = ".btapp"	utorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-appinst	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-appinst\Extension = ".btinstall"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-key\Extension = ".btkey"	utorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\uTorrent\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe\" \"%1\" /SHELLASSOC"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-app	utorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent\Extension = ".torrent"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\.btsearch\Content Type = "application/x-bittorrentsearchdescription+xml"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\bittorrent\ = "bittorrent URI"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\.btapp	utorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-skin	utorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-appinst\Extension = ".btinstall"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Applications\uTorrent.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe\" \"%1\" /SHELLASSOC"	utorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml\Extension = ".btsearch"	utorrent.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3148	utorrent.exe
3148	utorrent.exe
4992	uTorrent.exe
4992	uTorrent.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3868	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	3148	utorrent.exe
Token: SeManageVolumePrivilege	4992	uTorrent.exe
Token: SeManageVolumePrivilege	2412	uTorrent.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4992	uTorrent.exe
4992	uTorrent.exe
4992	uTorrent.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4992	uTorrent.exe
4992	uTorrent.exe
4992	uTorrent.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 2188	4992	uTorrent.exe	89
PID 4992 wrote to memory of 2052	4992	uTorrent.exe	92
PID 4992 wrote to memory of 2068	4992	uTorrent.exe	93
PID 2188 wrote to memory of 4952	2188	utorrentie.exe	94
PID 2052 wrote to memory of 2760	2052	utorrentie.exe	95
PID 2068 wrote to memory of 3868	2068	utorrentie.exe	96
PID 2760 wrote to memory of 3648	2760	msedgewebview2.exe	97
PID 4952 wrote to memory of 1188	4952	msedgewebview2.exe	98
PID 3868 wrote to memory of 5208	3868	msedgewebview2.exe	99
PID 4992 wrote to memory of 4944	4992	uTorrent.exe	101
PID 3868 wrote to memory of 648	3868	msedgewebview2.exe	103
PID 3868 wrote to memory of 648	3868	msedgewebview2.exe	103
PID 3868 wrote to memory of 648	3868	msedgewebview2.exe	103
PID 3868 wrote to memory of 1320	3868	msedgewebview2.exe	104
PID 3868 wrote to memory of 920	3868	msedgewebview2.exe	105
PID 3868 wrote to memory of 920	3868	msedgewebview2.exe	105
PID 3868 wrote to memory of 440	3868	msedgewebview2.exe	106
PID 3868 wrote to memory of 440	3868	msedgewebview2.exe	106
PID 3868 wrote to memory of 440	3868	msedgewebview2.exe	106
PID 4944 wrote to memory of 3652	4944	utorrentie.exe	107
PID 3652 wrote to memory of 520	3652	msedgewebview2.exe	108

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\utorrent.exe
"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\utorrent.exe"
1⤵
- Identifies Wine through registry keys
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3148

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}
1⤵
- System Location Discovery: System Language Discovery
PID:5620

C:\Users\Admin\AppData\Roaming\uTorrent\uTorrent.exe
"C:\Users\Admin\AppData\Roaming\uTorrent\uTorrent.exe"
1⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_47254\utorrentie.exe
  "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_47254\utorrentie.exe" uTorrent_4992_05BD56F0_149993389 µTorrent4823DF041B09 uTorrent ce unp
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=utorrentie.exe --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msEnhancedTrackingPreventionEnabled --mojo-named-platform-channel-pipe=2188.1196.6099584650253898743
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4952
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x1a0,0x1a4,0x1a8,0xb4,0x1dc,0x7ffc7de3b078,0x7ffc7de3b084,0x7ffc7de3b090
      4⤵
      PID:1188
- C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_47254\utorrentie.exe
  "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_47254\utorrentie.exe" uTorrent_4992_05BDFB98_1791361823 µTorrent4823DF041B09 uTorrent ce unp
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=utorrentie.exe --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msEnhancedTrackingPreventionEnabled --mojo-named-platform-channel-pipe=2052.2236.5956161498354637465
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2760
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x1a4,0x1a8,0x1ac,0x180,0x1b8,0x7ffc7de3b078,0x7ffc7de3b084,0x7ffc7de3b090
      4⤵
      PID:3648
- C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_47254\utorrentie.exe
  "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_47254\utorrentie.exe" uTorrent_4992_05BE4218_578751970 µTorrent4823DF041B09 uTorrent ce unp
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=utorrentie.exe --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msEnhancedTrackingPreventionEnabled --mojo-named-platform-channel-pipe=2068.3588.8805297884080362606
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:3868
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x1a0,0x1a4,0x1a8,0x17c,0x1e0,0x7ffc7de3b078,0x7ffc7de3b084,0x7ffc7de3b090
      4⤵
      PID:5208
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1800,i,13424050418968262380,8059305060368373943,262144 --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version --mojo-platform-channel-handle=1796 /prefetch:2
      4⤵
      PID:648
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2012,i,13424050418968262380,8059305060368373943,262144 --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:3
      4⤵
      PID:1320
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2276,i,13424050418968262380,8059305060368373943,262144 --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:8
      4⤵
      PID:920
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3600,i,13424050418968262380,8059305060368373943,262144 --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
      4⤵
      PID:440
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4000,i,13424050418968262380,8059305060368373943,262144 --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version --mojo-platform-channel-handle=3996 /prefetch:1
      4⤵
      PID:4388
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4156,i,13424050418968262380,8059305060368373943,262144 --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:1
      4⤵
      PID:4292
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3556,i,13424050418968262380,8059305060368373943,262144 --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:1
      4⤵
      PID:6088
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3584,i,13424050418968262380,8059305060368373943,262144 --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:1
      4⤵
      PID:3664
- C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_47254\utorrentie.exe
  "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_47254\utorrentie.exe" uTorrent_4992_05BD56F0_1580701984 µTorrent4823DF041B09 uTorrent ce unp
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=utorrentie.exe --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msEnhancedTrackingPreventionEnabled --mojo-named-platform-channel-pipe=4944.6076.17292815002809399500
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3652
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x1a4,0x1a8,0x1ac,0x180,0x1e0,0x7ffc7de3b078,0x7ffc7de3b084,0x7ffc7de3b090
      4⤵
      PID:520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://utorrent.com/prodnews?v=3%2e6%2e0%2e1%2e47254&pv=0.0.0.0.0
  2⤵
  PID:2032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://utorrent.com/prodnews?v=3%2e6%2e0%2e1%2e47254&pv=0.0.0.0.0
    3⤵
    PID:3756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x284,0x7ffc7c2cc188,0x7ffc7c2cc194,0x7ffc7c2cc1a0
      4⤵
      PID:2156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,9065051050867970635,1662317387827902291,524288 --field-trial-handle=2860,i,6842731390817671785,2400051541240953581,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:3
      4⤵
      System Time Discovery
      PID:5136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,3982077336306273118,8324565862249477897,262144 --field-trial-handle=2860,i,6842731390817671785,2400051541240953581,262144 --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:2
      4⤵
      PID:3380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2332,i,11319936050901672919,10723265806952537689,524288 --field-trial-handle=2860,i,6842731390817671785,2400051541240953581,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:8
      4⤵
      PID:5812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3392,i,2330017481041266793,11727409861458688659,2097152 --field-trial-handle=2860,i,6842731390817671785,2400051541240953581,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
      4⤵
      PID:4828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3396,i,17991797963643881718,8517842011640598700,2097152 --field-trial-handle=2860,i,6842731390817671785,2400051541240953581,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
      4⤵
      PID:5568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4908,i,1818181542183147880,8471493509915002141,2097152 --field-trial-handle=2860,i,6842731390817671785,2400051541240953581,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:1
      4⤵
      PID:3300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      PID:2748
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ffc7c2cc188,0x7ffc7c2cc194,0x7ffc7c2cc1a0
        5⤵
        
