Overview

overview

8

Static

static

3

bittorrent...er.exe

windows10-2004-x64

8

bittorrent...er.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    63s
  • max time network
    64s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    12/10/2026, 16:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    bittorrent_installer.exe
  • Size 2.1MB
  • Sample261012-tkcmyaea95
  • SHA256 f8d8ac37185f0af984d2332004dd840e7ca76f6a5ecc62c2f877454f2c19ed46
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoveryinstallerpersistencespywaretrojan

Malware Config

Signatures

  • Downloads MZ/PE file 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 11 IoCs
  • Identifies Wine through registry keys 2 TTPs 6 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks for any installed AV software in registry 1 TTPs 9 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
    defense_evasiontrojan
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
    defense_evasionspywaretrojan
  • Script User-Agent 5 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bittorrent_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\bittorrent_installer.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2864
    • C:\Users\Admin\AppData\Local\Temp\is-5W4K9W18TZ.tmp\bittorrent_installer.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-5W4K9W18TZ.tmp\bittorrent_installer.tmp" /SL5="$80040,956312,932864,C:\Users\Admin\AppData\Local\Temp\bittorrent_installer.exe"
      2⤵
      • Downloads MZ/PE file
      • Executes dropped EXE
      • Checks for any installed AV software in registry
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1096
      • C:\Users\Admin\AppData\Local\Temp\is-ECUHU80OUU.tmp\BitTorrent.exe
        "C:\Users\Admin\AppData\Local\Temp\is-ECUHU80OUU.tmp\BitTorrent.exe" /S /FORCEINSTALL 1110010101111110
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5004
        • C:\Users\Admin\AppData\Local\Temp\nsbEE34.tmp\bittorrent.exe
          "C:\Users\Admin\AppData\Local\Temp\nsbEE34.tmp\bittorrent.exe" /S /FORCEINSTALL 1110010101111110
          4⤵
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Adds Run key to start application
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          PID:3908
      • C:\Users\Admin\AppData\Roaming\bittorrent\BitTorrent.exe
        "C:\Users\Admin\AppData\Roaming\bittorrent\BitTorrent.exe"
        3⤵
        • Downloads MZ/PE file
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Adds Run key to start application
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Checks SCSI registry key(s)
        • Modifies Internet Explorer settings
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:4628
        • C:\Users\Admin\AppData\Roaming\bittorrent\updates\7.11.0_47391\bittorrentie.exe
          "C:\Users\Admin\AppData\Roaming\bittorrent\updates\7.11.0_47391\bittorrentie.exe" BitTorrent_4628_04E28DD0_638249612 BT4823DF041B09 BitTorrent ce unp
          4⤵
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1732
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=bittorrentie.exe --user-data-dir="C:\Users\Admin\AppData\LocalLow\BitTorrent.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msEnhancedTrackingPreventionEnabled --mojo-named-platform-channel-pipe=1732.4112.14998613382264674019
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:5116
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\LocalLow\BitTorrent.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\LocalLow\BitTorrent.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x13c,0x16c,0x7ff85cfbb078,0x7ff85cfbb084,0x7ff85cfbb090
              6⤵
                PID:4380
          • C:\Users\Admin\AppData\Roaming\bittorrent\updates\7.11.0_47391\bittorrentie.exe
            "C:\Users\Admin\AppData\Roaming\bittorrent\updates\7.11.0_47391\bittorrentie.exe" BitTorrent_4628_04E3A9A0_802690062 BT4823DF041B09 BitTorrent ce unp
            4⤵
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:752
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=bittorrentie.exe --user-data-dir="C:\Users\Admin\AppData\LocalLow\BitTorrent.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msEnhancedTrackingPreventionEnabled --mojo-named-platform-channel-pipe=752.3908.5266901640699105944
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:2812
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\LocalLow\BitTorrent.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\LocalLow\BitTorrent.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x174,0x7ff85cfbb078,0x7ff85cfbb084,0x7ff85cfbb090
                6⤵
                  PID:2388
            • C:\Users\Admin\AppData\Roaming\bittorrent\updates\7.11.0_47391\bittorrentie.exe
              "C:\Users\Admin\AppData\Roaming\bittorrent\updates\7.11.0_47391\bittorrentie.exe" BitTorrent_4628_03FA5408_1892490771 BT4823DF041B09 BitTorrent ce unp
              4⤵
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:620
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=bittorrentie.exe --user-data-dir="C:\Users\Admin\AppData\LocalLow\BitTorrent.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msEnhancedTrackingPreventionEnabled --mojo-named-platform-channel-pipe=620.936.9781496457768071118
                5⤵
                • Enumerates system info in registry
                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                • Suspicious use of WriteProcessMemory
                PID:2920
