053d55e3059c9829fc7ea175b6f69bec8cddfcd733f7d678d769862398e5e6b1

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 07:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Size 6.0MB
Sample260925-h784wasepd
SHA256 053d55e3059c9829fc7ea175b6f69bec8cddfcd733f7d678d769862398e5e6b1
MD5 7084773cb512ec2d4a064c66d685be95
SHA1 aa8ec52c9be8e72a8968209add6ac5ca1b0bf5e0
SHA512 43d80dc855ed62d5f008fac1c500e655016d609b37b0254b55cd9c48aa393103d712a6bd94d65fa12507fc8e7096b5f68fcfcd7589f64ea4fa30dd62e6e1e467
SSDEEP 196608:UgJchjqymNVwBhLrk3rDflf4XTP6iI5dCGioynrZ:1c1q1MLrk3rDflf4XTP6iI5dCGioyn
TLSH
T19656BF12BA85C079D3E20070092B5B5262BBED745B314EE7B3847A6E7A74DD2453FB23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

adware defense_evasion discovery spyware trojan upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 6 IoCs

resource	yara_rule
behavioral1/memory/4360-0-0x0000000000400000-0x0000000000A4A000-memory.dmp	UPX
behavioral1/memory/4360-22-0x0000000000400000-0x0000000000A4A000-memory.dmp	UPX
behavioral1/files/0x000a0000000246fb-33.dat	UPX
behavioral1/memory/3668-35-0x0000000000400000-0x0000000000A4A000-memory.dmp	UPX
behavioral1/memory/4360-34-0x0000000000400000-0x0000000000A4A000-memory.dmp	UPX
behavioral1/memory/3668-387-0x0000000000400000-0x0000000000A4A000-memory.dmp	UPX

Downloads MZ/PE file 2 IoCs

flow	pid	Process
164	3668	uTorrent.exe
165	3668	uTorrent.exe

Executes dropped EXE 3 IoCs

pid	Process
3668	uTorrent.exe
4088	utorrentie.exe
6040	utorrentie.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Wine	uTorrent.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Key opened	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Wine	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	uTorrent.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	utorrentie.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	utorrentie.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4360-0-0x0000000000400000-0x0000000000A4A000-memory.dmp	upx
behavioral1/memory/4360-22-0x0000000000400000-0x0000000000A4A000-memory.dmp	upx
behavioral1/files/0x000a0000000246fb-33.dat	upx
behavioral1/memory/3668-35-0x0000000000400000-0x0000000000A4A000-memory.dmp	upx
behavioral1/memory/4360-34-0x0000000000400000-0x0000000000A4A000-memory.dmp	upx
behavioral1/memory/3668-387-0x0000000000400000-0x0000000000A4A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1730821725\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-el.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1730821725\protocols.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-as.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-be.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-es.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1730821725\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-da.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-af.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5492_748643140\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5492_1625408867\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-te.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-et.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-la.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5492_1625408867\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5492_748643140\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5492_748643140\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-it.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-or.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5492_748643140\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-bg.hyb	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	utorrentie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	utorrentie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uTorrent.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
736	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	uTorrent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	uTorrent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	uTorrent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	uTorrent.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CROSS_DOMAIN_REDIRECT_MITIGATION\utorrentie.exe = "0"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	uTorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\utorrentie.exe = "11000"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION	uTorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION\utorrentie.exe = "1"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CROSS_DOMAIN_REDIRECT_MITIGATION	uTorrent.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134347946888666515"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\uTorrent\Content Type\ = "application/x-bittorrent"	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Applications\uTorrent.exe	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\bittorrent\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe\" \"%1\" /SHELLASSOC"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\FalconBetaAccount	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\uTorrent\shell\open	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-appinst\Extension = ".btinstall"	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.btkey\ = "uTorrent"	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.btkey\Content Type = "application/x-bittorrent-key"	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Applications\uTorrent.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe\" \"%1\" /SHELLASSOC"	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\uTorrent\DefaultIcon	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\uTorrent\shell	uTorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-app	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-skin\Extension = ".btskin"	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\uTorrent\Content Type	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.btsearch	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Magnet\DefaultIcon	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\bittorrent	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\bittorrent\shell\open\command	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\bittorrent\shell\open	uTorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml\Extension = ".btsearch"	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\bittorrent\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\maindoc.ico"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\FalconBetaAccount\remote_access_client_id = "9767409389"	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.btapp\Content Type = "application/x-bittorrent-app"	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.btsearch\OpenWithProgids\uTorrent	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.torrent\Content Type = "application/x-bittorrent"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\bittorrent\DefaultIcon	uTorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-app\Extension = ".btapp"	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.torrent	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Magnet\shell\open\command	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Magnet\shell	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Magnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe\" \"%1\" /SHELLASSOC"	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Magnet\shell\ = "open"	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\uTorrent\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\maindoc.ico"	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-appinst	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.torrent\ = "uTorrent"	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\uTorrent\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\maindoc.ico"	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\bittorrent\shell\ = "open"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.btskin	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-skin	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.btsearch\OpenWithProgids	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\uTorrent\shell\ = "open"	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\uTorrent\Content Type	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-appinst\Extension = ".btinstall"	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-key\Extension = ".btkey"	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\MIME\Database\Content Type\application/x-bittorrent\Extension = ".torrent"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Applications\uTorrent.exe\shell	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Applications	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml\Extension = ".btsearch"	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\uTorrent\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe\" \"%1\" /SHELLASSOC"	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.btkey	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Applications\uTorrent.exe\shell\ = "open"	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Applications\uTorrent.exe\shell\open	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.btsearch\ = "uTorrent"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\bittorrent\shell	uTorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-app\Extension = ".btapp"	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\uTorrent\shell	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-skin\Extension = ".btskin"	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-key	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.btsearch\OpenWithProgids	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.btsearch	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\uTorrent\shell\ = "open"	uTorrent.exe