        PID:3492
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,17031824321240957137,11004661084475892042,524288 --field-trial-handle=2288,i,1962002663190443784,10768511626141750644,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:5320
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,17014235720810902588,4851613665554602239,262144 --field-trial-handle=2288,i,1962002663190443784,10768511626141750644,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
        5⤵
        
        PID:3164
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2520,i,13610022108060164544,2420018601459206562,524288 --field-trial-handle=2288,i,1962002663190443784,10768511626141750644,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:8
        5⤵
        
        PID:4408
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,1890789882753606065,15070097650210979517,524288 --field-trial-handle=2288,i,1962002663190443784,10768511626141750644,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8
        5⤵
        
        PID:2460
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,1890789882753606065,15070097650210979517,524288 --field-trial-handle=2288,i,1962002663190443784,10768511626141750644,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8
        5⤵
        
        PID:572

C:\Users\Admin\AppData\Roaming\uTorrent\uTorrent.exe
"C:\Users\Admin\AppData\Roaming\uTorrent\uTorrent.exe" /MINIMIZED
1⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2412

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3056

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:32

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b00cb2dfc6a083300274d1a98359bde1dac772e4ae02b15318889a5324f85ceb
MD5 d2b8534d6a71163ca233c5a99c4fbad6
SHA1 e518e43c0bcc6686e04d42f2f9d713a52cd5fb48
SHA512 f2ccebe28e336b51c252357450f40ab7fce68e0293d552ae06e3ebf91248c004d11ddbf4533b633d46aaf3f8071f55fe8fb35ddd22ea8ad413d0757b26aae87c
TLSH
T11ED01212BA020634D4102033000261480851C64B410640005428A51F2B044540B03461
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e462756892b2c87e9ecfc8837ab5744b512d48bc3c698441f9945f9dc3dcdab7
MD5 454ddfa23e37f6151ea3229606289974
SHA1 4153d2a676fb29796113afe14589785859842031
SHA512 10d3666895ffaed72fc28006678fcd76a7cb524d1449bc204e49d161d35f047ddd5916429b04c4d58a5c5b55c5120ee28d785672d3c71cafbdbd7b1848a99a94
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Local State
Size 1KB
SHA256 adff826aa23c36b366aa9fb1506bcc758600bc3c595551bdc658cba48c5b2b56
MD5 10c26f60eda745d44a8eabcdc2086414
SHA1 bd3f216fc56eeb7c6cfa13643b40c39a51d31fef
SHA512 86d99d1fd22bb0294a8a9bf97d3ff11227be7f192c7e24e2a87c2f617f06156e77afb34fe06314b877696a071f708526fe7df1ae9630dfd05090b0cf8ab17b51
TLSH
T1CC31877395906F328D96B55063825AAB5F211177D1944F5885DE4B0C02FA5ECA62AC33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Local State
Size 2KB
SHA256 4098a5e9553aa4980254412692e7c536820d8297838b8c38f335802ff891b73c
MD5 f5f9481bd2801dfceae7eed690e6ced3
SHA1 f1545fd6cee5539e0114cddd2333cdf56f667e3a
SHA512 bb4786d197e5672477a8116dde1d4bd4817dbe7a682578ccc695d256dff4a692bbca7c3a4c55d93bf636ac31c97ebdfd307d7dc369788b8bcf40034b38244be2
TLSH
T1DB51A8737914AA7789F7A5547A852F239B355172D2911F9489DD0B0C01EB6EC2302C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Local State
Size 3KB
SHA256 580c67bcf6f8a25e6eec3a77f8d2d648fb8f7d0309ef94af43a51adecdd7f14c
MD5 cf6a2366d501f85c2139093770207dd8
SHA1 1ee3a7c24428358a3d7b60ea99a744cc838fbb7b
SHA512 bba6d75d8d36f717046fa6f89ef0ed29ce22cbee30ec100ba83542ddf3a70115f86fe1ccc4003cf87ea19b7320298c4581678932fe5ba831d024950c21650559
TLSH
T18D7151336964A9374DF7E954B9C62B16A7A55137E1D52FA8C9ED0F0C02EB3E82302C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Local State
Size 16KB
SHA256 fdbbcf8c9e5c6eaf6e2deb7258b66232375f32a7b718f3bcac0005a536f4afa1
MD5 41ad79c5dd85b4db2bcd5f9d38c16c61
SHA1 b93441f6efb64858daddbf08647713c9c8a46fb6
SHA512 bc468025dfc6e61d1c6d08de1ba027b1f9fca4276056cebbe2c4aed7f167b8f6fb085349895a2bd63d4c54545e93bd5bb4d34093d139d9a875801cc15be3cbed
SSDEEP 384:zx+aQikB+z/xvxjg/qhEm3NZBuCMgrW9z9:o/UxvxjgC+mlLrWF9
TLSH
T1D4729E2755687E2395F7F9147A8D0B5BCBB984B290C16FF88AEA5F0D068B3E41302D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Local State
Size 3KB
SHA256 bb3dc6040e29ef1e3b275a21afe8837c624d9b6b14cda585804ebb5e5cffe670
MD5 81bf551ff286489668155d112954ad67
SHA1 21fb9bb1d19a6144e055845e03b61b85ec7cc41b
SHA512 110884a297cd559ad2c660cb762dd6336e7ab0d35cc0b0512f01ae03edfea31daf211038871cdc1cbdf5d7365e447f814d81d1307290d0f753572d7dbfd042e9
TLSH
T1E48161226964A9778DF6E904B9862B17A7A55137D1D53FA8CAED0F0C02EB3E81342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Local State
Size 3KB
SHA256 d49b2a08507f5a7e39969710024cb1f73abe7205e019e1cf98892aceed7f9312
MD5 55be3838c2751aa6891a4529a2d25aa9
SHA1 1c2f260a1897ebcd7898b29e7967652d50479bb0
SHA512 127419f8b02cb083160ea81842633015f958a64fff93f40de64f98dafeb9d184d90ac7c006a072034afe9e1432a631e68c30c4e9bbfe19baae52fac8a1d8d0ee
TLSH
T1577163236964A9374DF7E954B9C62B16A7655133E1D52FA8C9ED0F0C02EB3E82302C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5877ea.TMP