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\LocalLow\BitTorrent.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\LocalLow\BitTorrent.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x19c,0x7ff85cfbb078,0x7ff85cfbb084,0x7ff85cfbb090
                  6⤵
                    PID:2292
                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\BitTorrent.WebView2\EBWebView" --webview-exe-name=bittorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1748,i,8516730392876380066,5326664333223491248,262144 --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version --mojo-platform-channel-handle=1744 /prefetch:2
                    6⤵
                      PID:3788
                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\BitTorrent.WebView2\EBWebView" --webview-exe-name=bittorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2044,i,8516730392876380066,5326664333223491248,262144 --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:3
                      6⤵
                        PID:3272
                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\BitTorrent.WebView2\EBWebView" --webview-exe-name=bittorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2388,i,8516730392876380066,5326664333223491248,262144 --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:8
                        6⤵
                          PID:684
                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\BitTorrent.WebView2\EBWebView" --webview-exe-name=bittorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3760,i,8516730392876380066,5326664333223491248,262144 --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:1
                          6⤵
                            PID:5492
                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\BitTorrent.WebView2\EBWebView" --webview-exe-name=bittorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4124,i,8516730392876380066,5326664333223491248,262144 --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:1
                            6⤵
                              PID:5640
                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\BitTorrent.WebView2\EBWebView" --webview-exe-name=bittorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4372,i,8516730392876380066,5326664333223491248,262144 --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:1
                              6⤵
                                PID:5820
                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\BitTorrent.WebView2\EBWebView" --webview-exe-name=bittorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4588,i,8516730392876380066,5326664333223491248,262144 --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:1
                                6⤵
                                  PID:5924
                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\BitTorrent.WebView2\EBWebView" --webview-exe-name=bittorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4340,i,8516730392876380066,5326664333223491248,262144 --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
                                  6⤵
                                    PID:6092
                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\BitTorrent.WebView2\EBWebView" --webview-exe-name=bittorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4896,i,8516730392876380066,5326664333223491248,262144 --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:1
                                    6⤵
                                      PID:3656
                                • C:\Users\Admin\AppData\Roaming\bittorrent\crashpad_handler.exe
                                  C:\Users\Admin\AppData\Roaming\bittorrent\crashpad_handler.exe --no-rate-limit --database=C:\Users\Admin\AppData\Roaming\BitTorrent\sentry-native --metrics-dir=C:\Users\Admin\AppData\Roaming\BitTorrent\sentry-native --url=https://o127107.ingest.us.sentry.io:443/api/4511257372459008/minidump/?sentry_client=sentry.native/0.7.0&sentry_key=8aff50f5e89f5dfc4fca527ca95b89e4 --attachment=C:\Users\Admin\AppData\Roaming\BitTorrent\sentry-native\5a24a9bf-a0fe-4357-2c39-5f8d8f9ee5f5.run\__sentry-event --attachment=C:\Users\Admin\AppData\Roaming\BitTorrent\sentry-native\5a24a9bf-a0fe-4357-2c39-5f8d8f9ee5f5.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Roaming\BitTorrent\sentry-native\5a24a9bf-a0fe-4357-2c39-5f8d8f9ee5f5.run\__sentry-breadcrumb2 --initial-client-data=0x974,0x978,0x97c,0x970,0x980,0xb656bc,0xb656d0,0xb656e0
                                  4⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:3384
                                • C:\Users\Admin\AppData\Roaming\bittorrent\updates\7.11.0_47391\bittorrentie.exe
                                  "C:\Users\Admin\AppData\Roaming\bittorrent\updates\7.11.0_47391\bittorrentie.exe" BitTorrent_4628_04E28DD0_1330757813 BT4823DF041B09 BitTorrent ce unp
                                  4⤵
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:5332
                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=bittorrentie.exe --user-data-dir="C:\Users\Admin\AppData\LocalLow\BitTorrent.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msEnhancedTrackingPreventionEnabled --mojo-named-platform-channel-pipe=5332.5604.7571715934496744538
                                    5⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:5672
                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\LocalLow\BitTorrent.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\LocalLow\BitTorrent.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x10c,0x194,0x7ff85cfbb078,0x7ff85cfbb084,0x7ff85cfbb090
