053d55e3059c9829fc7ea175b6f69bec8cddfcd733f7d678d769862398e5e6b1

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 07:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Size 6.0MB
Sample260925-h784wasepd
SHA256 053d55e3059c9829fc7ea175b6f69bec8cddfcd733f7d678d769862398e5e6b1
MD5 7084773cb512ec2d4a064c66d685be95
SHA1 aa8ec52c9be8e72a8968209add6ac5ca1b0bf5e0
SHA512 43d80dc855ed62d5f008fac1c500e655016d609b37b0254b55cd9c48aa393103d712a6bd94d65fa12507fc8e7096b5f68fcfcd7589f64ea4fa30dd62e6e1e467
SSDEEP 196608:UgJchjqymNVwBhLrk3rDflf4XTP6iI5dCGioynrZ:1c1q1MLrk3rDflf4XTP6iI5dCGioyn
TLSH
T19656BF12BA85C079D3E20070092B5B5262BBED745B314EE7B3847A6E7A74DD2453FB23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

adware defense_evasion discovery spyware trojan upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 6 IoCs

resource	yara_rule
behavioral2/memory/704-0-0x0000000000400000-0x0000000000A4A000-memory.dmp	UPX
behavioral2/memory/704-21-0x0000000000400000-0x0000000000A4A000-memory.dmp	UPX
behavioral2/files/0x000d00000001c55d-33.dat	UPX
behavioral2/memory/3128-36-0x0000000000400000-0x0000000000A4A000-memory.dmp	UPX
behavioral2/memory/704-37-0x0000000000400000-0x0000000000A4A000-memory.dmp	UPX
behavioral2/memory/3128-465-0x0000000000400000-0x0000000000A4A000-memory.dmp	UPX

Downloads MZ/PE file 2 IoCs

flow	pid	Process
119	3128	uTorrent.exe
116	3128	uTorrent.exe

Executes dropped EXE 6 IoCs

pid	Process
3128	uTorrent.exe
5800	utorrentie.exe
2420	utorrentie.exe
940	utorrentie.exe
5516	utorrentie.exe
3816	utorrentie.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Key opened	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Wine	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	uTorrent.exe
Key opened	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Wine	uTorrent.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 5 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	utorrentie.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	utorrentie.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	utorrentie.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	utorrentie.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	utorrentie.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/704-0-0x0000000000400000-0x0000000000A4A000-memory.dmp	upx
behavioral2/memory/704-21-0x0000000000400000-0x0000000000A4A000-memory.dmp	upx
behavioral2/files/0x000d00000001c55d-33.dat	upx
behavioral2/memory/3128-36-0x0000000000400000-0x0000000000A4A000-memory.dmp	upx
behavioral2/memory/704-37-0x0000000000400000-0x0000000000A4A000-memory.dmp	upx
behavioral2/memory/3128-465-0x0000000000400000-0x0000000000A4A000-memory.dmp	upx