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Local State~RFe5877ea.TMP
Size 1KB
SHA256 5dd4dddeee5a63bd11d3c7f3938e418afad2fa8d406a7126564eb3de22ca4fc7
MD5 edcab534750870ea21b45a6831435591
SHA1 123a7996dfc82ba75e828121d706959e91678751
SHA512 ce4103d42297326094ebdd53370cbe52032f538e47f6136a396f62bc6276c9a2c64565062350677d9536d9f28efb743ef904144b7897e6cf1de58e5e755ca16e
TLSH
T12821627389946A329996A460A3826B9B1F605276D2A44F58C1DE160D03EF5ECA72BC33
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 44e095af7ccad1927602b4b935aae3524939df30218011b877b59c782e6c6106
MD5 3c1bf221dd0438f719ae47a265c3e436
SHA1 b382689171539f473d331bdcef3739b0fa0b1062
SHA512 b7f8bf66ea12f9b37e5f8d1af222c106c1dfa377331d2153d9380edcc3af7381e9c3490378c0b160e05f5c4fd2e1590d5cb8ed07cdeb7b74fb7b38b0e8e1e57f
TLSH
T18ED080333D4D7015E35D5175A463C7153B7648611497DF01F166CA7CD9F61C466C71C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fc69248227d1b80ff41106426895bcd599abcddfbfe7fdbeabc0fcc2aca903ae
MD5 be6741080fa256162cf6b0264133ca7c
SHA1 4914334b0edd1e4c3a470920450bdee63ee2f5b6
SHA512 8d42ac6412ff316aaa68e317e92c2167dbcac331381aec8d8be8410c5bfab4657127a0601dfc90f771660e393667d62af5e917155d6fcc5c7aa6a8ca1e03f903
TLSH
T149D08037394D7015E35D5175A463C7152B664C611497DF01F166CA7CD9B61C462C71C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5edd2c4b8d24850090bda4fef1fb69147b6267e02b7d68ae876b99173b105eab
MD5 c6737596243a92ef6cc55ab247973c8c
SHA1 517a5e82de7a333c9513d48366950766bc0d3cea
SHA512 c216b6ec51f08082e6a2e4bf5f0ce99ff2e53cff5580f5c352d69659a0dd53c4f8c2492c9435e636146605def86ae4a83fbcc978b91cb526e37cd9afc5bb522c
TLSH
T106D0A732295D74A5F22C1179956283042A6948A316939B01F2158D6CD9B50C565C69C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 e883ceedc713c96b6130fcc380f55cb15ab9bc49343d3d5ae0f3ee29c60336be
MD5 f401b4121528b4e57c31e0bdfec52fbc
SHA1 7bb352ca88d643f9d4cbc00d19922d1d140b0f5d
SHA512 d0ee1a8500afc20497b58694e42a07bf7eb7aa2acd6a2d68956b5907dc3f641791aa163cfab59e75e9d400bd417a2ba03d1764845616a7ab7c335177cd6290c3
SSDEEP 384:2dPucx/VorF8uHlhZdDnqrNbNFsaI6eYI1w3nflEN:EXpSrFNFhZdDnqxbNFsarerwXtE
TLSH
T1F913947EB6416D46DAC2273D490F6A71633C8423F6F6030F7F793406932EB5AAA4E161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 5db0666f99d7f32f851348b52a625091f779e27d504868f9e4a92eb07210495c
MD5 b6c5ed78ef752652e64efce3192d8f34
SHA1 a1fd8d2a50174c96104baf54dec91799af376b15
SHA512 0211cb51a66c76230385ca84577dedc44dfa643475d2753e8a94c439c3808c661f1e45d96b2d47c563bc3537b0f48fa0889ac4fd8b8b5110596be5c9abd05fdd
SSDEEP 1536:rk2bcbem0+L/BnYL/luwlcuegLIaogWL/mL/nB/JeyDUp9sPJBZeuEWICUh17:T+L/eL/f9egYVL/mL/vH1nZdECU1
TLSH
T1484461F71951A01BCFA802F5E2033A3DD177055E7DE1E8E9E67C4C852825B32B6BDA84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 3ea9393025778fdaa7893e15fdccadf213ecc3157f32c6bb2007512dcef2e5cd
MD5 53b9026d85a8b1ad6aa6b01c21dd9ffe
SHA1 954a377e6660ecc77bc5c52b810fd234916d6827
SHA512 d76fa1feccc4130de4db122eaed82cb030b61b7ccb2a362da463192c71ce3c1aea2b85af92d077a553aa21653be4bc8511222ae0c3772695c93db479738ff5b9
SSDEEP 6144:PX5vWetmVB58XGD4T4w4x4D4F4e3pVZE1:PX5vxm/5ks4T4w4x4D4F4ybZ6
TLSH
T1D82518EECB682C92CE6B8774B0E0D9077E312183B69DC0D39944C5D897D6B8175E82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 657d8ee18f6931ba5a99b46f2397bcab64ee6f214dbb6fc0d8bc4e7e56b014a8
MD5 2512973c526ea813fb3a90d94c8cbf60
SHA1 dd8b5cb8c78e475e67165a2ca1fe68389ca1bb8f
SHA512 e8ebbf53deb4ef8d39c0437066114005b1c28736da9ae312bacf2a84a5876c061f1e00a78bc7edba7f91fea775739cb7946fdbda34349fa3fe13831c00b9d1aa
SSDEEP 49152:e5YfRh7FHtulBn0NB4ja4vpjbFeEw7YdS:e5m7FY/0NB4ja4vpXa
TLSH
T13E868DEDCA6898C3CD639970B0F0E9477C7423C3F5A5C1D6889CC584026B7C5BBAA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 39f3739b8ea734fd17fb3ba54b10e06f3cc2dd9fb94dbe097f33813f8f1ae99c
MD5 cf1cc8b805a023fe07a564d77564209b
SHA1 036dc34cf1133def9a2a65695940544c2895c83c
SHA512 cfd73fc812db40f384cad72c7fce3cfd90f33848ab9b4dfa52c423fec37c5d75f7fb022a7bf7d24c683373800c88348b69405e4ebbbbe1f180c67b8f65efd45e
TLSH
T18B71832982875451E7600334C3E50F127037449B7CFB8E8DA9976471EE2EB0E95FAEB4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589c89.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589c89.TMP