                                      6⤵
                                        PID:5704
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bittorrent.com/prodnews?v=7%2e11%2e0%2e1%2e47391&pv=0.0.0.0.0
                                    4⤵
                                    • Enumerates system info in registry
                                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                    • Suspicious use of FindShellTrayWindow
                                    • Suspicious use of WriteProcessMemory
                                    PID:6040
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ff85b3cc188,0x7ff85b3cc194,0x7ff85b3cc1a0
                                      5⤵
                                        PID:6116
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,14274110333242953446,13573119442594526692,524288 --field-trial-handle=2708,i,11648893251675304325,17844799711886514441,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:3
                                        5⤵
                                        • System Time Discovery
                                        PID:5228
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,15029707858971421130,10628599364592121998,262144 --field-trial-handle=2708,i,11648893251675304325,17844799711886514441,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:2
                                        5⤵
                                          PID:5292
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2340,i,2515686802447353291,12806764112354587914,524288 --field-trial-handle=2708,i,11648893251675304325,17844799711886514441,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:8
                                          5⤵
                                            PID:5300
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,8960726199021731500,18222906717503384582,2097152 --field-trial-handle=2708,i,11648893251675304325,17844799711886514441,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
                                            5⤵
                                              PID:5408
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,2739592247591595233,8603757292030128388,2097152 --field-trial-handle=2708,i,11648893251675304325,17844799711886514441,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
                                              5⤵
                                                PID:5428
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,16588053358053501092,13780655800143179708,2097152 --field-trial-handle=2708,i,11648893251675304325,17844799711886514441,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
                                                5⤵
                                                  PID:5680
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,3934744243564977702,11523787821616385394,2097152 --field-trial-handle=2708,i,11648893251675304325,17844799711886514441,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:2
                                                  5⤵
                                                    PID:5608
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,10937975292196225727,14968291862738114511,524288 --field-trial-handle=2708,i,11648893251675304325,17844799711886514441,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
                                                    5⤵
                                                      PID:6080
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,6132786492518877883,2665096639827552863,524288 --field-trial-handle=2708,i,11648893251675304325,17844799711886514441,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
                                                      5⤵
                                                        PID:5420
                                                    • C:\Users\Admin\AppData\Roaming\bittorrent\helper\helper.exe
                                                      "C:\Users\Admin\AppData\Roaming\bittorrent\helper\helper.exe" 37453 --hval TD35_qWCAU5lL8Zp -- -pid 4628 -version 47391
                                                      4⤵
                                                      • Executes dropped EXE
                                                      • Reads the TCP/IP host and domain name from the registry
                                                      • System Location Discovery: System Language Discovery
                                                      PID:7156
                                              • C:\Windows\SysWOW64\DllHost.exe
                                                C:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}
                                                1⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:1756
                                              • C:\Users\Admin\AppData\Roaming\bittorrent\BitTorrent.exe
                                                "C:\Users\Admin\AppData\Roaming\bittorrent\BitTorrent.exe" /MINIMIZED
                                                1⤵
                                                • Executes dropped EXE
                                                • Identifies Wine through registry keys
                                                • Reads the TCP/IP host and domain name from the registry
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2880
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                1⤵
                                                  PID:1360