Modifies system certificate store 2 TTPs 8 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	uTorrent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e75490f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e4190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	uTorrent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c000000010000000400000000100000190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e199604000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	uTorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	uTorrent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	uTorrent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	uTorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4	uTorrent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	uTorrent.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4360	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
4360	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
3668	uTorrent.exe
3668	uTorrent.exe
3668	uTorrent.exe
3668	uTorrent.exe
3668	uTorrent.exe
3668	uTorrent.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3668	uTorrent.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2540	msedgewebview2.exe
2540	msedgewebview2.exe
2540	msedgewebview2.exe
5492	msedge.exe
5492	msedge.exe
2540	msedgewebview2.exe
5492	msedge.exe
2540	msedgewebview2.exe
2540	msedgewebview2.exe
5492	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	4360	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Token: SeManageVolumePrivilege	3668	uTorrent.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3668	uTorrent.exe
3668	uTorrent.exe
3668	uTorrent.exe
5492	msedge.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3668	uTorrent.exe
3668	uTorrent.exe
3668	uTorrent.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 3668	4360	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe	103
PID 3668 wrote to memory of 4088	3668	uTorrent.exe	106
PID 3668 wrote to memory of 6040	3668	uTorrent.exe	107
PID 6040 wrote to memory of 2540	6040	utorrentie.exe	108
PID 4088 wrote to memory of 1760	4088	utorrentie.exe	109
PID 1760 wrote to memory of 1972	1760	msedgewebview2.exe	111
PID 2540 wrote to memory of 1492	2540	msedgewebview2.exe	112
PID 2540 wrote to memory of 4216	2540	msedgewebview2.exe	113
PID 2540 wrote to memory of 4216	2540	msedgewebview2.exe	113
PID 2540 wrote to memory of 4216	2540	msedgewebview2.exe	113
PID 2540 wrote to memory of 4296	2540	msedgewebview2.exe	114
PID 2540 wrote to memory of 5160	2540	msedgewebview2.exe	115
PID 2540 wrote to memory of 5160	2540	msedgewebview2.exe	115
PID 2540 wrote to memory of 5872	2540	msedgewebview2.exe	116
PID 2540 wrote to memory of 5872	2540	msedgewebview2.exe	116
PID 2540 wrote to memory of 5872	2540	msedgewebview2.exe	116
PID 2540 wrote to memory of 4292	2540	msedgewebview2.exe	117
PID 2540 wrote to memory of 4292	2540	msedgewebview2.exe	117
PID 2540 wrote to memory of 4292	2540	msedgewebview2.exe	117
PID 3668 wrote to memory of 5492	3668	uTorrent.exe	118
PID 5492 wrote to memory of 1076	5492	msedge.exe	119
PID 2540 wrote to memory of 968	2540	msedgewebview2.exe	120
PID 2540 wrote to memory of 968	2540	msedgewebview2.exe	120
PID 2540 wrote to memory of 968	2540	msedgewebview2.exe	120
PID 5492 wrote to memory of 736	5492	msedge.exe	122
PID 5492 wrote to memory of 5248	5492	msedge.exe	123
PID 5492 wrote to memory of 4380	5492	msedge.exe	124
PID 5492 wrote to memory of 5248	5492	msedge.exe	123
PID 5492 wrote to memory of 5248	5492	msedge.exe	123
PID 5492 wrote to memory of 4380	5492	msedge.exe	124
PID 5492 wrote to memory of 5224	5492	msedge.exe	125
PID 5492 wrote to memory of 5224	5492	msedge.exe	125
PID 5492 wrote to memory of 5224	5492	msedge.exe	125
PID 5492 wrote to memory of 6048	5492	msedge.exe	126
PID 5492 wrote to memory of 6048	5492	msedge.exe	126
PID 5492 wrote to memory of 6048	5492	msedge.exe	126
PID 2540 wrote to memory of 4848	2540	msedgewebview2.exe	127
PID 2540 wrote to memory of 4848	2540	msedgewebview2.exe	127
PID 2540 wrote to memory of 4848	2540	msedgewebview2.exe	127
PID 5492 wrote to memory of 4128	5492	msedge.exe	131
PID 5492 wrote to memory of 4128	5492	msedge.exe	131
PID 5492 wrote to memory of 4128	5492	msedge.exe	131
PID 2540 wrote to memory of 4508	2540	msedgewebview2.exe	132
PID 2540 wrote to memory of 4508	2540	msedgewebview2.exe	132
PID 2540 wrote to memory of 4508	2540	msedgewebview2.exe	132
PID 5492 wrote to memory of 1600	5492	msedge.exe	133
PID 5492 wrote to memory of 1112	5492	msedge.exe	134
PID 5492 wrote to memory of 1600	5492	msedge.exe	133
PID 5492 wrote to memory of 1112	5492	msedge.exe	134
PID 5492 wrote to memory of 4028	5492	msedge.exe	136
PID 2540 wrote to memory of 5296	2540	msedgewebview2.exe	140
PID 2540 wrote to memory of 5296	2540	msedgewebview2.exe	140
PID 2540 wrote to memory of 5296	2540	msedgewebview2.exe	140
PID 5492 wrote to memory of 5204	5492	msedge.exe	144
PID 5492 wrote to memory of 2604	5492	msedge.exe	145
PID 5492 wrote to memory of 4376	5492	msedge.exe	146
PID 5492 wrote to memory of 4460	5492	msedge.exe	148
PID 5492 wrote to memory of 4460	5492	msedge.exe	148
PID 5492 wrote to memory of 2272	5492	msedge.exe	151
PID 5492 wrote to memory of 2272	5492	msedge.exe	151
PID 5492 wrote to memory of 5208	5492	msedge.exe	152
PID 5492 wrote to memory of 5208	5492	msedge.exe	152
PID 2540 wrote to memory of 5648	2540	msedgewebview2.exe	153
PID 2540 wrote to memory of 5648	2540	msedgewebview2.exe	153

C:\Users\Admin\AppData\Local\Temp\2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe"
1⤵
- Identifies Wine through registry keys
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Users\Admin\AppData\Roaming\uTorrent\uTorrent.exe
  uTorrent.exe /NOINSTALL /BRINGTOFRONT
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - System Location Discovery: System Language Discovery
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3668
- - C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_46538\utorrentie.exe
    "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_46538\utorrentie.exe" uTorrent_3668_00F20370_344207698 µTorrent4823DF041B09 uTorrent ce unp
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4088
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=utorrentie.exe --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msEnhancedTrackingPreventionEnabled --mojo-named-platform-channel-pipe=4088.4904.13092905574221191381
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1760
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x198,0x7ffca43cb078,0x7ffca43cb084,0x7ffca43cb090
        5⤵
        
        PID:1972
- - C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_46538\utorrentie.exe
    "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_46538\utorrentie.exe" uTorrent_3668_03E86F58_1869661197 µTorrent4823DF041B09 uTorrent ce unp
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6040
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=utorrentie.exe --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msEnhancedTrackingPreventionEnabled --mojo-named-platform-channel-pipe=6040.1664.6859505247676690653
      4⤵
      Drops file in Program Files directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:2540
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x194,0x7ffca43cb078,0x7ffca43cb084,0x7ffca43cb090
        5⤵
        
        PID:1492
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1784,i,2780827374518721073,227413436840459617,262144 --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version --mojo-platform-channel-handle=1764 /prefetch:2
        5⤵
        
        PID:4216
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2012,i,2780827374518721073,227413436840459617,262144 --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:3
        5⤵
        