Size 3KB
SHA256 8085ba293cbd5726fa66294b884f2ae5792b06a065f9868fe504bfae192de6b7
MD5 e2082215e10c21c27cc10001afee7f8b
SHA1 e4ee19553dd3fc20d30f737474483cd5d188837b
SHA512 719ccc042f2c462e2944f46d5bba4d473151a732fc1fd15bb7e009157a82b7b8710246a6b17c1a41e88c42ab52e0bd920526d26025fb85d8ce9f38e50f8fbc5f
TLSH
T1EE61812942834452E7A00374D3E00E52703385ABBDF38E9D99D75476EE2EB0D95FAEB4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 ec5395af4d651fcf6830cf3ed14e9a25aadce424081c4b64c3a0258dcda38a1c
MD5 12b6fc9a56f1422162e3923897dd9347
SHA1 95496c97854956cdb7874b98aaa1a29ad6000419
SHA512 79acf37631f26c37647205fa672aba5ab942cc15bfc3e2ef5261edfa64205e3aaa44ac25c7b5b4afe4bcf6529d570a278f32362cffd02d62742d6409c9fff148
TLSH
T12DE0867404DEC53DD416ADDB936C671CC2D9B48AA6887B061B0A88616111647E7DF7D0
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 5081a4e77bc413a1aaa10ed157b79948098eb874fe1269b87fd90d95eada9bf1
MD5 f851b42483454c348240d25eadcd9f58
SHA1 1a18081e34a093f5a2f1274e483841e5f4dca855
SHA512 9673fa26ffe7dde9b6e6944c06470fae776ec73d241dad42174006bcafe973d5a34534d2250ff18667fdfe555467097a6af70cdf9c4c4de1777632a024028549
SSDEEP 192:zcpO7f+G83uy3Ct7XBBKOxoRH7DXspU3iZ:zcY/83uICtTBBbxa7DXspU3iZ
TLSH
T1E414310E5F743721DE7D417669EA44B39D7DF03F8B5266CA68A10470CEE2752A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 339B
SHA256 3b84a687898b735c772c1d38fa40dfb1a3fa9e0ffc603efad6116718942dbb8e
MD5 0b54c8e08d380fb177b8a18a219e4d35
SHA1 a112f0d15c2b7f40b722521cf95e02878c2ce1fa
SHA512 c7c3611b4e2a7801a829183184d012de0e7a745e7cc14e912ff2ceb155e526da66f5f63dabedf93937e2a69fbf4bed86b0365183719af600859c747a5073b793
TLSH
T1A5E012735910E847F9025CB136506BD4F333D01D9CD1A3F4C58EEC084E819F555C6613
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 425775ce621d717b64841d694d298341f999e75b117b8ca208ede0847b3f5e15
MD5 a5a8d4ef397eed3673343fcb7ac59d11
SHA1 508bfb03f9ce63eefeea13960bdc40af2c773fc4
SHA512 c90182c3d9525fdf5d7e20a8ae418e12d7396324fc4970865e91ad8cc74b665cca88b6f388de8e70d516761113557d58c9a24275d934d01587de85b5d760676c
TLSH
T118E0267488DEC22EA648298BD32C770CC3B5350BE688BE061F099C81B051146E3CA3C2
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 54af7a7a4f1ffc2fd9bed37653b0445a11b37573628c7b8abe78743ea12f1a7c
MD5 69eadd7830d931787a544a9065b76c79
SHA1 79ddf68c736373e88d4b2621d9d17c8c78e09b12
SHA512 c49bc51fac26d14d8332bd066469a52e4faffa340b59bf59ac1740b7de74e289a494b5ef7c612cabaff28e41afbb2795abc30147b67ed2e05989aa64cc0ee3d0
SSDEEP 48:T2SLopFMatSaw/auUOt8BMopwpaUkugAwH:iSeMatUaAKP2aT7AA
TLSH
T181921D4E0F306221D1F48B72FDD585272E7C201DD3737A899E1860F38D9226BF40A1AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 844bcc13b23499eb034b20de13899cc0ffe59e5585157990f69e12ed92aca4ea
MD5 16aecc6001515a0e223f400918b24ad8
SHA1 635ac4b5a11a16c61fc4e54728b862cb516bac5e
SHA512 1eb57ed5db72a109c9516206bd853a1f21b6675fa44ebc6317d78bb8f67f390aef31f5000c4fda241a17d8d297ecb1f502deb992e220a8e61f5e37df843a0449
TLSH
T1A531CEF747B0856E9A1096F0AA18AE2FCE6D0510532C7DEA85E0AE2793E3471E041B5B
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 352B
SHA256 b9f5b90e1f54921b64086049f4e12003a92623a7ac8a1713bae013d8f39c2915
MD5 2a20611f21d4542955f19b943ec0981f
SHA1 4f9162aa95603ce4f49ed6a66902138f25d5d681
SHA512 7228e9b97df3f712499ee98d694ac61c07114daec81078c1c76913de9850c75241759122e731d40223fc1c70c1e9c4da4f4f001ff0b24166f75f3957d289fc37
TLSH
T17FE0205749FFE477107405BD2A86BC406ABDF434212054E2DDD5817CB0D40F75B11436
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 a45bbf4d66a3cb15fe0c04054f85d5cdc31f84312baa77f849ffa87650c43176
MD5 5c7fdf8a3211763be6717f320a5d8c15
SHA1 bdf825e784ef89591085d1690ba4638cd910a95e
SHA512 aa04ece640d81a167f8b9d2a0035680131040371ea51e26507611bc35fcb35ee50d01207a7f132aaf060b53b148cdfc2ad95b0d47e29cb91545618b838f251a1
SSDEEP 192:sxZaRnyMqZjK1Ml8zj3/fXs8WpV1DYZZyb5Hzodp1PHW6+WNOqGk/lvlMu1TKIg1:sxZa8a3/fXs8Wv1DmZo5M9Hbf/1oZtB
TLSH
T17572D8066934597BDCDBD619FA857F63D7FC156292905E449AFCCA1C00EBAEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 ed4ddcf1fe767364ac254651d2cc73e62162773a2cdbbad543f0edd671655723