                                                Network

                                                      MITRE ATT&CK Enterprise v16

                                                      Reconnaissance

                                                      Resource Development

                                                      Initial Access

                                                      Execution

                                                      Persistence

                                                      Boot or Logon Autostart Execution

                                                      1
                                                      T1547

                                                      Registry Run Keys / Startup Folder

                                                      1
                                                      T1547.001

                                                      Privilege Escalation

                                                      Boot or Logon Autostart Execution

                                                      1
                                                      T1547

                                                      Registry Run Keys / Startup Folder

                                                      1
                                                      T1547.001

                                                      Defense Evasion

                                                      Modify Registry

                                                      3
                                                      T1112

                                                      Subvert Trust Controls

                                                      1
                                                      T1553

                                                      Install Root Certificate

                                                      1
                                                      T1553.004

                                                      Virtualization/Sandbox Evasion

                                                      1
                                                      T1497

                                                      Credential Access

                                                      Discovery

                                                      Browser Information Discovery

                                                      1
                                                      T1217

                                                      Network Share Discovery

                                                      1
                                                      T1135

                                                      Peripheral Device Discovery

                                                      1
                                                      T1120

                                                      Query Registry

                                                      6
                                                      T1012

                                                      Software Discovery

                                                      1
                                                      T1518

                                                      Security Software Discovery

                                                      1
                                                      T1518.001

                                                      System Information Discovery

                                                      6
                                                      T1082

                                                      System Location Discovery

                                                      1
                                                      T1614

                                                      System Language Discovery

                                                      1
                                                      T1614.001

                                                      System Network Configuration Discovery

                                                      1
                                                      T1016

                                                      System Time Discovery

                                                      1
                                                      T1124

                                                      Virtualization/Sandbox Evasion

                                                      1
                                                      T1497

                                                      Lateral Movement

                                                      Collection

                                                      Command and Control

                                                      Exfiltration

                                                      Impact

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      3fc5ebaf-6330-475e-8c98-2b2cc85f964e.tmp
                                                      • Path C:\Users\Admin\AppData\LocalLow\BitTorrent.WebView2\EBWebView\3fc5ebaf-6330-475e-8c98-2b2cc85f964e.tmp
                                                      • Size 3KB
                                                      • SHA256 f49c1642e73fe8673e160381bc1c20464242a4abf8b043329214176bb7769f4d
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      53eacb96-15e1-45ba-bf54-6fa4c194d6b8.tmp
                                                      • Path C:\Users\Admin\AppData\LocalLow\BitTorrent.WebView2\EBWebView\53eacb96-15e1-45ba-bf54-6fa4c194d6b8.tmp
                                                      • Size 3KB
                                                      • SHA256 4783ff94860a31a51767ae7e4c4d6aaef401b41a66f3fa2d65ec2223d0db2715
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      5e61d6b4-e9e9-4841-8d3b-f306c3f30eda.tmp
                                                      • Path C:\Users\Admin\AppData\LocalLow\BitTorrent.WebView2\EBWebView\5e61d6b4-e9e9-4841-8d3b-f306c3f30eda.tmp
                                                      • Size 2KB
                                                      • SHA256 a8ca6d9222a2277ba6a2ab76ad5633ba1c53bc8eb60baf0fa0ea7e0867dc9476
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      64ddb804-127f-4d67-a43a-de00de1e046d.tmp