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4936_1508379567\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4936_1664878434\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6100_795680136\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6100_795680136\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4936_1508379567\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4936_2041095759\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4936_1664878434\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6100_795680136\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6100_795680136\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6100_795680136\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6100_795680136\manifest.fingerprint	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uTorrent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	utorrentie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	utorrentie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	utorrentie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	utorrentie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	utorrentie.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4680	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	uTorrent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	uTorrent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	uTorrent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	uTorrent.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION	uTorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION\utorrentie.exe = "1"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CROSS_DOMAIN_REDIRECT_MITIGATION	uTorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CROSS_DOMAIN_REDIRECT_MITIGATION\utorrentie.exe = "0"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	uTorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\utorrentie.exe = "11000"	uTorrent.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134347946893978317"	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml\Extension = ".btsearch"	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\uTorrent\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\maindoc.ico"	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\uTorrent\shell\open\command	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\uTorrent\Content Type	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\.btkey	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\.btkey\Content Type = "application/x-bittorrent-key"	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\.btsearch\OpenWithProgids\uTorrent	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Key deleted	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\.btsearch\OpenWithProgids	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Magnet\shell\ = "open"	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-app\Extension = ".btapp"	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\.btinstall	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-appinst	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-appinst\Extension = ".btinstall"	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-appinst\Extension = ".btinstall"	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Applications\uTorrent.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe\" \"%1\" /SHELLASSOC"	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\.torrent	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Magnet\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\maindoc.ico"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Applications	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\.torrent\ = "uTorrent"	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\uTorrent\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\maindoc.ico"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\uTorrent\shell\open\command	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Magnet\ = "Magnet URI"	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Magnet\Content Type = "application/x-magnet"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\bittorrent	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\bittorrent\URL Protocol	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\MIME	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\.btskin\Content Type = "application/x-bittorrent-skin"	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\.btsearch	uTorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Magnet	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Magnet\shell\open\command	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\bittorrent\shell	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\.btapp\Content Type = "application/x-bittorrent-app"	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\uTorrent\shell\open	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\uTorrent\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe\" \"%1\" /SHELLASSOC"	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\.btkey\ = "uTorrent"	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\uTorrent\shell\ = "open"	uTorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml\Extension = ".btsearch"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\MIME\Database\Content Type	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\uTorrent\DefaultIcon	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\uTorrent	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-app	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent\Extension = ".torrent"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\MIME\Database\Content Type\application/x-bittorrent	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\bittorrent\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\maindoc.ico"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\uTorrent\shell	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\MIME\Database\Content Type\application/x-bittorrent\Extension = ".torrent"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\uTorrent\shell	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\.btskin	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-skin\Extension = ".btskin"	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\uTorrent\DefaultIcon	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\bittorrent\shell\ = "open"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\bittorrent\DefaultIcon	uTorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-skin\Extension = ".btskin"	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\.btapp\ = "uTorrent"	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\.btsearch\OpenWithProgids	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Applications\uTorrent.exe\shell\open\command	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\.btsearch\Content Type = "application/x-bittorrentsearchdescription+xml"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Magnet\shell	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\bittorrent\Content Type = "application/x-bittorrent-protocol"	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\uTorrent\Content Type\ = "application/x-bittorrent"	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-app\Extension = ".btapp"	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254836b0000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd22000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	uTorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	uTorrent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 6b0000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd20f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	uTorrent.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
704	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
704	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
3128	uTorrent.exe
3128	uTorrent.exe
3128	uTorrent.exe
3128	uTorrent.exe
3128	uTorrent.exe
3128	uTorrent.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3128	uTorrent.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
6100	msedgewebview2.exe
6100	msedgewebview2.exe
6100	msedgewebview2.exe
4936	msedge.exe
4936	msedge.exe
6100	msedgewebview2.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
6100	msedgewebview2.exe
6100	msedgewebview2.exe
6100	msedgewebview2.exe
6100	msedgewebview2.exe
6100	msedgewebview2.exe
6100	msedgewebview2.exe
6100	msedgewebview2.exe
6100	msedgewebview2.exe
4936	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	704	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Token: SeManageVolumePrivilege	3128	uTorrent.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3128	uTorrent.exe
3128	uTorrent.exe
3128	uTorrent.exe
4936	msedge.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3128	uTorrent.exe
3128	uTorrent.exe
3128	uTorrent.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 704 wrote to memory of 3128	704	2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe	91
PID 3128 wrote to memory of 5800	3128	uTorrent.exe	93
PID 3128 wrote to memory of 2420	3128	uTorrent.exe	94
PID 5800 wrote to memory of 6100	5800	utorrentie.exe	95
PID 2420 wrote to memory of 2568	2420	utorrentie.exe	96
PID 2568 wrote to memory of 3312	2568	msedgewebview2.exe	97
PID 6100 wrote to memory of 3832	6100	msedgewebview2.exe	98
PID 3128 wrote to memory of 4936	3128	uTorrent.exe	99
PID 6100 wrote to memory of 5296	6100	msedgewebview2.exe	100
PID 6100 wrote to memory of 5296	6100	msedgewebview2.exe	100
PID 6100 wrote to memory of 5296	6100	msedgewebview2.exe	100
PID 6100 wrote to memory of 5296	6100	msedgewebview2.exe	100
PID 6100 wrote to memory of 1472	6100	msedgewebview2.exe	101
PID 6100 wrote to memory of 5504	6100	msedgewebview2.exe	102
PID 6100 wrote to memory of 5504	6100	msedgewebview2.exe	102
PID 6100 wrote to memory of 5504	6100	msedgewebview2.exe	102
PID 6100 wrote to memory of 1144	6100	msedgewebview2.exe	103
PID 6100 wrote to memory of 1144	6100	msedgewebview2.exe	103
PID 6100 wrote to memory of 1144	6100	msedgewebview2.exe	103
PID 6100 wrote to memory of 1144	6100	msedgewebview2.exe	103
PID 6100 wrote to memory of 1144	6100	msedgewebview2.exe	103
PID 3128 wrote to memory of 940	3128	uTorrent.exe	104
PID 4936 wrote to memory of 3316	4936	msedge.exe	105
PID 3128 wrote to memory of 5516	3128	uTorrent.exe	106
PID 940 wrote to memory of 412	940	utorrentie.exe	107
PID 412 wrote to memory of 5488	412	msedgewebview2.exe	108
PID 6100 wrote to memory of 2884	6100	msedgewebview2.exe	109
PID 6100 wrote to memory of 2884	6100	msedgewebview2.exe	109
PID 6100 wrote to memory of 2884	6100	msedgewebview2.exe	109
PID 6100 wrote to memory of 2884	6100	msedgewebview2.exe	109
PID 6100 wrote to memory of 2884	6100	msedgewebview2.exe	109
PID 6100 wrote to memory of 3228	6100	msedgewebview2.exe	110
PID 6100 wrote to memory of 3228	6100	msedgewebview2.exe	110
PID 6100 wrote to memory of 3228	6100	msedgewebview2.exe	110
PID 6100 wrote to memory of 3228	6100	msedgewebview2.exe	110
PID 6100 wrote to memory of 3228	6100	msedgewebview2.exe	110
PID 4936 wrote to memory of 5940	4936	msedge.exe	111
PID 4936 wrote to memory of 4680	4936	msedge.exe	112
PID 4936 wrote to memory of 5940	4936	msedge.exe	111
PID 4936 wrote to memory of 5940	4936	msedge.exe	111
PID 4936 wrote to memory of 1720	4936	msedge.exe	113
PID 4936 wrote to memory of 1720	4936	msedge.exe	113
PID 4936 wrote to memory of 4840	4936	msedge.exe	114
PID 4936 wrote to memory of 1116	4936	msedge.exe	115
PID 4936 wrote to memory of 4840	4936	msedge.exe	114
PID 4936 wrote to memory of 4840	4936	msedge.exe	114
PID 4936 wrote to memory of 1116	4936	msedge.exe	115
PID 4936 wrote to memory of 1116	4936	msedge.exe	115
PID 5516 wrote to memory of 1708	5516	utorrentie.exe	117
PID 6100 wrote to memory of 1784	6100	msedgewebview2.exe	119
PID 6100 wrote to memory of 1784	6100	msedgewebview2.exe	119
PID 6100 wrote to memory of 1784	6100	msedgewebview2.exe	119
PID 6100 wrote to memory of 1784	6100	msedgewebview2.exe	119
PID 6100 wrote to memory of 1784	6100	msedgewebview2.exe	119
PID 4936 wrote to memory of 1308	4936	msedge.exe	120
PID 4936 wrote to memory of 5584	4936	msedge.exe	121
PID 4936 wrote to memory of 1308	4936	msedge.exe	120
PID 4936 wrote to memory of 1308	4936	msedge.exe	120
PID 4936 wrote to memory of 5584	4936	msedge.exe	121
PID 4936 wrote to memory of 5584	4936	msedge.exe	121
PID 4936 wrote to memory of 976	4936	msedge.exe	122
PID 4936 wrote to memory of 976	4936	msedge.exe	122
PID 4936 wrote to memory of 2016	4936	msedge.exe	123
PID 4936 wrote to memory of 2016	4936	msedge.exe	123

C:\Users\Admin\AppData\Local\Temp\2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-24_7084773cb512ec2d4a064c66d685be95_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe"
1⤵
- Identifies Wine through registry keys
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:704
- C:\Users\Admin\AppData\Roaming\uTorrent\uTorrent.exe
  uTorrent.exe /NOINSTALL /BRINGTOFRONT
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - System Location Discovery: System Language Discovery
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3128
- - C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_46538\utorrentie.exe
    "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_46538\utorrentie.exe" uTorrent_3128_00DB4938_776403245 µTorrent4823DF041B09 uTorrent ce unp
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5800
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=utorrentie.exe --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msEnhancedTrackingPreventionEnabled --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5800.2228.6941982285414833762 /pfhostedapp:efd94085da125003555392817ca6e6f791c85eec
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:6100
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView /prefetch:4 /pfhostedapp:efd94085da125003555392817ca6e6f791c85eec --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x164,0x188,0x18c,0x110,0x194,0x7fff988a5fd8,0x7fff988a5fe4,0x7fff988a5ff0
        5⤵
        
        PID:3832
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1792 --field-trial-handle=1676,i,2273781116607047455,8514309613939117885,262144 --enable-features=MojoIpcz --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version /prefetch:2 /pfhostedapp:efd94085da125003555392817ca6e6f791c85eec
        5⤵
        
        PID:5296
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2140 --field-trial-handle=1676,i,2273781116607047455,8514309613939117885,262144 --enable-features=MojoIpcz --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version /prefetch:3 /pfhostedapp:efd94085da125003555392817ca6e6f791c85eec
        5⤵
        
        PID:1472
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2256 --field-trial-handle=1676,i,2273781116607047455,8514309613939117885,262144 --enable-features=MojoIpcz --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version /prefetch:8 /pfhostedapp:efd94085da125003555392817ca6e6f791c85eec
        5⤵
        
        PID:5504
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3444 --field-trial-handle=1676,i,2273781116607047455,8514309613939117885,262144 --enable-features=MojoIpcz --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version /pfhostedapp:efd94085da125003555392817ca6e6f791c85eec /prefetch:1
        5⤵
        
        PID:1144
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=2892 --field-trial-handle=1676,i,2273781116607047455,8514309613939117885,262144 --enable-features=MojoIpcz --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version /pfhostedapp:efd94085da125003555392817ca6e6f791c85eec /prefetch:1
        5⤵
        