MD5 574f76b2b59043b2f127bedf556cd824
SHA1 796137c33261cab374365867a183f6b9b6da176c
SHA512 b0d5c40387a1ca3e3084fe8de6be8225210095ef10f24a213f3337bcb5f32f7f32d225975a5a49d3ab58e7e8e99e3048a810ddd890d357972bc7a896eba7f344
SSDEEP 768:P4E/ael7pLuLnC6WvCuFO8F1+UoAYDCx9Tuqh0VfUC9xbog/OVa6yVLlFX6BaroI:P4E/aezEnC6WvCuFOu1ja76yVLfqBRVe
TLSH
T192F20B3B2C0CCB7E4F844E9CEC2A7E9A6DE801CB5698899447F9841C03CA7EF51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 ba5970c211f73c63c06d4bcb887d2c943897108ba13eeebb6bb891b3f0bbb9fd
MD5 84fcd42eae0ec266719586a076e2f1d4
SHA1 74b6e4a9a992d7c4a0f31d646b69d7be33c3a521
SHA512 55bc24571f13ea3648377fffe82873fad111d6ad13351c32d17be24d22bc89fe7b619b24101660583c49da83e95ecb8a38235b5a1208f5843f2535185de1f087
TLSH
T106E026A406CAC17DA12574C3072CA32C82E8740BD3C83D072F01C8706182906F3DA3C3
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 612b9610765d9d09649b6f8d6bce6bc1926710bdb9261377373a1c072e2b348b
MD5 27623acfc7379cf2f6d39ddb126f7dbb
SHA1 8ccf17fb1f5fe51ef5dbb9d7f0ad0f809f03951b
SHA512 0aa3856036af764cedee7212a349078c4ce876ab815ea30cb2ee464d28bdb620249e44653f093a984824230e6742b1aba82999f095451da711bbb0b1b975bcaf
TLSH
T1FEE0D83015CAC62EB55635C7532CE30C81A67446D7CD6D152B09D9406206941B387381
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 320B
SHA256 27de41568ffc30bce919a586adea9e49a52929c43ce428d9ad92ea82a9b614c2
MD5 bff090c1ebeef6641b0a87978372e539
SHA1 91ed08360b04b21f885d66324929fd584fa8614c
SHA512 1ea904e80e57fba909cffe4ed4defaa9b5409a4e64a62b218c2631209b8061a66b5a891d1c792bb0d8cd6287d334b1ed5c793f168c286f5af00f3efa551d44e9
TLSH
T117E0867045DAC73DB80474C743ADA71DC2F8784A97C87E4A57088490A90194AF3FA7D0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 25KB
SHA256 5a961e4bc9b7b847569a5ca3c4ffdb71796c7073dd96f36de799af76fefe7073
MD5 fe7cb2246541567ff467e2c69b63661e
SHA1 f4e3476b05737cfb1d45200a39b3f9c0efebcb7e
SHA512 3ef9f4776f87da8ea16a00155a12590d2196f0e78ac49f82b65714aa25964004e5512fa045315a1d9a537b9544004fb1025891dc9ea35267e49cfc22914fb7ab
SSDEEP 192:OotE42aG3iLEAs1AOvQA7uItfg1MhlfznKzO5tZBBHaFlufF5XYP7cNBv3dR5LAp:8ptDYDcfvNR1ANAJ5PyjV
TLSH
T131C27916717B065638BF290CA69399379E4231A33418E4BF7BB814A20F67E125DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 f02de6f2f7e902a74d2e69483d76da117060849dd47c9fa282fdc8d15cc16464
MD5 66184a23cdd08b59db255e5c63dcb8fe
SHA1 2c851cd77977b57632f78cf63f4b3ed63ff10ba5
SHA512 3eb9e8a03f29a3d4a90984ceea6cbc98edfdac9d84199b0fcdaa7cf7628f743ef120351d846b30098f8b4cec118430ff301b0d42316a702916f439b379328d1b
SSDEEP 384:mxcw6w6wPfQ9QQn7IMW1hPJuVd6vPkxW:m29zn7zAhUVd6vP+W
TLSH
T1C224630A7B747001EDE6D9725CB080771E3CB16DCF22A6915DB254698EB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 10KB
SHA256 bf0531a5ce5e01f173292cd2e5199cc6d47ff761ab98288f402c341c92854f41
MD5 63fdda9ce5b0ccb876e3a9f847d02223
SHA1 786337dd0461476275033d78141a5f55e863f5bf
SHA512 2d623c3243c5886300ece3f94010cfc8b2bf6245a717c4801051573cf099befa5e14556ad6a6eebb82148769931680cf5a757f7431dafe974c053752531e1a45
SSDEEP 96:u89+FvgxZCcQgOXCZeDWXWY1lD8seCjAWV7l8++sWWVEx/23wl5N:k2OEZAs7l8++rsEx/2Al
TLSH
T1F1221F686B221B3BD00D9EBF52798FA117E2C0C34276676E756108DD2DD263787C82F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 db27b29544c7be0abce416cd094ed8c0db86f95482c8f8fcc584712ec59b5c10
MD5 782a3a63cbbf6efbd43f24f3cdefe3b7
SHA1 84f700b5c33b7287fbb2eea2bb500cc7b3beb687
SHA512 ee3c48f25d060587deb49b5fa50b1a3d8f494d7792b0517cc5746be6590586904434296a9e5d7c75529a917e7070a2fc945275d3df8acc8d06b41434a6ee7a19
TLSH
T14CE02630A8CFC16FE4143CCB132C570CC388380BEA88A90A2F01C494A012102F3CB7C1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 0cf182269a1bb5580c6d3505f7e53632a025035f09fea3fb38a175c572843cf7
MD5 bb7a2cd87bc21cfe3e1545737b37d584
SHA1 0ab0d6c823de0b23c7e195e5a4281a22eb54f30b
SHA512 2d166bff5c5aef5ed28f91b7daf8f99fb288bce803c453ff314f1e71a9778960996fd2ca19b45313da5ae890a3e50f32a3050b179b450e0648cba02fc7bf66e0
TLSH
T191215A45F325C108E28E967DA02B97351338E8068FFCED1F857820352E76A540E8BBF5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 334B
SHA256 caf5b3b3b168cb5b405df01e61cbedb4f5f3c8df67b41c118c85b5b049dab394