                                                      • Path C:\Users\Admin\AppData\LocalLow\BitTorrent.WebView2\EBWebView\64ddb804-127f-4d67-a43a-de00de1e046d.tmp
                                                      • Size 1KB
                                                      • SHA256 08e723d1d8c443dbc1ae152f211b33fd2eac4c6126e8f3dbb298bd9aae2c2372
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      892d6fa4-5bb6-4a87-aad4-2fbdd98394b0.tmp
                                                      • Path C:\Users\Admin\AppData\LocalLow\BitTorrent.WebView2\EBWebView\892d6fa4-5bb6-4a87-aad4-2fbdd98394b0.tmp
                                                      • Size 16KB
                                                      • SHA256 c29e4427585fc7a4af38491c8493de18f452bcd9cff4ad1cc7a7f08549e7a025
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      settings.dat
                                                      • Path C:\Users\Admin\AppData\LocalLow\BitTorrent.WebView2\EBWebView\Crashpad\settings.dat
                                                      • Size 280B
                                                      • SHA256 6d4f86dcf10478b8cd1d1c5d93bcfd7bfb4ace2226051e51cbb2b5cad3a7d58f
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      settings.dat
                                                      • Path C:\Users\Admin\AppData\LocalLow\BitTorrent.WebView2\EBWebView\Crashpad\settings.dat
                                                      • Size 280B
                                                      • SHA256 c036309e68026f602dc1a105df50bed3ce335a2b24495c7af337b6af4f6e1d97
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      throttle_store.dat
                                                      • Path C:\Users\Admin\AppData\LocalLow\BitTorrent.WebView2\EBWebView\Crashpad\throttle_store.dat
                                                      • Size 20B
                                                      • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      f_000009
                                                      • Path C:\Users\Admin\AppData\LocalLow\BitTorrent.WebView2\EBWebView\Default\Cache\Cache_Data\f_000009
                                                      • Size 28KB
                                                      • SHA256 e80f742646c4366401bdb4370bdeee1053265b14f742a45983b147a5432e2f8c
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      f_00000c
                                                      • Path C:\Users\Admin\AppData\LocalLow\BitTorrent.WebView2\EBWebView\Default\Cache\Cache_Data\f_00000c
                                                      • Size 31KB
                                                      • SHA256 13cd5f41d5d83a148359b26d81e70a1d5b92cabb339810f4b6ce5e3267aa8a90
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      f_00000d
                                                      • Path C:\Users\Admin\AppData\LocalLow\BitTorrent.WebView2\EBWebView\Default\Cache\Cache_Data\f_00000d
                                                      • Size 34KB
                                                      • SHA256 20932fec0bbda6310c8b59b9c740d3097461fcf84d559a33227d3c60cd3d4bd7
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      f_00000e
                                                      • Path C:\Users\Admin\AppData\LocalLow\BitTorrent.WebView2\EBWebView\Default\Cache\Cache_Data\f_00000e
                                                      • Size 134KB
                                                      • SHA256 f8cb51ef1a1216546c221d54e90a6cefe97503d94e8b3d9472ee69e98cccb197
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      f_00000f
                                                      • Path C:\Users\Admin\AppData\LocalLow\BitTorrent.WebView2\EBWebView\Default\Cache\Cache_Data\f_00000f
                                                      • Size 58KB
                                                      • SHA256 b8a7d2c55fff4bd666279bf5c1cde068e8966ff15d4f17e6bcde95e6f5dc983e
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      f_000010
                                                      • Path C:\Users\Admin\AppData\LocalLow\BitTorrent.WebView2\EBWebView\Default\Cache\Cache_Data\f_000010
                                                      • Size 92KB
                                                      • SHA256 b98bd7bf22bd59d586418d2cb8068ebd0298b9ab5571300091cd4987be0673e5
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      MANIFEST-000001
                                                      • Path C:\Users\Admin\AppData\LocalLow\BitTorrent.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
                                                      • Size 41B
                                                      • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      data_0
                                                      • Path C:\Users\Admin\AppData\LocalLow\BitTorrent.WebView2\EBWebView\Default\GPUCache\data_0
                                                      • Size 8KB
                                                      • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      data_1
                                                      • Path C:\Users\Admin\AppData\LocalLow\BitTorrent.WebView2\EBWebView\Default\GPUCache\data_1
                                                      • Size 264KB
                                                      • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      data_2
                                                      • Path C:\Users\Admin\AppData\LocalLow\BitTorrent.WebView2\EBWebView\Default\GPUCache\data_2
                                                      • Size 8KB
                                                      • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      data_3
                                                      • Path C:\Users\Admin\AppData\LocalLow\BitTorrent.WebView2\EBWebView\Default\GPUCache\data_3
                                                      • Size 8KB
                                                      • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      SCT Auditing Pending Reports
                                                      • Path C:\Users\Admin\AppData\LocalLow\BitTorrent.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
                                                      • Size 2B