        PID:2884
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4056 --field-trial-handle=1676,i,2273781116607047455,8514309613939117885,262144 --enable-features=MojoIpcz --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version /pfhostedapp:efd94085da125003555392817ca6e6f791c85eec /prefetch:1
        5⤵
        
        PID:3228
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3916 --field-trial-handle=1676,i,2273781116607047455,8514309613939117885,262144 --enable-features=MojoIpcz --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version /pfhostedapp:efd94085da125003555392817ca6e6f791c85eec /prefetch:1
        5⤵
        
        PID:1784
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4312 --field-trial-handle=1676,i,2273781116607047455,8514309613939117885,262144 --enable-features=MojoIpcz --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version /pfhostedapp:efd94085da125003555392817ca6e6f791c85eec /prefetch:1
        5⤵
        
        PID:1856
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4604 --field-trial-handle=1676,i,2273781116607047455,8514309613939117885,262144 --enable-features=MojoIpcz --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version /pfhostedapp:efd94085da125003555392817ca6e6f791c85eec /prefetch:1
        5⤵
        
        PID:6788
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4328 --field-trial-handle=1676,i,2273781116607047455,8514309613939117885,262144 --enable-features=MojoIpcz --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version /pfhostedapp:efd94085da125003555392817ca6e6f791c85eec /prefetch:1
        5⤵
        
        PID:6884
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4496 --field-trial-handle=1676,i,2273781116607047455,8514309613939117885,262144 --enable-features=MojoIpcz --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version /pfhostedapp:efd94085da125003555392817ca6e6f791c85eec /prefetch:1
        5⤵
        
        PID:6156
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4048 --field-trial-handle=1676,i,2273781116607047455,8514309613939117885,262144 --enable-features=MojoIpcz --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version /pfhostedapp:efd94085da125003555392817ca6e6f791c85eec /prefetch:1
        5⤵
        
        PID:6340
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3932 --field-trial-handle=1676,i,2273781116607047455,8514309613939117885,262144 --enable-features=MojoIpcz --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version /pfhostedapp:efd94085da125003555392817ca6e6f791c85eec /prefetch:1
        5⤵
        
        PID:6468
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4712 --field-trial-handle=1676,i,2273781116607047455,8514309613939117885,262144 --enable-features=MojoIpcz --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version /pfhostedapp:efd94085da125003555392817ca6e6f791c85eec /prefetch:1
        5⤵
        
        PID:6700
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4660 --field-trial-handle=1676,i,2273781116607047455,8514309613939117885,262144 --enable-features=MojoIpcz --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version /pfhostedapp:efd94085da125003555392817ca6e6f791c85eec /prefetch:1
        5⤵
        
        PID:6828
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4000 --field-trial-handle=1676,i,2273781116607047455,8514309613939117885,262144 --enable-features=MojoIpcz --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version /prefetch:8 /pfhostedapp:efd94085da125003555392817ca6e6f791c85eec
        5⤵
        
        PID:6572
- - C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_46538\utorrentie.exe
    "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_46538\utorrentie.exe" uTorrent_3128_00DB2F58_1689369720 µTorrent4823DF041B09 uTorrent ce unp
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2420
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=utorrentie.exe --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msEnhancedTrackingPreventionEnabled --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=2420.1308.7808167594126914001 /pfhostedapp:efd94085da125003555392817ca6e6f791c85eec
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2568
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView /prefetch:4 /pfhostedapp:efd94085da125003555392817ca6e6f791c85eec --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x198,0x7fff988a5fd8,0x7fff988a5fe4,0x7fff988a5ff0
        5⤵
        
        PID:3312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://utorrent.com/prodnews?v=3%2e5%2e5%2e1%2e46538&pv=0.0.0.0.0
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2fc,0x300,0x304,0x2f8,0x350,0x7fff9848c188,0x7fff9848c194,0x7fff9848c1a0
      4⤵
      PID:3316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,9535555471182189239,15094034512117082276,262144 --field-trial-handle=2540,i,13810769974059218793,15702457552737021419,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:2
      4⤵
      PID:5940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,4666918629317812696,883126573267295182,524288 --field-trial-handle=2540,i,13810769974059218793,15702457552737021419,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:11
      4⤵
      System Time Discovery
      PID:4680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2156,i,16459297051341464897,11285288381129908020,524288 --field-trial-handle=2540,i,13810769974059218793,15702457552737021419,262144 --variations-seed-version --mojo-platform-channel-handle=3156 /prefetch:13
      4⤵
      PID:1720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,3859094348176906936,3616241777184304449,2097152 --field-trial-handle=2540,i,13810769974059218793,15702457552737021419,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
      4⤵
      PID:4840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,14843057520492241615,6739007184207799602,2097152 --field-trial-handle=2540,i,13810769974059218793,15702457552737021419,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
      4⤵
      PID:1116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,7789142746184218889,16622398792118164419,2097152 --field-trial-handle=2540,i,13810769974059218793,15702457552737021419,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
      4⤵
      PID:1308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,12771831514516035936,5889988567963838128,2097152 --field-trial-handle=2540,i,13810769974059218793,15702457552737021419,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:9
      4⤵
      PID:5584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,11283098793807817150,16192672247501744630,524288 --field-trial-handle=2540,i,13810769974059218793,15702457552737021419,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
      4⤵
      PID:976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4392,i,13692072351869956300,13592252900498836836,2097152 --field-trial-handle=2540,i,13810769974059218793,15702457552737021419,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
      4⤵
      PID:2016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,14051814020057250754,4811606978072276625,524288 --field-trial-handle=2540,i,13810769974059218793,15702457552737021419,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
      4⤵
      PID:4152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,14051814020057250754,4811606978072276625,524288 --field-trial-handle=2540,i,13810769974059218793,15702457552737021419,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
      4⤵
      PID:4240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,12208369208977569464,11594119976320461889,524288 --field-trial-handle=2540,i,13810769974059218793,15702457552737021419,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:14
      4⤵
      PID:6504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,15160628633341507663,11854078778841590709,524288 --field-trial-handle=2540,i,13810769974059218793,15702457552737021419,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:14
      4⤵
      PID:6512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,8794725449040306868,11968947001157933106,524288 --field-trial-handle=2540,i,13810769974059218793,15702457552737021419,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
      4⤵
      PID:6520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3820,i,318725559699263018,167157384721721782,524288 --field-trial-handle=2540,i,13810769974059218793,15702457552737021419,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
      4⤵
      PID:7016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,10789172230520814175,7431295323932080693,524288 --field-trial-handle=2540,i,13810769974059218793,15702457552737021419,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:14
      4⤵
      PID:7016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,16863917246322039394,13913468408505558409,524288 --field-trial-handle=2540,i,13810769974059218793,15702457552737021419,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:14
      4⤵
      PID:7084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,14059774730358506187,2501552003537633792,524288 --field-trial-handle=2540,i,13810769974059218793,15702457552737021419,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:14
      4⤵
      PID:7132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,8987148044524828884,5089496530829325823,524288 --field-trial-handle=2540,i,13810769974059218793,15702457552737021419,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
      4⤵
      PID:6624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3840,i,12242981206835214557,18097159300896258509,524288 --field-trial-handle=2540,i,13810769974059218793,15702457552737021419,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:14
      4⤵
      PID:6900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3780,i,6901548994239716310,6040802537993128400,524288 --field-trial-handle=2540,i,13810769974059218793,15702457552737021419,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
      4⤵
      PID:5952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,16555979349872257831,11919107703051309262,524288 --field-trial-handle=2540,i,13810769974059218793,15702457552737021419,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:14
      4⤵
      PID:4220
- - C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_46538\utorrentie.exe
    "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_46538\utorrentie.exe" uTorrent_3128_00DB2F58_1951613296 µTorrent4823DF041B09 uTorrent ce unp
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:940
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=utorrentie.exe --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msEnhancedTrackingPreventionEnabled --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=940.5620.15396996820015169290 /pfhostedapp:efd94085da125003555392817ca6e6f791c85eec
      4⤵
      Suspicious use of WriteProcessMemory
      PID:412
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView /prefetch:4 /pfhostedapp:efd94085da125003555392817ca6e6f791c85eec --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x198,0x7fff988a5fd8,0x7fff988a5fe4,0x7fff988a5ff0
        5⤵
        