MD5 6fbe1f55ec11b7a46a626a30107bfdcc
SHA1 2f2226c26d36915508b414a3bb6e6faf2afbd703
SHA512 c54753527e95141727e8ab1b31ef3fd364fee4aae47c539b93c6c42e55df34b5b8d7c98592c0dd665dcdbdf8e8e2be64fe984ae14bdecce4b7c9f5e5e7298f90
TLSH
T16BE02630A8CAC1AFD01038C7036CA348C399380BEA882E0A2F06CCB4A502243F3CE3C1
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 3cdf263278d10e97246e24f6e244452837c2a86a58315ad72714c459ce962baf
MD5 56b5920cfcbfbfbe86db4295c38ba383
SHA1 fafe81bfc0471d0cd0b4ff342956a10f572efa4f
SHA512 843b8d03006486b396ca9464b529f4d70d1613a3e00507967ba18aeb3851615ecbf0f14d16caf8561d7b549f0b8c898ba3e0649dc486c322378977b32672626a
SSDEEP 3:MsEllllkEthXllkl2zEflS+X:/M/xT02zle
TLSH
T1EE4404447FC04405C5001034C051C7D03370D4105FD1575734D104375CDF5400C00540
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 25e39c0eb2981d0b904b10b142225790be5f1ffba6afbbfe75e557c3fb417312
MD5 574b96c465189081389f0a8019776999
SHA1 e1b2acdf881fd94807738545742ff1d652afba9d
SHA512 dcf36c3a8f76b89ed08aa62ec9f33f8ffd7f9dbd5333eda49c04f6dcbddff3b2bed8fc19a1a065b9ae88e7c0134d5db28d35601b6023231cefd20bd4e4445a22
SSDEEP 384:nLiFKCcmyWCSsNa8TUNTUlI4kWDcYEBnJ4fOGHZwidYWJXKITrBxcrECq47fu5Vq:mFhcpSxwgSM1GvhvBYECq47fu3q
TLSH
T1E8D22839DC94DDBF98AE7B88A38E29129DE44137C6B885D4EBC80F0D907709CE74B815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 14943c8db1c2f0c8f8c6acbfa9d3a11d433d98dd5ec5ac1023d4bf97fbd58749
MD5 a0a30f96dd89e5b54a8a5385b791a916
SHA1 f7be61b35efdea1cc8c3ca452f19aa429426f8ca
SHA512 a925d9d07ac6fb7f76d3e7d4837e037602d4bb861e89268ff8a31e0282969c3077859d419151abb33fe6b6c67299b0ac5f483e8735f4f421428eec06a41c0126
SSDEEP 384:n/iF9CcmyWCs3sN28TUNTUlImkrDcYh59J4fOGHZwidYWEDwLaJCra5eTgHy/7II:KFccps3RwgxlXGvEDwLaArXl
TLSH
T1C7B26B31DCA8CABBEDE75FD9E34A3A57DEE0016786985AD0EAD91D0D00C71DD034B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 88b9e2fa9b12efab30289ad1e3f7fa42ede87182eeed88f569d6b99902638c11
MD5 8690eeeb4fc1f851aa6811c143fb564f
SHA1 623ea83b324c36ce59889b8593810a7e8876aba3
SHA512 b9127fa8134a242cfc437b794d0c870afae4294f6077169a2ca520eabd454429eaa2166cbcd682caf5b3983e2a4d7465e2fe6438932a4771ff40360565014cf0
SSDEEP 384:nZiF9CcmyWCs3sN28TUNTUlImkrDcYyXUJ4fOGHZwidYWJXKITrEvwLaJCra5eT5:wFccps3Bwgx+YGvhvEvwLaArXl
TLSH
T1BDC24A32D898CABBEDE75BD5E35A3647DEE04163868C9AD0DAD91D0D01CB1ED034BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 990de3daccf51b4ec943915c5ff72e34b842c2f6574fd4065e5750e9314c1e36
MD5 c88b0ea065d96011fee24f32024ced5f
SHA1 d1636ab02924691788a92c376044cbd8fb7d75a3
SHA512 3f6ebc90d43802606ec33780a3994179e4c6a9bc7a7ed9925455ae4e4bd0bb61c3de772b1dc7aa0246691cd5a1d0e143b6cfd7ba8aef8b205bfe6ba89784f54c
SSDEEP 384:nLiFKCcmyWCSsNa8TUNTUlI4kWDcYEynJ4fOGHZwidYWJXKITrBxcrECq47fu5Vq:mFhcpSxwgSH1GvhvBYECq47fu3q
TLSH
T1B1D22839DC94DDBF98AE7B88638E29129DE44137C6B885D4EBC80F0D917709CE74B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 bd987f213d50a3134ebdec5a6ed79da536122d2fd00610c8f8cb0bd5339d6379
MD5 be22091fd908885dbdef33ee61b67930
SHA1 96fe227e8097c69a6161dd31861c6b47d748c830
SHA512 71fdcf51c67f6a1e2b3af8c5ae6cd88443ba1ce202ba57c3a688b0ec4199c795d6ef3a2bfc8eb1533e26776b1d0a419b68ad32893c89c0235577b30184e19be7
SSDEEP 3:MsEllllkEthXllkl2zEflgg1:/M/xT02zM
TLSH
T1094404057FC00405CD0010314051D3503370DC105751574334D134335CCF5400D004C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 43c1b3c27bcc9768b8b469d0f850bb464f1bdafe01261ff5e0181d742eb98310
MD5 446bb6111751bcabb3b71e9d664091c5
SHA1 225d298535dea10f8993a7bb7ca7d06e56b7364b
SHA512 94382cffe749ad1d44edd1cb9a7c83d77bcab95714d3a30e28041d5584dca4a7197d1292d8d6669396d55ecaf1c0992270605c567298dc1e31786ef2c384a022
TLSH
T18241285DB6E91108B3B36E9AABF7B86E487FB8772E06D05E10110D4F0A22B40D871737
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 ab8b3303b243e23832269c99555d4fdd62ae98ff58a333e794e829cecf220ab2
MD5 cd5b70ac06fc22c2a5acfdeea71a2d4d
SHA1 4cbb522743889b644197af5689fdde13224c6f9c
SHA512 30e03c282174ac3a0e825f5f104e9f87142ad8ac0591991ae614fc255ca4038038b0c0a0525234b20c41acaa0d8c96b39429908b8ee9e2d9cb38017043f2e66d
TLSH
T1A8515E5866E91108F3B77F5A9FF6752E887BB9771E06C05E00110E4F0A33A01C961737
MD5 SHA1 SHA512 TLSH