                                                      • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      CURRENT
                                                      • Path C:\Users\Admin\AppData\LocalLow\BitTorrent.WebView2\EBWebView\Default\Sync Data\LevelDB\CURRENT
                                                      • Size 16B
                                                      • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      Local State
                                                      • Path C:\Users\Admin\AppData\LocalLow\BitTorrent.WebView2\EBWebView\Local State
                                                      • Size 1KB
                                                      • SHA256 8da54d61f0f0cd0fab0abe718ee97759adede726996174a264bb0190b8e8c337
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      bbddcf4c-68a8-444e-b50e-d06231da7a02.tmp
                                                      • Path C:\Users\Admin\AppData\LocalLow\BitTorrent.WebView2\EBWebView\bbddcf4c-68a8-444e-b50e-d06231da7a02.tmp
                                                      • Size 4KB
                                                      • SHA256 70784043766bf6dc219b8674d9c1387ee46e6f4f507d4c40f69e64cc03a370a2
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      25482dd9-980b-45a4-93a9-d30ea4efb308.tmp
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\25482dd9-980b-45a4-93a9-d30ea4efb308.tmp
                                                      • Size 8KB
                                                      • SHA256 25cf19772d6c0c78c2038caaff435495eb5b711f3cfe28361b1c3b1937b98ae9
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      54ff4c35-064a-49cc-ad8a-dae54c3d77e6.tmp
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\54ff4c35-064a-49cc-ad8a-dae54c3d77e6.tmp
                                                      • Size 15KB
                                                      • SHA256 e42d0c987e19c8d776d9d1457b99b126d780b89e63927e34945ff476918ea577
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      settings.dat
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                      • Size 280B
                                                      • SHA256 0e249170bbcfe30a2a7f421f287b6f81c1c4b71b07e845351f15d008b660ff09
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      settings.dat
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                      • Size 280B
                                                      • SHA256 04d384e503ac7726cb96f043e69cad98489c2eafc2665c80e33cb016d873b6e5
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      settings.dat
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                      • Size 280B
                                                      • SHA256 f7e901ff3df2d769334a9a6d3d1825c832dead150655a1e08b1ef005d0292c1c
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      43060747-c313-42b6-8302-f74aa3504c28.tmp
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\43060747-c313-42b6-8302-f74aa3504c28.tmp
                                                      • Size 9KB
                                                      • SHA256 85fa57300f876b9f4454d439f4dd14133d2ea40d1ce92275807a1f447c9f67eb
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      4dd6a0fc-4ab9-4208-8cfe-e8e6a5cc3b4e.tmp
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4dd6a0fc-4ab9-4208-8cfe-e8e6a5cc3b4e.tmp
                                                      • Size 6B
                                                      • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      52a99ee4-452b-4441-b6f6-39d78913eed6.tmp
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\52a99ee4-452b-4441-b6f6-39d78913eed6.tmp
                                                      • Size 70KB
                                                      • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      6c3e6f92-4802-4f2f-89c7-c8e91a2e006f.tmp
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6c3e6f92-4802-4f2f-89c7-c8e91a2e006f.tmp
                                                      • Size 27KB
                                                      • SHA256 a1f1583189f1252246bbcbe576a056403f8e29d074cd0e638e9a82dadad6fb03
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      temp-index
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                      • Size 2KB
                                                      • SHA256 93a6334af651edf5813e496e6230bbf6a6c109378eeb198e9bbf6dfba795c19c
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      the-real-index
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                      • Size 2KB
                                                      • SHA256 ea3a767f88155ab7df3f33ef49b73bc7282f7cd8925b9b4588c90c0a3a846418
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      5620c9a6-767f-4bb5-84ba-300bbfae4c29.tmp
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\5620c9a6-767f-4bb5-84ba-300bbfae4c29.tmp
                                                      • Size 2B
                                                      • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      7bc76622-cbd5-48a0-ae8c-c272bcc671f8.tmp
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7bc76622-cbd5-48a0-ae8c-c272bcc671f8.tmp
                                                      • Size 1KB
                                                      • SHA256 065538da34235e65cdfbc2b8de5843b99403348bddb7210ac7437c91604e0fda
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      ed919241-8476-4079-b976-12c1e23c4c20.tmp
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ed919241-8476-4079-b976-12c1e23c4c20.tmp
                                                      • Size 8KB
                                                      • SHA256 8c9a1e884ca44d54e8f5150a88ffe71bcbc46481c71de678a2f3949f69b25eab
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      537bde2f-0e70-4426-812d-4eb03ec44b61.tmp
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\537bde2f-0e70-4426-812d-4eb03ec44b61.tmp
                                                      • Size 13B
                                                      • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                      • Size 2KB
                                                      • SHA256 d14083ccadfc528e27d12e6f652d52b8cd69faf95f00a0b34607b54ba2e93792
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