        PID:5488
- - C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_46538\utorrentie.exe
    "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_46538\utorrentie.exe" uTorrent_3128_00DB3180_2047110072 µTorrent4823DF041B09 uTorrent ce unp
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5516
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=utorrentie.exe --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msEnhancedTrackingPreventionEnabled --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5516.3932.11111002140324265202 /pfhostedapp:efd94085da125003555392817ca6e6f791c85eec
      4⤵
      PID:1708
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView /prefetch:4 /pfhostedapp:efd94085da125003555392817ca6e6f791c85eec --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x1c0,0x7fff988a5fd8,0x7fff988a5fe4,0x7fff988a5ff0
        5⤵
        
        PID:5840
- - C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_46538\utorrentie.exe
    "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_46538\utorrentie.exe" uTorrent_3128_07FB2CF8_897800496 µTorrent4823DF041B09 uTorrent ce unp
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - System Location Discovery: System Language Discovery
    PID:3816
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=utorrentie.exe --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msEnhancedTrackingPreventionEnabled --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=3816.6280.8167553312861477959 /pfhostedapp:efd94085da125003555392817ca6e6f791c85eec
      4⤵
      PID:6292
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView /prefetch:4 /pfhostedapp:efd94085da125003555392817ca6e6f791c85eec --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x19c,0x7fff988a5fd8,0x7fff988a5fe4,0x7fff988a5ff0
        5⤵
        
        PID:6160

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}
1⤵
- System Location Discovery: System Language Discovery
PID:4240

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 6e5be0c7222f4878be585d62c42986078dcf8d1b415fd1f25e75c9f5d3f94eec
MD5 69be30842c13546b74214b3432bf179b
SHA1 f8a39cdcb0c2bca2e53b333905180b22570d029b
SHA512 279f61a902a0becc89a8f73f2e26144fc4362172ccda15a6a8472d6a4153974cebfa1f114047616529efab809fceb23c1f3ef568ec83a326e81f6c3cb2b73019
TLSH
T104D02B7222150932C62431374191E5586100D52F800E40401E35FA6D0A508E10CC3881
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 bb3c40f2573c3b6cb63193189c7c8b0c21819edc307dbbfce5745730ff0a8bcb
MD5 628f00b825de008c7ccdaa807c4814f2
SHA1 10c3b406fbce1b18e154f19385b153f6c48649af
SHA512 4d6565d1ab6132b935fd3b17ce3f9c5fa0027a15beaa5f945761f4ed1bd3279cc773c3a8001ead30f2765a8ca08838102827220a9647ccc3e9df1188dec72fad
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b97aafa87628bf023d56797953d5463a6dfc4b1a7f529d3163c61e919f12d206
MD5 1f5a0b246ac41836b567f36823f1fd07
SHA1 03c8897c4b40b55de5526ba68b67c8b871cc107b
SHA512 466fe980c1f0a92605369e853365a6534c2c1b6d7135b7ffe9d51fcbd9eec625f41a63ed62ea6edf8e8f9b8ceef8aed5cf932279a408fce745945f53d924f2ba
TLSH
T1B9D0123236410535C42030330122A5091500E51FC00D40405428866E1A248945D43491
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

6d68d762-abe2-4312-8ac0-7e35d06559d5.tmp

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Default\Network\6d68d762-abe2-4312-8ac0-7e35d06559d5.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5b3d54.TMP

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Default\Network\Network Persistent State~RFe5b3d54.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Default\Network\TransportSecurity
Size 188B
SHA256 2281fd3105951474e79275afc4b1cc32d996ce82f6be3d9462e8daed92cb185c
MD5 94e6299e637b05dbc98ea3521fd8052e
SHA1 dac0d24e68bb620cd5c696fd1290204f7f4d16ba
SHA512 85406d765908dad750344b384196a1a783448cacf00dd9b2f4286852f1403a2fe1631afbcd4ceedd87fb1553dd9d09f22db0706607379e373020b6735a7f62c5
TLSH
T137C02271402EA23A103A45224D887D496E7EB134004268E89292822850401BB5203002
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5a85ea.TMP

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Default\Network\TransportSecurity~RFe5a85ea.TMP
Size 188B
SHA256 d361a9ad2a05235a7d89ad48a1c9b37b698f4936edb20ef96240fe7454b241a6
MD5 a7fac69c03995fba9514d7d03f66c268
SHA1 e0bea279e9318a6d086527d40c043abf5252e4ea
SHA512 f5a72422a53c9616f2f0b27515d8ee6aded2638b44d39ff48dd7ace43b6a72e47cfe76bedbbcddbebcc1c95f247e06ad739a512ae96f357fba025b8666c4d64d
TLSH
T168C0C061803DE0F21038053B09E07D415F7EF13400C16CECE153833C90400775203483
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 6b41c92813ed0f95cf75292d2c583bf1e526183c6bd10ef967ef1d90dbac6dd3
MD5 1b0b0f502edcf34489c89ca0555bd177
SHA1 9a6436dea864b3f7345763b26277fbe9fb272b45
SHA512 66ecc1bc1daf188fead18882f105e43b0f461a65999afc78dc69404036bfdb397f0ce8643d934b6cd1e7aa759175b04c851b247819252204fb2ce04d76e978b1
SSDEEP 96:st9/dcsHV9b9lBdo5h16ZWycws7YBbcN6Sx+6MhmuecmjeUK+giUub28XM1C7K:stBy8nopfwskBYN7+FijY/ubG6K
TLSH
T145D1A6569E6869BB4CC6E559BA35BF03E2F9603234911E48EBF8862C04D79DC6307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5a61b9.TMP