Submit Download

1f91d2d17ea675d4c2c3192e241743f9_e2ece6a9-57d5-45dc-93b3-c9f913219352

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4045429996-2364296335-1634900306-1000\1f91d2d17ea675d4c2c3192e241743f9_e2ece6a9-57d5-45dc-93b3-c9f913219352
Size 1KB
SHA256 aa9b044394fb0d03cbadcd5421a03c101d18511993a8b16b7dbdd09b8ba94338
MD5 9e75a1c5dbfa2b581f34e9b04c1ec84e
SHA1 a35a75a4bd46f2fcc95c77968de672a86fd4acd8
SHA512 d302ede0674085bc6ed6c2992721b336c21b1a1c166903b6dbe29b6b14db7badc992a6d03627343433621e33b83fd9e8ed6ab0a1c49904c859fe161cda30830a
TLSH
T1C331E69AE3AB3951ECEE42F55507DB3846E0790C7373833A76C421FA40725B02238BE2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\uTorrent\settings.dat
Size 8KB
SHA256 d33052b8175509ba2f93db470d5f6e0f4a17da792033e0d0ad52ff680f0eda70
MD5 d7810462630d7953c1278cbbbfd960bd
SHA1 77ca6aa74b80dfbc49be582779b9573770557455
SHA512 c973668906ced75e3f5ae82bcd673f7acdb718c8c0755305913ce26f148bd94dc23dd7e7071de28462f7c55c412624db20e1afd414657231255015243aa38bb6
SSDEEP 96:Em/PbM4T09J3elflTlt8Aa0L0aJnhIE50e/gBWJ47XJ:Em3bM4T09FevENHSICYQJ4N
TLSH
T12E02E922DCFFC4F0D8AB543787B64016777A6A40D5B9EA11A0E909F8250256F09FBF23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\uTorrent\settings.dat
Size 8KB
SHA256 8677b6aea44f1f55b9552f8aa17bbf5979f66d3cf4edfeda15544da835b013be
MD5 e5ac9a2c7fb71dc9fbe0bd971d8855b4
SHA1 7a805a5d8759289aa173f334f20d8d96c1237f4c
SHA512 7ff573e5d2751fa80cfc414fbc23cb7d3344f0a5c9c0ada2b39d381ad57e448a2044a6e60590cba7dc4c76460a756c4804c83d7cc6d5dbac1fcb9a76db3e2504
SSDEEP 96:Yx/PbMBT09J3elflTlt8AapL0aJnhIE50e/gBWJ47XJ:Yx3bMBT09FevENaSICYQJ4N
TLSH
T1EB02DA22DCFFC4B0D8AF543787B64012767A5A40D5B9EA11A0ED49F4250255F09FBF13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat.old

Path C:\Users\Admin\AppData\Roaming\uTorrent\settings.dat.old
Size 7KB
SHA256 9f5f03908c4410766dc4c550be74d1883cb111ee859385c06053834dd8d97881
MD5 469bf9333ece57a442c80cdfdcbabbf0
SHA1 a6fea8a17257626c79078e6c5dab1605dd530d45
SHA512 13b5b8bfb26fc1c37940e3862825c8fc311b91b883077ec26a6463ebe1a3fc36b7f6390ce3476bca1062e8228ff3a90daa0fd1e9abf85a034c1adc26140f90ad
SSDEEP 96:YX/PbMET09J6jlflTlt8Aa0L0aJnhIE50e/gBWJ476J:YX3bMET090jvENHSICYQJ4o
TLSH
T166F1E9229CFFD4F0D89F903787B54012727A6E40D5F9EA12A0A909F4250256F09FBB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat.old

