URL:

https://filecr.com/pc-games/avowed-free-download-for-windows/

Full analysis: https://app.any.run/tasks/bac81245-dbe8-4eba-885c-e191e3ec12d2
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: March 14, 2025, 21:23:57
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
autorun-reg
bittorrent
loader
arch-exec
stealer
delphi
inno
installer
upx
Indicators:
MD5:

B883607DFD25ACD765277B0D46658ED4

SHA1:

D01A11E713E01D3BEB11A3BD946F59717940B4F9

SHA256:

B234DDA06022EC949F21300E5618ABF865A353153CB4E629447451F68473B9B5

SSDEEP:

3:N8JTpIuJ1QA8FkDJSaKSN:2hpRjQUdKSN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • utorrent.exe (PID: 5304)
      • MicrosoftEdgeUpdate.exe (PID: 5164)
      • uTorrent.exe (PID: 7536)

    • BITTORRENT has been detected (SURICATA)

      • uTorrent.exe (PID: 7536)

    • Actions looks like stealing of personal data

      • servicehost.exe (PID: 7996)
      • uihost.exe (PID: 9224)

    • The DLL Hijacking

      • msedgewebview2.exe (PID: 9940)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • utorrent_installer.exe (PID: 7900)
      • utorrent_installer.exe (PID: 1012)
      • uTorrent.exe (PID: 7020)
      • utorrent.exe (PID: 5304)
      • uTorrent.exe (PID: 7536)
      • saBSI.exe (PID: 7564)
      • utorrent_installer.tmp (PID: 776)
      • MicrosoftEdgeWebView2Setup.exe (PID: 6300)
      • saBSI.exe (PID: 5188)
      • MicrosoftEdgeUpdate.exe (PID: 5164)
      • installer.exe (PID: 9020)
      • installer.exe (PID: 8704)
      • setup.exe (PID: 10088)
      • MicrosoftEdge_X64_134.0.3124.68.exe (PID: 10192)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 1660)
      • utorrent_installer.tmp (PID: 5204)
      • uTorrent.exe (PID: 7020)
      • utorrent.exe (PID: 5304)
      • utorrent_installer.tmp (PID: 776)
      • saBSI.exe (PID: 7564)
      • uTorrent.exe (PID: 7536)
      • utorrentie.exe (PID: 7488)
      • saBSI.exe (PID: 5188)
      • utorrentie.exe (PID: 2656)
      • utorrentie.exe (PID: 5988)
      • MicrosoftEdgeUpdate.exe (PID: 5164)
      • utorrentie.exe (PID: 7492)
      • installer.exe (PID: 8704)
      • utorrentie.exe (PID: 7680)
      • uihost.exe (PID: 9224)
      • MicrosoftEdgeUpdate.exe (PID: 8656)
      • msedgewebview2.exe (PID: 8756)

    • Mutex name with non-standard characters

      • utorrent_installer.tmp (PID: 776)
      • uTorrent.exe (PID: 7536)

    • Reads the Windows owner or organization settings

      • utorrent_installer.tmp (PID: 776)

    • The process creates files with name similar to system file names

      • uTorrent.exe (PID: 7020)
      • installer.exe (PID: 8704)
      • servicehost.exe (PID: 7996)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • uTorrent.exe (PID: 7020)

    • Searches for installed software

      • utorrent.exe (PID: 5304)
      • uTorrent.exe (PID: 7536)
      • updater.exe (PID: 7508)
      • setup.exe (PID: 10088)
      • msedgewebview2.exe (PID: 8756)

    • Creates a software uninstall entry

      • utorrent.exe (PID: 5304)
      • installer.exe (PID: 8704)
      • servicehost.exe (PID: 7996)
      • setup.exe (PID: 10088)

    • Potential Corporate Privacy Violation

      • utorrent.exe (PID: 5304)
      • uTorrent.exe (PID: 7536)

    • Adds/modifies Windows certificates

      • saBSI.exe (PID: 7564)
      • servicehost.exe (PID: 7996)

    • Process drops legitimate windows executable

      • uTorrent.exe (PID: 7536)
      • MicrosoftEdgeWebView2Setup.exe (PID: 6300)
      • MicrosoftEdgeUpdate.exe (PID: 5164)
      • installer.exe (PID: 8704)

    • Reads Microsoft Outlook installation path

      • utorrentie.exe (PID: 7488)
      • utorrentie.exe (PID: 2656)
      • utorrentie.exe (PID: 5988)
      • utorrentie.exe (PID: 7492)
      • utorrentie.exe (PID: 7680)
      • uTorrent.exe (PID: 7536)

    • Reads Internet Explorer settings

      • utorrentie.exe (PID: 7488)
      • utorrentie.exe (PID: 2656)
      • utorrentie.exe (PID: 5988)
      • utorrentie.exe (PID: 7492)
      • utorrentie.exe (PID: 7680)