        PID:4296
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1692,i,2780827374518721073,227413436840459617,262144 --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:8
        5⤵
        
        PID:5160
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3460,i,2780827374518721073,227413436840459617,262144 --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
        5⤵
        
        PID:5872
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3848,i,2780827374518721073,227413436840459617,262144 --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:1
        5⤵
        
        PID:4292
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3676,i,2780827374518721073,227413436840459617,262144 --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
        5⤵
        
        PID:968
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4468,i,2780827374518721073,227413436840459617,262144 --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
        5⤵
        
        PID:4848
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4796,i,2780827374518721073,227413436840459617,262144 --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:1
        5⤵
        
        PID:4508
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3864,i,2780827374518721073,227413436840459617,262144 --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:1
        5⤵
        
        PID:5296
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=3868,i,2780827374518721073,227413436840459617,262144 --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:8
        5⤵
        
        PID:5648
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=772,i,2780827374518721073,227413436840459617,262144 --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:8
        5⤵
        
        PID:2528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://utorrent.com/prodnews?v=3%2e5%2e5%2e1%2e46538&pv=0.0.0.0.0
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ffca242c188,0x7ffca242c194,0x7ffca242c1a0
      4⤵
      PID:1076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,15129581893837331879,11750681099882191193,524288 --field-trial-handle=2740,i,3159265503463588018,11895830623883110517,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:3
      4⤵
      System Time Discovery
      PID:736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,14579119664909726264,12362166444717382433,262144 --field-trial-handle=2740,i,3159265503463588018,11895830623883110517,262144 --variations-seed-version --mojo-platform-channel-handle=2708 /prefetch:2
      4⤵
      PID:5248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2288,i,6915890647420513661,3701915733380998350,524288 --field-trial-handle=2740,i,3159265503463588018,11895830623883110517,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:8
      4⤵
      PID:4380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,16785435454123893185,16649624610950516346,2097152 --field-trial-handle=2740,i,3159265503463588018,11895830623883110517,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
      4⤵
      PID:5224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,11761994117871198610,14858326042989903464,2097152 --field-trial-handle=2740,i,3159265503463588018,11895830623883110517,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
      4⤵
      PID:6048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4864,i,4034320565664846875,292639567319634811,2097152 --field-trial-handle=2740,i,3159265503463588018,11895830623883110517,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:1
      4⤵
      PID:4128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,1446965150850861488,18092113930461540523,524288 --field-trial-handle=2740,i,3159265503463588018,11895830623883110517,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:8
      4⤵
      PID:1600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,5472547666488314620,12699479478445535682,524288 --field-trial-handle=2740,i,3159265503463588018,11895830623883110517,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:8
      4⤵
      PID:1112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,10283511574233843164,3302503225779039309,524288 --field-trial-handle=2740,i,3159265503463588018,11895830623883110517,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
      4⤵
      PID:4976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,10283511574233843164,3302503225779039309,524288 --field-trial-handle=2740,i,3159265503463588018,11895830623883110517,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
      4⤵
      PID:4028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,4863558477586015315,678796452989045672,524288 --field-trial-handle=2740,i,3159265503463588018,11895830623883110517,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
      4⤵
      PID:5204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,14430084762459196059,2610333650658416983,524288 --field-trial-handle=2740,i,3159265503463588018,11895830623883110517,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
      4⤵
      PID:2604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,2379301362830908445,15068757098262264759,524288 --field-trial-handle=2740,i,3159265503463588018,11895830623883110517,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
      4⤵
      PID:4376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,15168214307897069959,9947139118651657774,524288 --field-trial-handle=2740,i,3159265503463588018,11895830623883110517,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:8
      4⤵
      PID:4460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,15107152585453958211,884038120252346098,524288 --field-trial-handle=2740,i,3159265503463588018,11895830623883110517,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
      4⤵
      PID:2272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,14756831170742522345,13028481712209003190,524288 --field-trial-handle=2740,i,3159265503463588018,11895830623883110517,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:8
      4⤵
      PID:5208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,9993961937167072918,11950939171730608957,524288 --field-trial-handle=2740,i,3159265503463588018,11895830623883110517,262144 --variations-seed-version --mojo-platform-channel-handle=700 /prefetch:8
      4⤵
      PID:5288

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}
1⤵
- System Location Discovery: System Language Discovery
PID:5456

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hyph-as.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1090614351\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1730821725\manifest.fingerprint
Size 66B
SHA256 e84df839eb3dee2a10ba66de65c372c6e2bba0cbab46a39af041f4eeaab1ffe8
MD5 06d2b48de0edcb3e022ed639f0fb0085
SHA1 32f93d5a76998c407087269794026d1ea028828f
SHA512 3c883d4c342f95f28e4a76c73ce7151e8a76d6f5b2c86f90a9ee7f9976ae7e1be94c963489b326d2ff5f7c6423b29552d9aa09b65c17396c2f66ce271fe19506
TLSH
T1F3A022E32CE8880EACEC0AAB020A0AFA0ECC8000020280C80008080220028F0008CA8C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2540_1730821725\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5492_1625408867\manifest.json
Size 53B
SHA256 7612538ef6ea25a2078adf4ebda2b0565546d80189b6af46bb0e1c9744d720d5
MD5 46b34a0f2dbd5b58337d4cf05bdb4797
SHA1 b190fc81ede34f9fe8f4f5dee1b915331b76cc19
SHA512 49d0691d8eea580f863190f3073552b74bd550ec8b0a1b748fa0c5a18f05a515390735264f62f1aee0590017a1e4e85e470c32bfd49dfd371a47d1493ecab664
TLSH
T1B79002600414921716C10E906571B895A391661955850D1D04551558029586CE150298
MD5 SHA1 SHA512 TLSH