                                                      • Size 2KB
                                                      • SHA256 3caae2ff3d86081d11a317d1c397795fc5407b0babce78e853fa9f62474b06da
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      bittorrent_installer.tmp
                                                      • Path C:\Users\Admin\AppData\Local\Temp\is-5W4K9W18TZ.tmp\bittorrent_installer.tmp
                                                      • Size 4.2MB
                                                      • SHA256 b81cd0c6bdd7231366df4b3f7a6eca5fd02d1ac27a2bb0cca4acde6113ce4add
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      107.png
                                                      • Path C:\Users\Admin\AppData\Local\Temp\is-ECUHU80OUU.tmp\107.png
                                                      • Size 152KB
                                                      • SHA256 2f116cdef55e05549d6f06913afe39a91b715b188e110188c7fbf7f5eb69b318
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      BitTorrent.exe
                                                      • Path C:\Users\Admin\AppData\Local\Temp\is-ECUHU80OUU.tmp\BitTorrent.exe
                                                      • Size 4.0MB
                                                      • SHA256 7b8f4935b293de6db80ad270b019e2b8ad035c5b3b88f6c415494e1e28041164
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      INetC.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\nsbEE34.tmp\INetC.dll
                                                      • Size 24KB
                                                      • SHA256 c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      System.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\nsbEE34.tmp\System.dll
                                                      • Size 12KB
                                                      • SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      bittorrent.exe
                                                      • Path C:\Users\Admin\AppData\Local\Temp\nsbEE34.tmp\bittorrent.exe
                                                      • Size 8.9MB
                                                      • SHA256 b1c2a1724281a1ddcbc9f1506ce9f992c739bcb434ee8faeb0a905ce2b16e501
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      crashpad_handler.exe
                                                      • Path C:\Users\Admin\AppData\Local\Temp\nsbEE34.tmp\crashpad_handler.exe
                                                      • Size 736KB
                                                      • SHA256 cbafd88509e7f56dd3c542237239f15232745fae3cb50a70a3ab50d03eb9bcfe
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      nsisFirewall.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\nsbEE34.tmp\nsisFirewall.dll
                                                      • Size 8KB
                                                      • SHA256 53be5716ad80945cb99681d5dbda60492f5dfb206fbfdb776b769b3eeb18d2c2
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      9d1627c087e30ee6fe8c9cce3c77e841_1190f6a9-ab12-41a5-a5dd-25e481f1df6c
                                                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-895009113-1202185046-1686627690-1000\9d1627c087e30ee6fe8c9cce3c77e841_1190f6a9-ab12-41a5-a5dd-25e481f1df6c
                                                      • Size 1KB
                                                      • SHA256 88bf8af17f9974759d13f6d0edd6eb06ebc3ec3f986fea97e75cb9022c8117a0
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      165F6EF40A81DD175FFAEA69E77ABFD30B27E71C
                                                      • Path C:\Users\Admin\AppData\Roaming\bittorrent\dlimagecache\165F6EF40A81DD175FFAEA69E77ABFD30B27E71C
                                                      • Size 1KB
                                                      • SHA256 ec9e7c253d599175af470832da851cf4f59614a4c4d4e37183159801b13abf5f
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      helper.exe
                                                      • Path C:\Users\Admin\AppData\Roaming\bittorrent\helper\helper.exe
                                                      • Size 8.5MB
                                                      • SHA256 26f431428fc725af9c71fffd0eaed4ea1895329af8181d275d37ccb3457076f1
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      helper_web_ui.btinstall
                                                      • Path C:\Users\Admin\AppData\Roaming\bittorrent\helper_web_ui.btinstall
                                                      • Size 7.4MB
                                                      • SHA256 4325244a7c1b300cd6006c6d4d8ee6335c4b04284b3677748de614d6acfae86d
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      settings.dat
                                                      • Path C:\Users\Admin\AppData\Roaming\bittorrent\settings.dat
                                                      • Size 8KB
                                                      • SHA256 6cbba6d0a3833b631fd6cc1604cee7e5c97e8c09ae269b44e8f203bee9049d19
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      settings.dat
                                                      • Path C:\Users\Admin\AppData\Roaming\bittorrent\settings.dat
                                                      • Size 8KB
                                                      • SHA256 7ce098ff0c8a504c87158dc590c933c9cb90c96fb4b77dbbeea54429607df7e4
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      settings.dat
                                                      • Path C:\Users\Admin\AppData\Roaming\bittorrent\settings.dat
                                                      • Size 15KB
                                                      • SHA256 2bb29cf81dccd0b44639d81bfe4eb31de12c3e709c01478bea7c60b43ed92ff1
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      bittorrentie.exe
                                                      • Path C:\Users\Admin\AppData\Roaming\bittorrent\updates\7.11.0_47391\bittorrentie.exe
                                                      • Size 693KB
                                                      • SHA256 d014fae2c3b46ffb7576da7f084640a8f5fbb9ed93aaf74f5c0d55f795fd8d08
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      memory/684-267-0x00007FF87B1F0000-0x00007FF87B1F1000-memory.dmp
                                                      Download