Path C:\Users\Admin\AppData\Roaming\uTorrent\settings.dat.old
Size 8KB
SHA256 0263fd173d0eff205af8936119898433377aab7b057a9598e1a3ae6a2b721e37
MD5 d92e0034ec95c49ffe0726d034548c5a
SHA1 fe28f532257eb26e1690a878e6df53b08a267f06
SHA512 b927aed6fbdd67ff95db55819f3d4334fddb9580bb40074c2fb8eaa7a81e0b78f610ae846012bd7ac815cc8a21417a3df4c924a167532a6fd1caf27909e9f344
SSDEEP 96:rvz/PbMET09J6jlflTlt8Aa0L0aJnhIE50e/gBWJ47mJ:f3bMET090jvENHSICYQJ4E
TLSH
T13402E922DCFFC4B4D89B543687B64016777A6E40D5F9EA12A0A909F8250256F09FBF22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

toolbar.benc

Path C:\Users\Admin\AppData\Roaming\uTorrent\toolbar.benc
Size 170B
SHA256 846fe3953f1ce30bec03005b17c594e24633bda99eb4b1b3541c89258a2ef9f0
MD5 ea90bd10002f4269c6f44c30099793c5
SHA1 dbdc2efd9873b0decbcf705273aa5ddb1de40dac
SHA512 2e202586996f16e47e9988e84e8565d03d85cc7b2cc6bd2f7e9b9256bc1625b1ea98b3238e8f046401937e340cc4b82540d9e401546f2c44a82cc3cb795c7d1a
TLSH
T14CC0801495F65554173B4C5370D8687F6681511A55D7B6048D061A598CE505D07F4065
MD5 SHA1 SHA512 TLSH

Submit Download

uTorrent.exe

Path C:\Users\Admin\AppData\Roaming\uTorrent\uTorrent.exe
Size 3.5MB
SHA256 285127f8530fcdb0166cf37c97e60a13ecff7d57d3f0066e7cec0e89188e9ae2
MD5 657775f666c15e8ac34687e994dba93c
SHA1 7462a199219a13700b48b3bfb094dcb6273d29cf
SHA512 a8ac6aa8ec3453c7d098b42f4b163ae8fe04c335213a9dd7ed39be76758064064b71d4d0dc1573c575f2a3d7df6a62cbf22323220dddfbd2d74220580375065f
SSDEEP 98304:O12+yYUKanBkVVZHvXzSoInsqsCBVCpTLNMYuA4FGPsI:O1BU5nC1bS1dspTBuNy
TLSH
T179063392DE312E84E0FE52F514694AA84121EE4A7D5C1F334231763D5F360C2EABADE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updates.dat

Path C:\Users\Admin\AppData\Roaming\uTorrent\updates.dat
Size 344B
SHA256 d868703984c4e15f72c0e87ba6207b9563787c1885be1198d5c9c75b1b40638e
MD5 aef3f75c27a2bbf3b121967c496f2054
SHA1 6a834edec06448b9b789518dee4576dd3df8d5c3
SHA512 d56dda8904f3feb2974a2faea573cad18c4ff353f545b3f9dbfd0cef9d3b2cbbc6d25b1155cb1560d0f884beacd91ccf52fb17dcac0695259e29d69c275e577a
TLSH
T17EE0C6A001B9C22E3831C38A8BBA24FA9371B8C286A0A7748086098CAC804344AE2E14
MD5 SHA1 SHA512 TLSH

Submit Download

utorrentie.exe

Path C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_47254\utorrentie.exe
Size 692KB
SHA256 1a23079b7a9d7aa8f77a2f957ed02486c925699587b177a07b56868e1d18e6e2
MD5 32fe851f520eacf7642a6a2a0b634e7f
SHA1 0f27f6ea1c4c3a8ddb7eed83ba69d1af9fe34ea0
SHA512 e6704afd4df40e9f23823bb21a5191cb352bcf3d465422654473d182e6446832d1922db3a6e0a007d9bcd334a172bd121bc8b7ed23a961edf438ee2f54e418be
SSDEEP 12288:NLRfW/m2IJBo/HNkE2siMnP8TL36GdlOS+VqdZZqlNxEUjIrOvQqjehp7z1U5bN3:NLRW/m2IJBo/HNkE2siMnP8TL36GzHd+
TLSH
T10EE47D213581C036D97110711E68AFB592AEFD375F7209CBB7C05B2E5A252E22F31A7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/440-196-0x00007FFC9B5D0000-0x00007FFC9B5D1000-memory.dmp

Download

memory/440-346-0x000002C602000000-0x000002C6020CD000-memory.dmp

Download

memory/648-589-0x00000202BA330000-0x00000202BA3FD000-memory.dmp

Download

memory/648-96-0x00007FFC9B5D0000-0x00007FFC9B5D1000-memory.dmp

Download

memory/920-187-0x00007FFC9B180000-0x00007FFC9B181000-memory.dmp

Download

memory/920-186-0x00007FFC9B0E0000-0x00007FFC9B0E1000-memory.dmp

Download

memory/2412-72-0x0000000000400000-0x0000000000D17000-memory.dmp

Download

memory/3148-560-0x0000000000400000-0x0000000000D17000-memory.dmp

Download

memory/3148-0-0x0000000000400000-0x0000000000D17000-memory.dmp

Download

memory/3148-81-0x0000000000400000-0x0000000000D17000-memory.dmp

Download

memory/3148-37-0x0000000000400000-0x0000000000D17000-memory.dmp

Download

memory/3148-24-0x0000000000400000-0x0000000000D17000-memory.dmp

Download

memory/3148-23-0x0000000000400000-0x0000000000D17000-memory.dmp

Download

memory/4292-591-0x000001EE86000000-0x000001EE860CD000-memory.dmp

Download

memory/4388-590-0x000002913CAD0000-0x000002913CB9D000-memory.dmp

Download

memory/4992-388-0x0000000000400000-0x0000000000D17000-memory.dmp

Download

memory/4992-387-0x0000000000400000-0x0000000000D17000-memory.dmp

Download

memory/4992-45-0x0000000000400000-0x0000000000D17000-memory.dmp

Download

memory/6088-393-0x000001C529E00000-0x000001C529ECD000-memory.dmp

Download