Submit Download

deny_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5492_748643140\deny_domains.list
Size 12B
SHA256 f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85
MD5 085a334bdb7c8e27b7d925a596bfc19a
SHA1 1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2
SHA512 c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5492_748643140\manifest.json
Size 177B
SHA256 0e9ec9e79542b4a26ff5da5ff91ed23c0fc9d4ee655cc135b64726daafb364a0
MD5 b06cf477c7639438f14301777daaaeb4
SHA1 77f7a86139f01bf8838df12e4c839143c0958932
SHA512 526576792f56bae509e5de7936815bacbdb262884c7b06110b5ad649b8ea8260622eba0244043ee6a972395297cbcbdc830cc105bd2526b619885c6c0ce42ce5
TLSH
T18CC012DFDC509DB119EB4332156D43C4D733CF0B1546450935FB66082E25985C193500
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e83e45437a3c5b4bc6d9ed114840ad5b6ecf586c96c9359ab5597ad0c0040d17
MD5 b88bae94680604d6040822311f917323
SHA1 367bf01d202a4cb83783128e517fb4a5c4eccad2
SHA512 b68efcbab42f5ffb70b9d1ba379d5f06ffe92f10b2f3c3ba1630446e5198bb7ca8b91e2cefbbbbda89ee33cff26347b2bee6923a26e6fb7a02c224a1efce7ae0
TLSH
T100D0122B36831138C02030B3000265081A00C20B40054145582DC96D2F944940A02482
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 decf8b3d252188e1624fad924a1aaefc72648801dcdfb15a4764a8901719c6da
MD5 f8ff54f0c06daef205e2b641d98f777e
SHA1 98e1472b1f1169946f1b009c20f55de68924b6f9
SHA512 3bf112e389ea853bbbd65e62dd08e0d6e52162542f714a79c1142f7893991b8109b8a64558b68d12fd75b3343509affdae5c01c3534b8114a470ffbb00ce8da1
TLSH
T172D0043D55C33005C11470F1401445001700C50014010755051544541DD15440141041
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 ad43a0b7cf60e0422ab42cd5d8e4aba633043ec69f7d0d4c917b7281a36e5b5e
MD5 94aba916793e3c89c9e8dacf2fc3a321
SHA1 c62944a14cfe138778b5092f7ce00c6e2bb052f1
SHA512 4ab654adf876e43fc781d72ee7032cd9ab918080cc4ed6952106a8c316786f9c5130cb739c354504c60763042fbf65f14452c2aa2649f67c98fb52754a171f7e
SSDEEP 96:st805LftU5tb9Z5zffyZ8i0vhEZkTwm/7PBUl7x+WVHMSm+uecadQjV+gSLMEB:st801iR5zfaZ8payJ/zB8+Wi8d8ULM8
TLSH
T159D1A7569E6869B74CC7E619BA35BF03E2F5206265D50E98EBFC861C08D65CC1307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 dcefb63a115ea122b7e1f8e70408caf2142b07b50938cde79b6d154a9ae1284e
MD5 fa29e8771a95ffe433884e968d0a556f
SHA1 7ae0deb00e9f761bdc4db42bbc891cb74bac8352
SHA512 d641597eabd56ff05a92cebca517b1af6fbd79c05bc00bfe2b7a4646ff01ff0db231416be74bb32a9f546ce30e66a314f84000a8656c7f0d40ba36305ddfd159
SSDEEP 96:st805LftU5tb9ZqzffyZ8i0vhEZkTwm/7PBUl7x+WVHMSm+uecadQjV+giLMOB:st801iRqzfaZ8payJ/zB8+Wi8d8MLMC
TLSH
T1E9D1A6569E6869B74CC7F659BA35BF03E2F5206265D10E98EBFC861C05E66CC1307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59d577.TMP

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Default\Preferences~RFe59d577.TMP
Size 6KB
SHA256 ff7939f049b119c817c0ed85b5c3ff0ae28d182b2fc46fcd47a7a69cbe8e8a2b
MD5 03337ac1866bb74ec38cfffd3bb2fc0d
SHA1 526af6a4427393bfc778d6bbc572851d122e0d8b
SHA512 4ddc232fec3c6e3c85fcf9a629d4f5e6980a60720ff38b1c082ca27ad25abe5050f1d3a4c85c394c79a830e8254caf119fab670716a5ec5838ae8c218fe47ed8
SSDEEP 96:st805LftU5tb9Z5zffyZ8i0vhEZkTFm/7PBzYx+WVHMSm+uecadQjV+gSLMEB:st801iR5zfaZ8payo/zBY+Wi8d8ULM8
TLSH
T13ED196569E6869B74CC7E619BA35BF03E2F6206265D40E98EBFC861C08D65DC130BD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Local State
Size 1KB
SHA256 26f99b120284f11bb4f0a3f6891aedd987eecbb34c92e8aa1e394348aeae9f99
MD5 a0cbe8eebc66e4ae928e57dcb30dc4b9
SHA1 eb7bb24c01cc185fb0216e9e6971b8de19c6d581
SHA512 7451732515fa1a0eedce56353d301bf843c26ecb31ffbe5d0149426a252b253d6203b6f1770661a475deafbaed47c0e5eb1195d6b2ea41a6da24bcf9cf6c7742
TLSH
T1E73165B7A4D42E367A9296C571416F431D612079E1108F44E2DE0B1A01E37CCD16AC23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Local State
Size 2KB
SHA256 9bce60ebe8efcad0c8ab40ccac139ea6f199e9cff3807e55521850500a2de524
MD5 5e7cd2be7ea7290048e579edd0d2ffba
SHA1 7d4b012afd38f7ddf8f3c43ca0c2608390e5daa9
SHA512 1d75fb5287a1e8896fbec18f53b48ce3a7c0861f08b9ee305def5883d976820bb45d99a1efdda2146e26542e1995f18b7be6a8c19c5c1a3aba0983efecb0c91c
TLSH
T1E251F9737884AE378AE38AC4B4453F139D7161B8E6602F90DADD0B1D01E778C6302C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Local State
Size 16KB
SHA256 baa92db0c88ca91650084af3683924f0376727249ce9e63c1c36b3b115cab9c2
MD5 ef007739dddc853aadb23facc5244d09
SHA1 6a358205d0159b00ab80e62d0dc8472be3f3d33e
SHA512 516a68b578b5be4a7fd81eb91381b02933ad05ead1c893a7487033bb2f81aec714d096e9acec3e125576d53b39a24d57340e12501db3cfdbfc80cf20ad7f8f87
SSDEEP 384:zW+aQikB+z/xvxjg/qhEwNadeBoblaR9zY:l/UxvxjgC+f5UFY
TLSH
T14B729E3B55A93E23AAF3E6457A480B4BDAB594B290C17EB84DED5F0A06D77D81302D02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Local State
Size 3KB
SHA256 fafba16e1e03de78913c41a03f747c1a177d968e945be1cc94fa85785f5d3b90
MD5 70f96aecb0ab999086808ef2c5533ae8
SHA1 dffc49a76d0234aa25314b47f98c4d432b2485f6
SHA512 770d682bfaffc61816d137646742c66a6efa3e451a7a22734c1038e7222261403366b61728f862b286f9bbe8b3a4b807d1d9b518a8c13ecd983a54efd023f9aa
TLSH
T19F71B57B69A4A9374EF3CA85B8863F03A6A1513AE5903F98DAED0F0D01D73881342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Local State
Size 3KB
SHA256 d6465b4e9a28cf0c2dc0b8293afbd1bb237d5b376a65e2247d0e1dd75ba3f930
MD5 42db5f3687abb43691db85002b8bc55b
SHA1 3d96cc4a1f6d048852463e20bc3fc24f55a54caf
SHA512 f8f6cb64a3cff75623e3d1d85d388cdb89e8d38272beb8fb27b957a61f7eec30c257157152f2de197ef6644c0ae77c2d3e48c9936c3a798ba1f09015da9bc76f
TLSH
T17571B67B68A4A9374EF3DE84B8852F02B6A15136E5903FA4DAEC0F0D01D77C81342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe598301.TMP