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Default\Preferences~RFe5a61b9.TMP
Size 6KB
SHA256 80849a9c51097f89f7a76abe6d8e782f2b2a7ebd0f276d4b3165b73b9b796f04
MD5 db40b6fa026cb594fb097a314f272f2f
SHA1 78f4d23f97833810f99caf797e24dc9f20d4b769
SHA512 24bb9dabfd3f99277e00ed688069fa25c898e6dfddca81d5a127af2ea61ab730bcbfa73bc78311d41455b155a52fd52aae2866427afa78da3563368b6261a8d2
SSDEEP 96:st9/d9sHV9b9lkdo5h16ZWRs7YBJHx+6MhmuecmjeUK+gKub28XM1C7K:stBv8AopRskBv+FijYIubG6K
TLSH
T19AD194566E64687B4CCBE559BA357F03E2F9602230D51E58EBF8862C04EB6DC6307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Local State
Size 3KB
SHA256 e5b44774b17b9626d57f5c4a8a35ba24e963d5a4af5ffd8e7a49ff44e0d2cf71
MD5 52d8700cdc61b30d5c0d7e27f1c49cdd
SHA1 ed988f6bcd5859877986d77f571d4b3bc677c048
SHA512 61e98750854793e62d23a5fccb644cdbd8f592444ac9792f3ab6b1e6124b07a48297f34f411fe972398e75dc81a635eed88960fc7b45bad11d71e6da78040bd0
TLSH
T11371977AA9A079774DF38904BD462F03B7A45137E5913F64D9EC0F0D01D72881352C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Local State
Size 3KB
SHA256 a84d9c8ad5ea253c047d09182c16ebfb6fc136a55f68c54dc5ccc188c56effe1
MD5 ad03af5e05f0485e9bc94a319eba43bb
SHA1 c17a725d32d8ab64553ddc02107a8e30a3564a11
SHA512 94ebe5a4ee5cb167118039876558f3234b11e6abd3725582fcf742ed862b2fac49fc7e6a6655a91a41386a94dd46e409fc691cd0992168f2c071053c8d2865d1
TLSH
T19171867AA9A479674DF38504BD462F03B7A45037A9813FA4D9EC0F0D01DB2981392C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Local State
Size 16KB
SHA256 6664fd50f7c451d6669812041d46d692cbc59daa7c0a582754c95785559371b6
MD5 f28b9d4b6f9896904ec00aaf661aba05
SHA1 beda0746f352740ee70fa14aa413cb90f5e853d2
SHA512 022688be8ac3b19486871aa476eb4e5afef2914f3999b4bfe41b40dfe3b40949a73b5f8e58087f888cd3c530a4b355a94b432b6065e1ff0e584253882c92f113
SSDEEP 384:I+aQikB+z/xvxjg/qhEbu3NbFdw57HDFu9zS:H/UxvxjgC+bbbcFS
TLSH
T13D729F3B59643D2799F3E5447E491F4BDBB498B394C26EB48EAC4F0A07C72D81342C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Local State
Size 2KB
SHA256 3dbdc1dbb0bce00f85648cd26cdf33735bdeeb9e6831880fb97866a61b73eeea
MD5 f55cdc72dd29aa7590be14fd94d350fc
SHA1 48c94106ab29eef44584da8673eaa5adf84bfe17
SHA512 5be0572b124556048b63fd7b8802795c72a563401a0c0a3e2858e3e014aa7c3193f1e6530ae95d7d5ca52b77f1cf2da86604ce9dc24742e02a19f16e7701f0a5
TLSH
T1F251D7B3AD503A778DF38648BE1A7F13DE749162BA521F209ACC0B1900DB51C2787C32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Local State
Size 3KB
SHA256 098e23a788aa824ae6308b0683c031e14cb99f1eb9e830910eea05e34106ca91
MD5 59e0cbf66714dd45025f77d1a52e3abd
SHA1 57d24aeaa373db5e8bb00bfd3a4ab10bec0ecd3e
SHA512 1befd16dc17b472f4215e1bd4361b9a1de9e393a04a62c78073505e55724a14ed897a04b0571cd2cdb544923bc8d2bda87bcbb0e0d8913351c3f2f80708d491e
TLSH
T15671847AA9A0B9774DF38A05BD862F17BBA05127E5913FA4D9EC0F1D01D72981392C22
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Local State
Size 16KB
SHA256 b63572d83d8b483fd574adec0da2f39ac23d100b33c67748a11392ae8669d9d4
MD5 8fa7e5eb34552aaea7bd11ce1ee91533
SHA1 3839f0d931a09d4bd13ffe092c95639f46f42474
SHA512 b51bc00a0a5d0ac85f1f707f0044033db5c7bedeb17bfeb06a50f82bf0f1c8842a1f50de7a66c0ad5dea29ca97c7439de2843d2b80b59e4e881b4ab8a3e526ec
SSDEEP 384:t+aQikB+z/xvxjg/qhE8u3N7FAwL7HDFu9zS:4/UxvxjgC+8ibcFS
TLSH
T107729F3B59657D2795F3E5047E591F4BDBB8A8B394C26EB48EA84F0A07C72D81342C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Local State
Size 3KB
SHA256 82540753a7a70ccdb18dbfe881b56e8c7a684ddf4ed30bfeb7961511b7932218
MD5 38b1323cb043a2419b169a5e95dcd444
SHA1 c1c179353bd2b18b57f4d5ceafa860fe10555e73
SHA512 f406c86e204414266c72512f894ac1a9205beeb1b55197443de5867bf49e4ece9c9a719b989e1ca55e4ca51570ef2e026262a8623578e5eda356d57432605176
TLSH
T1FA81967AA9B079274DF3D508BE463F03B7A45027A9863FA8D9EC0F0D01D72981342C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5a12ae.TMP