                                                      memory/684-268-0x00007FF879AD0000-0x00007FF879AD1000-memory.dmp
                                                      Download

                                                      memory/1096-36-0x0000000000AE0000-0x0000000000F2D000-memory.dmp
                                                      Download

                                                      memory/1096-25-0x00000000035B0000-0x00000000036F0000-memory.dmp
                                                      Download

                                                      memory/1096-63-0x00000000035B0000-0x00000000036F0000-memory.dmp
                                                      Download

                                                      memory/1096-26-0x00000000035B0000-0x00000000036F0000-memory.dmp
                                                      Download

                                                      memory/1096-101-0x0000000000AE0000-0x0000000000F2D000-memory.dmp
                                                      Download

                                                      memory/1096-5-0x0000000001350000-0x0000000001351000-memory.dmp
                                                      Download

                                                      memory/1096-123-0x0000000000AE0000-0x0000000000F2D000-memory.dmp
                                                      Download

                                                      memory/1096-21-0x0000000001350000-0x0000000001351000-memory.dmp
                                                      Download

                                                      memory/1096-20-0x0000000000AE0000-0x0000000000F2D000-memory.dmp
                                                      Download

                                                      memory/2864-125-0x00000000000F0000-0x00000000001E2000-memory.dmp
                                                      Download

                                                      memory/2864-1-0x00000000000F0000-0x00000000001E2000-memory.dmp
                                                      Download

                                                      memory/2864-13-0x00000000000F0000-0x00000000001E2000-memory.dmp
                                                      Download

                                                      memory/3788-169-0x00007FF87B1F0000-0x00007FF87B1F1000-memory.dmp
                                                      Download

                                                      memory/5492-318-0x00007FF87B1F0000-0x00007FF87B1F1000-memory.dmp
                                                      Download