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Local State~RFe598301.TMP
Size 1KB
SHA256 b39eb0b89b7b2ff1529db2e947835c18aed2fa5319823111367488878444703d
MD5 b674b76041ad197124a38f86228e9a6e
SHA1 e95999b32dad864d208ef4cf97ee72f399e6c7db
SHA512 e13929073f773a53de5e864297b69feab4dcdd2ec5cafe3fb0537e7a93aca4e1991be736ad6f2d530560cbe082e96ac0bfd7340da2eddaa54f5cfb3204ecff57
TLSH
T1E0214277D4D53E367A528AD5B1427F831DA061B9E1108F08E1DE071A01E7BC8C176C23
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
MD5 a98f4348736e1c7c5e70799864c15774
SHA1 fa2e3725e970aab935f77d155b649177f50be7d6
SHA512 c1dd68c743d45af6f713c7d8fade4a675abe4d224e86b956c5aaf959ccda0a92b9824b0e784a0ee9992843bfc2a7a73f85267479d6e5ffa0aa5827760492419d
TLSH
T19ED02B20B6A87654E006343C0114428C31CE5570140BB400809413A40FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 f045b436e6bb7fb57df8041d88517343e315a1458db3d3c61df049e2b1e8eef4
MD5 4a17fe27cfd68ecd62cfc10e10950599
SHA1 73124b44c77316d5d39846ce285c816d8ed0867f
SHA512 dff1ca99c60814c5e1d605880f4e3fd1a6a1a8b2ede683a7057889aa937206813973296361f5bcd4620997b25fba4e09836eb148bc06ed2706fdc25f9ec45153
TLSH
T171E0CDAC25DAC2AEA327A847456C474D8290370BE7CC6ADA6B088C8C7582544B3E2799
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 b034430c649e49b1b2872b5548602bf87948f136f0fe09807840d5ce150c7ec6
MD5 504c1db2add1437b57f3e2e7b6bbc0b5
SHA1 607dde85ffae569f1c11736e12db8658c7dd52f2
SHA512 4bf8f419a964c0a93aacb1c0aa7961498a4872e707fdc717c895e27f48782a28fd2b5495eac845d7deb5349292a425b6359bc918225bc9d458a9d95748bff019
TLSH
T1B8F028FAC821FC3B18FD0B7A24940B46F750232B2A41984F3B3E810D8FB053B468582C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 12b82f713201526b152af2e0db7a355241234b2ec2504029bceb5592a33db658
MD5 ab397e5eae6facd1ade454b31b332767
SHA1 d02a540aadf164036ecca365016ca8eb51716d9a
SHA512 6f6b3230b2dc76404b4248f1549edf73532f68d98a29744163311d5c4072af5b4bd3b509228937293ac08e18895b5483afaaf506f2e57e37b54e2beaf56bc8b2
TLSH
T1E3718F948C8672D0FB6D20B0E9F6404336B4667A0AA7ED1315D2DDBCF4633F49202B0B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59faa2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59faa2.TMP
Size 3KB
SHA256 5b53261b24a0c4f6b6b4434515720298b54324accf6d2ed1efa21d56f3edb8d4
MD5 6348f76ae0cb5380ff215a2c43a2cc7c
SHA1 e22273359da3e293f76537e42e0a2ec30ee66e33
SHA512 d9e7e6e88f7bb37b49245dde3064625ec98a6d89cc5b94a3bcdccde762ffc705208a39eebd9b75e305f9041cc4b052e862d55f37dd83abbccc72e53ab1fe4cd1
TLSH
T1EB615D848C8AB0D0F7AE60F4E9F6908336B46B7549A3AD1316D6DD7CE4673F4931630A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 b016ce7e543b1caee96c8e32385b793b61c8c8bcc11977a303fd1a6fd6b34b70
MD5 a70f07b850cee342e3b086f4a22456a4
SHA1 2c5313a5981699196dccb196f340cfb6278192dc
SHA512 976d794fafbb40c6578c518aeea816d364bde2dd3bba9e17c61cf5f7bf79f7b913e0ce7e609c3cc95108ec6246b11b2e137975af4d7594e8307546c1403ed00a
SSDEEP 96:D1POhjhshY+hyht9FaOzBhrhehvh7GhrVqhzhNSh/AhZTwQ:D1mJGrINFaO1RgNUFVqVnSiLTT
TLSH
T114A1CFF7C7E4952DCC115AF0A7156D1BCE5D0A28A32C3C9AC9E4AF1B53E24B0E241A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1670fc61f87967f9243f7e909b29c887207b2025d10935fca03e16e3d84e7f88
MD5 27da9a32e74c39a3be4b2610489bc2d1
SHA1 554748b0ffc6bd3a09a13589fb9c30f1244badf9
SHA512 b7b2c19679e6f1511e758c6895741fae428c827e8dce498b23abddd4d85ed46b8381f6b4e07dcc8fa8a7fa82994facb72b3876f4a527e45efbe732dd77bf132c
SSDEEP 192:sxZeR9iO/fTsbQaQZLjZA8ozodp1YHW6+WN7tq/EWwVIhvxo12Senjv6Ig58t2J:sxZeOO/fTsFOPZXbaHbw/UViSenOStC
TLSH
T12542EA69AD24697B4CC7D619FB15BF63E3F9003394900E84AAFC8A1C05EB6DD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2373b69136974c46a7d3af945f6dd2cf851a0a9003e0f46d53a3cbb524269fe6
MD5 4d46a799666e88ee80f1683275a28f59
SHA1 17c2893f07ccb5bdb43064d98f837c4ec241e25e
SHA512 1c28f5c78bb2781f3c37d1d81cf87d8aaa1a2f2a766c41858c838053b680d84aa264da50da8929eaeaf35ef750de7b60934406e704fba734c4baf187b39dfcc5
SSDEEP 192:sxZeR9iO/fTsb6QZLjZA8ozodp1YHW6+WN7tq/EWwVIhvxoD2Senjv6Ig5YJTtIJ:sxZeOO/fTs+OPZXbaHbw/UVgSenOMTts
TLSH
T19152DAA9AD24697B4CC7D619FB15BF63E3F9103294910E84AAFC8B1C05E76DD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c7b5bd3b5ddf13d791dce01714b015f9eb79f1e796bfe2d4fcd6b0ca5683fcfb
MD5 a1ac2b4b7b134fb957c74ab4ff0c5167
SHA1 48648b2dc5a0bc0370076db9a81a5a6133387132
SHA512 5fccafef1d4b15a3c30be29c5a2c05e6829bf7d03d0a545991b11317cfb78d20865b32db4d5aa81902b38698f2260e589b3f54c76ea4023eb76cde36c88aa2c7
SSDEEP 192:sxZeR9iO/fTsqQaQZLjZA8ozodp1YHW6+WN7tq/EWwVIhvxo12Senjv6Igjt2J:sxZeOO/fTsiOPZXbaHbw/UViSenOjtC
TLSH
T16042DA65AD28697B4CC7D619FB15BF63E3F9103394940E44AAFC8A1C15EB6DD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 4c11653f5e25933d6f6943222c3b00b1c7f2d878062033659f40d6fd7657202b
MD5 d8861be1a0a8824eeceb7b66b23fa490
SHA1 807453177e9e260df8765e8372f9091c6960ec49
SHA512 2198ee1a5ecfe77a7c6e3ee757e71a8225ce955f743ee8784498ab80b50f25c1144fec10ec301ff0933087de58f8dca99c4fcf89adb8111c988e03230a81cd48