Path C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Local State~RFe5a12ae.TMP
Size 1KB
SHA256 14e9810864f7fae95c19b419fba1e372d91bd76afbddeed1bf647c42660a117c
MD5 bb91db0ffcb4ac5730e2abab20f15bd4
SHA1 987db0877f513910d68dc7ad3019148c834a94be
SHA512 1beeab8e71049f1a25f29fb10d0dec320222ef68483941eecb4dfafbb58c8f71a7694428c593b4216f0e526e439f66ffcb51873a2de57988f7372233f812d782
TLSH
T1C13196F2E9903E33ACB751467B16BF836E605076A2120F1065CD472A11EB40C5B6FC32
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 7331d61b72578f10058ae20f1a7351dc99070a754006884c0b775bb57bffd9cc
MD5 df1098b0a62fea8609e624a81ae2865a
SHA1 eb148addd613d8dae155058eacdf967eae295b15
SHA512 0ec5916b4d090394f668a1ee0ca76c2125146f8b8507c9e7dd1bb90a8aed21e61551b85c2a32b975aea241df7bda238c513a58ebe378cd3af3d77e71803ef6d8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7s:fwUQC5VwBIiElEd2K57P7s
TLSH
T1D2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a9db3b181fe23d2da858b764c2d3bc2baae4a7e217d8cc5885ed34c7b21166b7
MD5 c2e18a2143bb27e5b37e2d5b65c09643
SHA1 43bb7d235630acc17d81e04e37f3cd25e299ecc7
SHA512 08f1e7fa966122b22bea5e316c89298987fac4c53be675ad48a1c1c8a784dc7b1d8789be8d1abdb8cdb59c14d6757e0f1934d0a56d919c8fb08e311621fe4d9c
TLSH
T109D02BB0B77DCCD3D00310FE0015AE0421A370159E0402802302885844001041101358
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2664448b8ab4f4edce89a8c875c31ed1e748ff3060fa1567c434149210bb4fc5
MD5 35b0bc3bbbf168c9b6c74d3bc119d3eb
SHA1 3dde0e79982d9dbcf2dbd3045bae0a5bc63e14cd
SHA512 9c5f83f731b8e4bf7f7e64c2e51191192b13fa5260950a1fcade843318dbf7d5b99057f3ca893e35cb6c19942f5b5852e7124ed01f7c46e7de9bcea70152fc0d
TLSH
T173D02BB4B76DCDD3D00310FE0014AE0421B37015EE040280230248484400104110236C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d04b4f0871eda0db6b701fe9e3bbae3f683daa46cc185942d2fb8646555346e8
MD5 98662561fb5416455a9c1e5adda49a81
SHA1 6da4bde271176f77309691d9727c57233413e347
SHA512 4e7728a9f5efd60aa5569d5034c98c50b0074b68c2969d215678493df077ba5d5efff9f993473198797a30b47a5137fc66925c50df12f99e5cf8fae4d8d7e6c2
TLSH
T1AF71D748A39D4E9FFBDC7330B5D8B6A7BAFC4CB646470EA115AEC0B86A1775D4188800
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a87a0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a87a0.TMP
Size 3KB
SHA256 ef79fc8904c33395f35eb8120ea4f74fda2eb74cd7a1bd59bc44e98f78a14d64
MD5 083d1894e9b2428b9dac2270b83fa083
SHA1 69766e5edb3212c3e22ca291607690937ff80c4e
SHA512 ad00f5d589c640373f2cb2cce0804be772e81cfb5f47f2b10edd1faaa83191c143f5ac16f118129b3975aef575ce02f2e90f39e6f738196f3039d0cf12bdcba9
TLSH
T11E61925C935D4DAFFBDC6371B5EC72A7BAFC8DB045471EA218AEC1B8690B36D4188800
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a76edbd-28e1-4fe8-83cf-051b1064c3d2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5a76edbd-28e1-4fe8-83cf-051b1064c3d2.tmp
Size 4KB
SHA256 8c21b5c24fe884c8391a8aae80aad24584c4a20fa0ac8dee3e6fea54962b9a84
MD5 8c3f173830fa283596e1719e2f546d56
SHA1 71a7e06d05820042baa18f8970946c94324a9d34
SHA512 437490147fb0bb7b6d6a426b574703f7f8e70430044815e306aefdb322bb4f6f3d820f91ad5ce94a148f7ef459af42e00c730f3d4718f93440de1117107f57d1
SSDEEP 96:DPOhKh7+hkhjbDda7gzBhrhQhSh/GhrV6hlhvh7mGhk1iwQ:DmA0q9bDda7g1ROcEFV6T14G+1iT
TLSH
T1F6A1DFF7C7E4952DCC215AF0AB156E1BCE5D0914931C3D9AC8E4AF1B53E24B0E241A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

f0edb396-9bbf-42c0-bd38-aaa1c943d1f1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f0edb396-9bbf-42c0-bd38-aaa1c943d1f1.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 840831d6234380845ef2d01183b3b203dfbf098bda85850eb29b99d0d02eb04d
MD5 33ac4638b29cadbea9b7d31673037e27
SHA1 08d920da4f07fcaf7ae72e7032af8690a4b588a2
SHA512 ae72a5df86bfbd553c06126751d3bbe0fef0bf16be6564dd4e9ecbcfec8cb6de6cb553c71946f3ea1bdd80424817b236d57009f19ab13aa59be7575e2dfade12
SSDEEP 192:sxRuRtCMV/feDs5vjZpbqzoA8pY3F/g6+WNl7c/EmeVIFYbxRSqUIG3IgD2IJ:sxRuWMV/fis1NFncF/5y/KV1Urj
TLSH
T1F542BA5AAD786D7B4CD7D25DFA55BF63E2F91032A0951E44AAFC8A1C00E76DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3f2537eae2e67f47dce5a7d230929cf154f484fba7a7c398e6c570ee25667374
MD5 e9e698debc389310e5a118bcb879e32a
SHA1 ee21fe1976e587c80c416682b02dabceab49fc10
SHA512 1b7425888d9271a99a58613706a0c6d7dbc8981e44d6e4f81e7702e3f3e899a5f7146b021c48540e46b1e5774ecb719f59ed4c9cb3c79e789629824ff26348f9
SSDEEP 192:sxRuRtCMV/feDs54jZpbqzoA8pY3F/g6+WNl7c/EmeVIFYbxiwqUIG3IgDsIJ:sxRuWMV/fisKNFncF/5y/KVaUr1
TLSH
T19F42CA5AAD686D7B4CC7D25DBA55FF63E2F9503360951E44AAFCCA1C00E76DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 86b646a7dcbd168cb8b516f1afc88a6247eab1a7d724d2bdf8d11b8c7d71630e
MD5 3e5bd486225f52ca67b699314d927039
SHA1 ed0f9fd2111fb3f140f335b157eea6f9739c5bf8
SHA512 7d96e4abfed07fb5467a013e96dc90aea88310e9b40a7408046b012cbf7ccf359357a0935ec684a65fef2d7882454bf6ce164e090f6e1ca1a7729da2d266cdaf
SSDEEP 192:sxRtRtCMV/feDsxvjZpbqzoA8pY3F/g6+WNl7c/EmeVIFYbxRSqUIG3IgVIJ:sxRtWMV/fisNNFncF/5y/KV1Uru
TLSH
T1D542A95AAD786D7B4CD7D25DBA55BF63E2F91032A0951E44EAFC8A1C00E76DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 cbe630ce488f1a9bb80ebb80d49daa9419bd28c5a5cc5d32f94f193b47d37cfd
MD5 7f43914dec95b11fe3c95f97c03069dc
SHA1 6b0a7ae6b29fd4f9b95fc66bcfef89659c40ff82
SHA512 fc8202fca521b2611b1a8d04ace0250dbf08608226d324e251ab649a7424d07eaa8ad0635c6f256bdee3e9036b64dcf085c19cceff672fb45bdd456a00b60f84
SSDEEP 768:zBDnEx7pLuLbYFWgbjfkW8F1+UoAYDCx9Tuqh0VfUC9xbog/OVko+BK3nroDmtTo:zBDnEnEbYFWgbjfkWu1jabo+030Dwo
TLSH
T13AD2D97B684CCA7F4F800A9D9C197E9E6DA802CB9698CD4047FE945C02C7BEF51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 59f0f02b83d67e7f9178c5744dccbb92da360fed4684a7ab54360738cea0ce43
MD5 2776d1724f8f86698e6da69673adba90
SHA1 00370116581cec9da349da4e1166ec971bebfc1c
SHA512 ee17000614a77ee1c0ad209e974b348001411ac4e5dd2fee48f56a0f212046a838d15c0ba02b2a8473735828b380ecb91bad7beead74184484f7b980e75aefc5
SSDEEP 48:KkqIPKL6wXyxiIfKj6AT0ITKFycnyZeI/Kb1:Kkq8KL6SyiMKj6M0QKFy+6eIKb1
TLSH
T13CA10320707B52407A3E251C80D4A66EC65276B73428E6AF3BED05A14E77E184EFDACD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5b02db.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5b02db.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 9e9a9a953c0e5d9e0489be9c1ba474f4fd821f3fe900e3335a039728ed47c7ea
MD5 0061ebf3f92e9bf956cfb2213efdf4ac
SHA1 13eba4639511bf5e5e26c113e50917faeca480c4
SHA512 be8928cefb552faf9a625702929081899590d807ce4d00f5f64bc5f82b31501790a19f5ab6b26afb20a12eb076d15e09e97300a5f06e10968cb5570c830a7fb9
SSDEEP 768:JFwX3HwgDvROf7fjfJ/GJYe1ELsAvC8/YE82siSw:4X3yf7fjfJsYe1EQujYV2svw
TLSH
T1301318F198E78976E9AE5787A77D6E029EBCC113B4888584B7C51E0DCC831BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7b9b883f4025a8cecdb942479ee71b2be2ad68e38c9db5a8edbd6ee795f90032
MD5 0cf8cf59cd291be4e13add292ea53f6d
SHA1 5e876d54049c25ea12f2d812039176b2075ffb26
SHA512 a1029c5c7e154103d80375b5b8d2e1e6cc283d898d1e74e49a8dbf7449cad6aaa0bf67c13acdb99026fdcc2d2511540340881fb3abaffc93be7ea76e49809330
SSDEEP 768:9/UxvxjgC+i3D39TOf7fjfJ+yJYe1ELsAvC8/YE8KKB:gZj3+i3kf7fjfJXYe1EQujYVJB
TLSH
T10903BF71ECA99D335DF2A298774A1B53FFF4452384C45A68C9D92B0E05C33AD270F85A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 b25aabbf356709a4d9cf51be96ae63102f3ad6df9e303b61e533206f3876cca6
MD5 dfe21d78cc1d72ec87f05b4a93e2be51
SHA1 39207c68100791974d4ae887ec895d33d68391cc
SHA512 b80efb8a5fbe72a717e4b63fdf1968c0dc45049f8ec5d7913df6e99a138883a522064200d79a314d179e5b149bbfb0a1ea7eabbc6e412896da8d8eca36998293
SSDEEP 768:rg3V39TOf7fjfJ+yJYe1ELsAvC8/YE82siSw:rg3ef7fjfJXYe1EQujYV2svw
TLSH
T1ECF2AEB1ECB5CD771DF6A289B7462B13BFF4412394C48B54D5D92B0E04836AE274F82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 7d345cb46af40b73c58742932292afa35786b6d70798bc6e59e1299353fe5cf9
MD5 1727a174c187dc87488cd1ab50047d7f
SHA1 dfabedff9265b8d94a664eabc89d5ca00acf0af1
SHA512 d8836148133267e0b0243c938ba5ba40988a240ccdc5f431da7c841c24728d4bfce4ddf967094239528c7beac816df74fce7f2f03e9d333bc43b8efdb783d166
SSDEEP 768:ag3w39TOf7fjfJ+yJYe1ELsAvC8/YE82siSw:ag3nf7fjfJXYe1EQujYV2svw
TLSH
T110F2AEB1ECB5CD771DF6A289B7462B13BFF4812394C44A54D5D92B0E04837AE274F82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 6616671d44ac025afa0453a97774d3960918b42e78bdd67aceb765d95dd2128d
MD5 68114022d61cb9ed9b6ef8ebc5d9eb5d
SHA1 2ea5363613d86172ea33127146aa339d709a8f3a
SHA512 950b1be79fc3ae3e98b1bee3e4c1d495b8708e1d60ef6de9a4670f19ee8fdece5fce9a521d587ff0d3f07829a6d0a1e0f03c55e367995ba4fcba0afadf87b086
SSDEEP 768:h/UxvxjgC+i3k/9TOf7fYKJYe1ELsAvC8/YMf8SHrkw:0Zj3+i3Tf7flYe1EQujYBS4w
TLSH
T1D203C031ECA49C774DF2A788774A5717FEF8812395C06AA486DD2B0D05C73AC630F85A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4936_1131604045\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1f91d2d17ea675d4c2c3192e241743f9_a467fcbb-2f37-4473-b47b-6fb52ffaaf67