SSDEEP 768:Px6r8sW7pLuLbG+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVw1qpLlvVajYroJ:Px6r8s2EbG+WviyUKu1jaN1qpLd4jjoI
TLSH
T18CE2E97B780CCB7E4FC04A9DDD1A7F8B6DA802CB9698C94087FA945C02C67EA51170DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 d291a3d049aa890c1bdf4d58fa338364324f812980e0dd3f1621a5aeddb68ccb
MD5 c2f61c2eb39d7f937ce9d36cfd99bf04
SHA1 a51ed57f9014909378939a3f9fc3d3b1efac0b78
SHA512 f6f75bd5b373a1cbffacbb1a89dcbfcc1bc535d9cc9fef5c028f18f79ff2cf238e53c06067009d7a4777cf3b7163da51c63ec8fee2f950fe101a54aa658c1558
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgU:ST/2dXOJhJlpfnpp3tNXVrN3m9vQ7g
TLSH
T14AB2215571BB421039FE390891B59B2E064232733119EA6B7FBD04B68E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.25\data.txt
Size 152KB
SHA256 4e932235a6fefae59866c98f69253bf2d3d0e7e2a2a9ae546685bc4646f9a297
MD5 b5394eb229ba53caf4fc321b5087e299
SHA1 b84ae45b51a9d200639a10ea487b1ba9b94ed3eb
SHA512 6e6f890c6fc57d470e2bedaf5b022d13e54762c8d424a4a43493b7eb68f2d22be2a1641f5ffa25a1756fef938841ec50c908e97161da28158a2c7e3b258b39d0
SSDEEP 3072:wPAgDcCHaLHl65aynyosxb3+BLvf55rOiWF4Vkia/UFwK:cX1aI5aZoKzMDXrOiW1igUB
TLSH
T1AAE3F240C9D0AFDDCEA8161C90BE0F1963E1CA8EC13A958ADB23FD4B6FD3A045A175D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 7cc566292ddb2b5c40248a426bce2108006523c68c928f37b0709309108f1b49
MD5 5adf7ada50a3551caccc6127dd285b45
SHA1 15af7b97cd7f4a9a080dd537b96e3de7dcfe7e64
SHA512 de95ae1594d85e2c2d9829a3d8c6efbb671e12758985be1e3202118ecc5108970fb8950f0ea2be743d123164260222904c59f1b0597c2f5243884f794546dd3f
SSDEEP 384:npiFiZcI63sNU8TUNTUlIm2aKMi34w2fLBCN7Fi7O6R2FeoEgL/7Izzo9:AFQ63pwgcKoBCBFi7TRNS
TLSH
T14FC23A36EC98DABBEDFA8FD9AB4A7A03DEE00163948C45D4D9D81D1D00976DD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 1904dc4563143109d089abe1437d87cf921a55610cbd3f0d88d21f01edf18b09
MD5 2c961c4939f4474a48d6cd2ed2e0349f
SHA1 f2becfa61ff867da9c1a97a6d2939b48258d8ae8
SHA512 4f3e39da6341845f132e779850a7e90d997786df4a8b27b8e0feabb0a4705088fdd44f79c19701d70f566d9cb89961d393a721092d2f1897e4b0301986458378
SSDEEP 384:nRiFiZcI63sNkQ8TUNTUlI4waKMIbbRYfw2fLBCNfunKUhih3GDHgL/7Iz5oO:4FQ63kwgYcuBCRPUhih3qp
TLSH
T164C25A72EC99DEABECEA4BD5B74A3A43DEF00163848C8AD4D9D85D1D00932DD070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 8677d0ea1baa0ede3a9044c70514ed31c5f6fe7f738d7e15a3ef000e8049b551
MD5 97b5023ac42fd940c0387a3b0d982c4e
SHA1 f5b6e2a800b612e70d63ee32e72c9b5e63cf9caf
SHA512 30dd7c8ac3d3d9afdf8d422e8c90c2a3563567e2c0c5778fd719ce7822fab49bdaa069c2be307ef9c2dd884c05538b5453906e5f1998517cc6b7ba9cf650766a
SSDEEP 384:nIiFiZcI63sNkQ8TUNTUlI4waKMIbbRYfw2fLBCNfunKUYihtgOIwZOyJLCgL/7B:TFQ63kwgYcuBCRPUYihXsavj
TLSH
T195C25A72D8A9DEBBECEA4BC5B74A7A43DEE01163848C9AD4D9D84D1D00D32DD070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 60d08507e402026f42ed60ba66d97cf3a29d3ec324fec7ed06ded0f12e268ee3
MD5 a1d9b40597a67d52e36691296d0cb60c
SHA1 fea24f289b0a560d5226ef3ceafa728b8d7ed860
SHA512 8a417fd06f29befbcd8700e457510352dafc988cdbd6550748feaa74708d05dcdea3e62f1877bc91851379570c9e850840bb37270770f6716d83d4a934a15255
SSDEEP 384:n6iFiZcIz43sNkQ8TUNTUlI4waKMIbbNYfw2fLBCNfunKUQmhtgOIwZOyJLCgL/l:xFQs3kwgYAuBCRPUQmhXsavj
TLSH
T194E291F198D78977E8EE4B87677D2E429ABCC163B4884984B7D40D1DCC921BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 6406ef8579ee45ec3e15db4712b2798b55228d5642b270c7364107fb466b678b
MD5 680b5906b1dc40f5b7414cebbad44a6a
SHA1 a5f722b7b3202db3a70eb7cb98d32079a559da92
SHA512 a5ffb3b116f94c638f9f7ade2e8af91913da664b7633d50bce0a9a8aa7dce921ea33043c1c77af8882220f8859d8a758e7f551f5ea544b03490a0ab100ef0b7e
TLSH
T1EA512DE04C3C5AD1D4BD0E7EB49B35EC95EC9621B8A434392858E9988A3AA1D3084C3F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 db5776718307a71d95d7a30d31b48758bc16fde9802463aefb66deab1a3015c0
MD5 636a9fc71bc550b67db92fa5cf6ababb
SHA1 2b5eb24145b545e45144cf2fba91255f5c2ec9ac
SHA512 95767ec427e5ec6abe11b26f736ae3e0ed681d21022a3393f67057d7dc259b7b1a6e14862304b46414606897177b18310a0497277a86a7f2e5cdecf228c951c7
TLSH
T168410958A6ED1148B3B77E5AAFFAA46E58BAB8372E07D45E00110D4F0A23F40C961737
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3ef95dbd095a81d78f27d5d6b8459eebab359329162dc0362a26900a28e2bec4
MD5 8f225b6d56841683abf748ca19482d2b
SHA1 279f9d8eb97803230dd3d7f3c0c63c732b5a35af
SHA512 f1bbb3f6949b508c290a8dc25f467b2979a6509f86183d6d12bf06feed4db229b76a1fc799d10a0575e54e416fb4f07b10b8b6e442aadee433c9059d9eb72ed9
TLSH
T13E413B5876F91048B373AE1AAFF6B46D487FB9773E06819D10110E4E0B62A00C971B37
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 d90ed40cc9bf4ab7f0e56c3cfef0dd9750a6e44e6ca75be7279b2c2372626ed6
MD5 a519a6dd8c29d7a2fbbd13d4d126c8aa
SHA1 ebd2246f07fd85e1ee955ec5bf73e9b7c806f7fd
SHA512 6d703a758d999102fc6b795c6dd18c4c1cce844c76d5fd7d5290d0d5376783113b41ae0da36773ef16ce6a1e1b7602e8c194304ec95d043f9c5983a801f73f38
TLSH
T14D514B5C6AEA105CF373AF0A9BF6B95E487FBD332E06905D10510E4F0623A45C961B37
MD5 SHA1 SHA512 TLSH

Submit Download

1f91d2d17ea675d4c2c3192e241743f9_841ae630-b22d-4710-a2f9-395fbcdc8c97

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2091445952-3649787497-104050984-1000\1f91d2d17ea675d4c2c3192e241743f9_841ae630-b22d-4710-a2f9-395fbcdc8c97
Size 1KB
SHA256 61ffeb8d9fc486b0dbfcb6efb63dba7e5990901887422a367d04a5f8f3ef0136
MD5 12b281aacfa1d405e086695f8d67f07f
SHA1 d638cff6926510c369ec75df3643dd7f919cc39d
SHA512 8d3b59d86cebc0247da1cd548c3e81a65bf1661fbd4b891ad5656f67ec6c659199569a09a23ee5275865ca14fc9c43f6f3ae76ad15395cb13e8f52ddd13f3de7
TLSH
T18331E992361435DAD0B4C3BF2A1B45780F50486E02BAC9443F4AE2AFE10ADD085A4341
MD5 SHA1 SHA512 TLSH

Submit Download

165F6EF40A81DD175FFAEA69E77ABFD30B27E71C

Path C:\Users\Admin\AppData\Roaming\uTorrent\dlimagecache\165F6EF40A81DD175FFAEA69E77ABFD30B27E71C
Size 1KB
SHA256 ec9e7c253d599175af470832da851cf4f59614a4c4d4e37183159801b13abf5f
MD5 4280089022fce23da2c64031bf137c08
SHA1 0380334f420bc6677795fda8f5201c1fb7355c1c
SHA512 9eafb6f30baf09a32601b1f9da1316e1fcc44256784221da85f54718de6f0539c2bb601feba194c2ba801c8b95834f5029c93e3508f79daddf8c3343fc848a05
TLSH
T19621354CF54454019949FC4118EFE027892748C0E5D0F6A5BCCFDC5E19641F681658DF
MD5 SHA1 SHA512 TLSH

Submit Download

helper_web_ui.btinstall

Path C:\Users\Admin\AppData\Roaming\uTorrent\helper_web_ui.btinstall
Size 7.4MB
SHA256 4325244a7c1b300cd6006c6d4d8ee6335c4b04284b3677748de614d6acfae86d
MD5 670665adc104762488096e84624fa384
SHA1 b76a77a5d1f061434e4dd2691e5cd5855a70359b
SHA512 537ce79e9be83aa2a7c02f23903e759238eac34d7d37f11d616f7f3d9c3011e1d52dc6286454176bc593a9733cae7ba0e1361e2d6d4619705fdbe8f68261fc4f
SSDEEP 196608:Dtcf3YdAkSihw+MDq3dxfrZ28O/dDJz8Mpe8dmT88ejj41ZPTnUz:DtgISkSiyq388O/dDJz8H8dmhSAZPTnU
TLSH
T1AB7633FCCFD5A011E26A44F1DDBE0B799AC51D31B03699319B1D6B0B0873D4B96ABE80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\uTorrent\settings.dat
Size 8KB
SHA256 c4dc40eacf0b4df6f1e5e540bdbf68309bc41ba2709c6d5addf72530956868d9
MD5 b8da2d919c51d8a54099305a81cea56d
SHA1 ee28ffdc9591a5921e67cf2df2792efc9ba6bf03
SHA512 e71e6366ef6726b717acbc3f01bd60e1525d7d6d67a736f4badf8e0d50b6f72338b22fedbad3865baaf2146680b53c6052bc65a973e8349750be6f4f128156f6
SSDEEP 96:uaaq0T09J42lflTlt8Aa0L0M1nzT50eZfaNY/V6tKJ:uXq0T09nvENHM1VYvM
TLSH
T1550208229DFFC5A0F869813F4779400BB57A1B40DA76E622E0981DF83541A1F09EBB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat.old