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-53044966-3830981193-2402648431-1000\1f91d2d17ea675d4c2c3192e241743f9_a467fcbb-2f37-4473-b47b-6fb52ffaaf67
Size 1KB
SHA256 cbe9e5a8527ed4bdbd0178f6c8812226e766d5fa8a279c17ed6ac273292ed4dd
MD5 cfe2e3c7cd264ff389115289685526a3
SHA1 dec051845357ac30a49435b7f71cf7e83b0239d4
SHA512 16955a4cba792930624d8560d266bd51359fcd5033b454896bdb03fe95e9b6f2067fcf20942532b4bf54ae3d8a40287dfa02f9cdb30a2dd12a5731426357d496
TLSH
T1C131C974B25914D1FEA2A271179B1DE401D68C26627F9D923B79A0B74221350C3947F3
MD5 SHA1 SHA512 TLSH

Submit Download

165F6EF40A81DD175FFAEA69E77ABFD30B27E71C

Path C:\Users\Admin\AppData\Roaming\uTorrent\dlimagecache\165F6EF40A81DD175FFAEA69E77ABFD30B27E71C
Size 1KB
SHA256 ec9e7c253d599175af470832da851cf4f59614a4c4d4e37183159801b13abf5f
MD5 4280089022fce23da2c64031bf137c08
SHA1 0380334f420bc6677795fda8f5201c1fb7355c1c
SHA512 9eafb6f30baf09a32601b1f9da1316e1fcc44256784221da85f54718de6f0539c2bb601feba194c2ba801c8b95834f5029c93e3508f79daddf8c3343fc848a05
TLSH
T19621354CF54454019949FC4118EFE027892748C0E5D0F6A5BCCFDC5E19641F681658DF
MD5 SHA1 SHA512 TLSH

Submit Download

helper_web_ui.btinstall

Path C:\Users\Admin\AppData\Roaming\uTorrent\helper_web_ui.btinstall
Size 7.4MB
SHA256 4325244a7c1b300cd6006c6d4d8ee6335c4b04284b3677748de614d6acfae86d
MD5 670665adc104762488096e84624fa384
SHA1 b76a77a5d1f061434e4dd2691e5cd5855a70359b
SHA512 537ce79e9be83aa2a7c02f23903e759238eac34d7d37f11d616f7f3d9c3011e1d52dc6286454176bc593a9733cae7ba0e1361e2d6d4619705fdbe8f68261fc4f
SSDEEP 196608:Dtcf3YdAkSihw+MDq3dxfrZ28O/dDJz8Mpe8dmT88ejj41ZPTnUz:DtgISkSiyq388O/dDJz8H8dmhSAZPTnU
TLSH
T1AB7633FCCFD5A011E26A44F1DDBE0B799AC51D31B03699319B1D6B0B0873D4B96ABE80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\uTorrent\settings.dat
Size 8KB
SHA256 cb76f715f65bcae3cf5bdafadb6a23a2d22330142cf009d60e726a3c5f549988
MD5 5526faa4642fdfe5925b7496c5889bdc
SHA1 3f3022d55ad966eebcca39c79811fdf3fc994cf6
SHA512 332e138c43dc3c8b97e43aff58073aaa52f78bd22a6f9324e1650573c78b67c425eb8a472e55f68cce93d4056bb2efc60d48d31af3f799493f5670121896c05a
SSDEEP 96:11FT09J7DlflTlt8Aa0L0ixIWrjg97sFa50e9AWyifsJ:1rT09pvENHmvU97I49AWyL
TLSH
T1DC020A214CFBD974E86E803F4A7E0146767A3B40D4B1FA11E0A997F83112A4F0CDBB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat.old