Path C:\Users\Admin\AppData\Roaming\uTorrent\settings.dat.old
Size 7KB
SHA256 fe6280a75520c83073d3e7d7734ff05538b68b36e510e8c2fca6c78c5f1072bf
MD5 2979444fd352d9074bac52a1f5491d5e
SHA1 4dee9d046a97b0a8440782df9ea27afb9a167bca
SHA512 a84ad54e800d45fbfe9e9402130db2da93a65505d2b2c30ccd698e2b519112a63b63f85604370937f6e6b80be487977639cbafb24ff07c76d3f99af76e60cf19
SSDEEP 96:/aaqPT09J1lflTlt8Aa0L0M1nzT50eZfaNY/V6tiJ:/XqPT09/vENHM1VYvk
TLSH
T1A3F108235DFFC6B0F869813B5779440BB17A1B40DA76E622A05C1DF8354161F09EBB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat.old

Path C:\Users\Admin\AppData\Roaming\uTorrent\settings.dat.old
Size 8KB
SHA256 82c3b62d2918b061ed00479864cd869762e10debac451f606bdfa3421a8e4c46
MD5 7f438e6aa14d91d22529dfb8069a0693
SHA1 7ca6192c72dacd01d9944f8b3740fadec7c1800b
SHA512 a548c0c07243be0c9b8f1430f0e8d0ec9458444c844c237be594627a9168e16e942a710a4225d4187d2a6d5c707ab170c26ab0a15a00df03a35fbfb1409a2165
SSDEEP 96:Yn/aaqPT09J1lflTlt8Aa0L0M1nzT50eZfaNY/V6tZJ:Yn/XqPT09/vENHM1VYvH
TLSH
T18E02F9125DFFC5B0F469853F5779440BB17A1B40DA76E622E05C1DF8354171B09EBB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

toolbar.benc.new

Path C:\Users\Admin\AppData\Roaming\uTorrent\toolbar.benc.new
Size 170B
SHA256 c4a188a7cdac96f0220f0e841a9c296bdf15c4fa9df2cb0e93524a5483172fa8
MD5 e7c8e8ffb8b5b7371a79ebe21d9164a8
SHA1 9042f60f4a6ab29366293341a70ef2abb6704dd7
SHA512 79df15ab56a3bfaa394a05e53e319bfbb18496d1cc16d93a8f891c6220be65d86d465130b49ea2c1282d533912bcfdc90e551267db5a52a7f6fcd56a1ba97fe8
TLSH
T1C9C08C6146F4153C0B2B584E21EDAC7FB682AA98898E7E4998576B268CCE1492BE1420
MD5 SHA1 SHA512 TLSH

Submit Download

uTorrent.exe

Path C:\Users\Admin\AppData\Roaming\uTorrent\uTorrent.exe
Size 6.0MB
SHA256 053d55e3059c9829fc7ea175b6f69bec8cddfcd733f7d678d769862398e5e6b1
MD5 7084773cb512ec2d4a064c66d685be95
SHA1 aa8ec52c9be8e72a8968209add6ac5ca1b0bf5e0
SHA512 43d80dc855ed62d5f008fac1c500e655016d609b37b0254b55cd9c48aa393103d712a6bd94d65fa12507fc8e7096b5f68fcfcd7589f64ea4fa30dd62e6e1e467
SSDEEP 196608:UgJchjqymNVwBhLrk3rDflf4XTP6iI5dCGioynrZ:1c1q1MLrk3rDflf4XTP6iI5dCGioyn
TLSH
T19656BF12BA85C079D3E20070092B5B5262BBED745B314EE7B3847A6E7A74DD2453FB23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updates.dat

Path C:\Users\Admin\AppData\Roaming\uTorrent\updates.dat
Size 344B
SHA256 13e028bd8561b518da14308d7e8c175f1d372b67e5fd5b86d32f6d9f18915ecf
MD5 0c5a2ddc3c70abe1f702f54c665a45d3
SHA1 4995d72687e587c89ddbed3d635b686bb89723fe
SHA512 1ba2170028dee207f3dd64c5a4cddc4a13e876ad89e9c1292e42395618da3d1ab22879a36b0fd566103667b419092913406940b797eee20d4c762e0a07c75caa
TLSH
T189E0C07444F4C21F35208FAE96B434F1937564C5580457B48043098C98408344AE5D09
MD5 SHA1 SHA512 TLSH

Submit Download

utorrentie.exe

Path C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_46538\utorrentie.exe
Size 690KB
SHA256 21d3d396ebe4a29f21a098ab5a0948db5ec045a98e0d88ee644ea2ef695d65c0
MD5 feff4d66db6978490f5de5e6885ecd60
SHA1 c032f43a9119481bc8b865c81fdaff19eedfa101
SHA512 f7a2873ff8e7bb58f306c795df1a9b052f9fdfc4f1fe0fe56c70135bf0a8863ef693b67ce0ca34ae7111bbb1ecc6b0622c0dd14dbba6be4ca60616536da83257
SSDEEP 12288:ze61Lrk3rDflf4XTP6iI5dCGioySpPplnOrrkB159EBRKFiTkU0Ja8Sav4awrwYG:zrLrk3rDflf4XTP6iI5dCGioySRO/kB9
TLSH
T1F0E47C217581C036D67110B11A69ABF591BEF9365F7249CBB7C01B2E1A352E22F31B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3.6.0_47254.exe

Path C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_47254.exe
Size 3.7MB
SHA256 e2837e13d80e4602b0c2d711c6d6c17217f4a80c8ff0b33dd90df219f025f3b7
MD5 7b1bcf79461ed67aa315a4e156dc83f7
SHA1 d15d84e371af61b2497d0f825167d8d19caa9ea6
SHA512 3857a4642a0e5911d46a96ee66309fc414997b347500dd90e8a88f8c578de615849d24ce02080cb30633ec822e2ec2e0503ea86819ba05d3a9ef795cb43c21f4
SSDEEP 98304:yg3iGC5mAyFoVCVMZUkPk0XdC/eBWLhR4qdGcQi:ywi95jooCM+gC2B6hR4/O
TLSH
T145063361E664FC6AE57885F5008B53CE9C63BC07F26C2BB387A1363B7B312415A94F49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3668-387-0x0000000000400000-0x0000000000A4A000-memory.dmp

Download

memory/3668-35-0x0000000000400000-0x0000000000A4A000-memory.dmp

Download

memory/4216-83-0x00007FFCC1970000-0x00007FFCC1971000-memory.dmp

Download

memory/4360-0-0x0000000000400000-0x0000000000A4A000-memory.dmp

Download

memory/4360-34-0x0000000000400000-0x0000000000A4A000-memory.dmp

Download

memory/4360-22-0x0000000000400000-0x0000000000A4A000-memory.dmp

Download

memory/5160-151-0x00007FFCC2060000-0x00007FFCC2061000-memory.dmp

Download

memory/5160-150-0x00007FFCC2360000-0x00007FFCC2361000-memory.dmp

Download

memory/5872-171-0x00007FFCC1970000-0x00007FFCC1971000-memory.dmp

Download