Path C:\Users\Admin\AppData\Roaming\uTorrent\settings.dat.old
Size 7KB
SHA256 68dc29349d42b2827517e158bda7a62f6a065e543eccc42d24ab9ba4c5be6d7f
MD5 1c7a6db39153daa00736647abe237780
SHA1 21f288e5b194676dce71a2324e0f12598fdef526
SHA512 57b2bbf83f2071c2915ef214d9262b1055c1907043c5abf91e824f4184f146640b7a6b930593e95d0e71c8907619827019bea274f546b65376609e80610c13ce
SSDEEP 96:C1rT09J1lflTlt8Aa0L0ixIWrjg97sFa50e9AWyiaJ:CFT09/vENHmvU97I49AWy1
TLSH
T159F1F9224CFBD570E46E843B4A7E104675762B40E5B1F711A0AD56F83112A8F0CDBB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat.old

Path C:\Users\Admin\AppData\Roaming\uTorrent\settings.dat.old
Size 8KB
SHA256 1b63c863f9e204d4276a85702b8b93550460dff8a74cd5dd32e65178935fb635
MD5 9946fec0292c58a2a64cfbf4ead31661
SHA1 5332f5faac67bdb867f4bd57931adbe158a9f1f0
SHA512 f4e7e58ac45edcee748bdc9218b19ff658efcf6e0a5adc681b34323b92cbfd0331e75e52008661f455409c1fa8ea7acaa6b9ce0e29d25466536195ee152c62a3
SSDEEP 96:U1rT09J1lflTlt8Aa0L0ixIWrjg97sFa50e9AWyif8J:UFT09/vENHmvU97I49AWyl
TLSH
T15D02FA225CFBD974E46E843A8A7E014676753B40D5B1F711E0AD97F43152A4F0CDBB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

toolbar.benc.new

Path C:\Users\Admin\AppData\Roaming\uTorrent\toolbar.benc.new
Size 170B
SHA256 00e692c89f15c8b3d6604cb4d12a6da7bdf961a10f5cd1a56ca50b969832ce85
MD5 affa446d5b6c912a78e513f752e33eb7
SHA1 e4664f0d2cfe7679e26e2f367fb94aeea7e87618
SHA512 2b1525d4860299ec42bcc15eeb36728060982c262b6f6c3326e96c35d2cda66090873e7d0de4c54384b136ed8636f79fe06a7b5481f3067ea771cd9d7ccc2f46
TLSH
T1EBC0C0200BE815000B3788D120FC303F38C1122010C23706C8874B248C853544BE0450
MD5 SHA1 SHA512 TLSH

Submit Download

uTorrent.exe

Path C:\Users\Admin\AppData\Roaming\uTorrent\uTorrent.exe
Size 6.0MB
SHA256 053d55e3059c9829fc7ea175b6f69bec8cddfcd733f7d678d769862398e5e6b1
MD5 7084773cb512ec2d4a064c66d685be95
SHA1 aa8ec52c9be8e72a8968209add6ac5ca1b0bf5e0
SHA512 43d80dc855ed62d5f008fac1c500e655016d609b37b0254b55cd9c48aa393103d712a6bd94d65fa12507fc8e7096b5f68fcfcd7589f64ea4fa30dd62e6e1e467
SSDEEP 196608:UgJchjqymNVwBhLrk3rDflf4XTP6iI5dCGioynrZ:1c1q1MLrk3rDflf4XTP6iI5dCGioyn
TLSH
T19656BF12BA85C079D3E20070092B5B5262BBED745B314EE7B3847A6E7A74DD2453FB23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updates.dat

Path C:\Users\Admin\AppData\Roaming\uTorrent\updates.dat
Size 344B
SHA256 13e028bd8561b518da14308d7e8c175f1d372b67e5fd5b86d32f6d9f18915ecf
MD5 0c5a2ddc3c70abe1f702f54c665a45d3
SHA1 4995d72687e587c89ddbed3d635b686bb89723fe
SHA512 1ba2170028dee207f3dd64c5a4cddc4a13e876ad89e9c1292e42395618da3d1ab22879a36b0fd566103667b419092913406940b797eee20d4c762e0a07c75caa
TLSH
T189E0C07444F4C21F35208FAE96B434F1937564C5580457B48043098C98408344AE5D09
MD5 SHA1 SHA512 TLSH

Submit Download

utorrentie.exe

Path C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_46538\utorrentie.exe
Size 690KB
SHA256 21d3d396ebe4a29f21a098ab5a0948db5ec045a98e0d88ee644ea2ef695d65c0
MD5 feff4d66db6978490f5de5e6885ecd60
SHA1 c032f43a9119481bc8b865c81fdaff19eedfa101
SHA512 f7a2873ff8e7bb58f306c795df1a9b052f9fdfc4f1fe0fe56c70135bf0a8863ef693b67ce0ca34ae7111bbb1ecc6b0622c0dd14dbba6be4ca60616536da83257
SSDEEP 12288:ze61Lrk3rDflf4XTP6iI5dCGioySpPplnOrrkB159EBRKFiTkU0Ja8Sav4awrwYG:zrLrk3rDflf4XTP6iI5dCGioySRO/kB9
TLSH
T1F0E47C217581C036D67110B11A69ABF591BEF9365F7249CBB7C01B2E1A352E22F31B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3.6.0_47254.exe

Path C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_47254.exe
Size 3.7MB
SHA256 e2837e13d80e4602b0c2d711c6d6c17217f4a80c8ff0b33dd90df219f025f3b7
MD5 7b1bcf79461ed67aa315a4e156dc83f7
SHA1 d15d84e371af61b2497d0f825167d8d19caa9ea6
SHA512 3857a4642a0e5911d46a96ee66309fc414997b347500dd90e8a88f8c578de615849d24ce02080cb30633ec822e2ec2e0503ea86819ba05d3a9ef795cb43c21f4
SSDEEP 98304:yg3iGC5mAyFoVCVMZUkPk0XdC/eBWLhR4qdGcQi:ywi95jooCM+gC2B6hR4/O
TLSH
T145063361E664FC6AE57885F5008B53CE9C63BC07F26C2BB387A1363B7B312415A94F49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/704-0-0x0000000000400000-0x0000000000A4A000-memory.dmp

Download

memory/704-21-0x0000000000400000-0x0000000000A4A000-memory.dmp

Download

memory/704-37-0x0000000000400000-0x0000000000A4A000-memory.dmp

Download

memory/1144-169-0x00007FFFBA610000-0x00007FFFBA611000-memory.dmp

Download

memory/3128-36-0x0000000000400000-0x0000000000A4A000-memory.dmp

Download

memory/3128-465-0x0000000000400000-0x0000000000A4A000-memory.dmp

Download

memory/5296-150-0x00007FFFBA610000-0x00007FFFBA611000-memory.dmp

Download

memory/6572-804-0x00007FFFBAE00000-0x00007FFFBAE01000-memory.dmp

Download

memory/6572-805-0x00007FFFBA8D0000-0x00007FFFBA8D1000-memory.dmp

Download