    • The process verifies whether the antivirus software is installed

      • saBSI.exe (PID: 5188)
      • installer.exe (PID: 9020)
      • uihost.exe (PID: 9224)
      • installer.exe (PID: 8704)
      • updater.exe (PID: 7508)
      • servicehost.exe (PID: 7996)
      • cmd.exe (PID: 7992)
      • cmd.exe (PID: 9712)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeUpdate.exe (PID: 5164)

    • There is functionality for taking screenshot (YARA)

      • utorrent_installer.tmp (PID: 776)
      • uTorrent.exe (PID: 7536)

    • Creates/Modifies COM task schedule object

      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 2776)
      • MicrosoftEdgeUpdate.exe (PID: 3976)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7020)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 3032)
      • installer.exe (PID: 8704)

    • Process requests binary or script from the Internet

      • utorrentie.exe (PID: 2656)
      • uTorrent.exe (PID: 7536)

    • Starts itself from another location

      • MicrosoftEdgeUpdate.exe (PID: 5164)

    • Connects to unusual port

      • uTorrent.exe (PID: 7536)

    • Executes as Windows Service

      • servicehost.exe (PID: 7996)

    • Reads Mozilla Firefox installation path

      • uihost.exe (PID: 9224)
      • servicehost.exe (PID: 7996)

    • Starts CMD.EXE for commands execution

      • updater.exe (PID: 7508)

    • Application launched itself

      • setup.exe (PID: 10088)
      • MicrosoftEdgeUpdate.exe (PID: 8656)
      • msedgewebview2.exe (PID: 8816)
      • msedgewebview2.exe (PID: 8756)

  • INFO

    • Reads Microsoft Office registry keys

      • chrome.exe (PID: 1628)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 872)
      • WinRAR.exe (PID: 1660)

    • Create files in a temporary directory

      • utorrent_installer.exe (PID: 7900)
      • utorrent_installer.exe (PID: 1012)
      • utorrent_installer.tmp (PID: 776)
      • uTorrent.exe (PID: 7020)
      • utorrent.exe (PID: 5304)
      • uTorrent.exe (PID: 7536)
      • MicrosoftEdgeWebView2Setup.exe (PID: 6300)
      • saBSI.exe (PID: 5188)
      • MicrosoftEdgeUpdate.exe (PID: 5164)
      • installer.exe (PID: 8704)
      • msedgewebview2.exe (PID: 8756)

    • Reads the computer name

      • utorrent_installer.tmp (PID: 5204)
      • uTorrent.exe (PID: 7020)
      • utorrent.exe (PID: 5304)
      • saBSI.exe (PID: 7564)
      • uTorrent.exe (PID: 7536)
      • saBSI.exe (PID: 5188)
      • utorrentie.exe (PID: 7488)
      • utorrentie.exe (PID: 7492)
      • utorrentie.exe (PID: 5988)
      • utorrentie.exe (PID: 2656)
      • utorrent_installer.tmp (PID: 776)
      • MicrosoftEdgeUpdate.exe (PID: 5164)
      • MicrosoftEdgeUpdate.exe (PID: 3976)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7020)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 2776)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 3032)
      • MicrosoftEdgeUpdate.exe (PID: 8484)
      • MicrosoftEdgeUpdate.exe (PID: 8556)
      • MicrosoftEdgeUpdate.exe (PID: 8656)
      • installer.exe (PID: 8704)
      • identity_helper.exe (PID: 8348)
      • utorrentie.exe (PID: 7680)
      • helper.exe (PID: 900)
      • servicehost.exe (PID: 7996)
      • uihost.exe (PID: 9224)
      • updater.exe (PID: 7508)
      • MicrosoftEdge_X64_134.0.3124.68.exe (PID: 10192)
      • MicrosoftEdgeUpdate.exe (PID: 7528)
      • utorrentie.exe (PID: 7504)
      • setup.exe (PID: 10088)
      • msedgewebview2.exe (PID: 8816)
      • msedgewebview2.exe (PID: 8756)
      • utorrentie.exe (PID: 4040)
      • msedgewebview2.exe (PID: 9940)
      • msedgewebview2.exe (PID: 10076)

    • Checks supported languages

      • utorrent_installer.tmp (PID: 5204)
      • utorrent_installer.exe (PID: 7900)
      • utorrent_installer.exe (PID: 1012)
      • utorrent_installer.tmp (PID: 776)
      • uTorrent.exe (PID: 7020)
      • utorrent.exe (PID: 5304)
      • saBSI.exe (PID: 7564)
      • uTorrent.exe (PID: 7536)
      • saBSI.exe (PID: 5188)
      • utorrentie.exe (PID: 7488)
      • MicrosoftEdgeWebView2Setup.exe (PID: 6300)
      • utorrentie.exe (PID: 7492)
      • utorrentie.exe (PID: 2656)
      • utorrentie.exe (PID: 5988)
      • MicrosoftEdgeUpdate.exe (PID: 3976)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7020)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 2776)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 3032)
      • MicrosoftEdgeUpdate.exe (PID: 8484)
      • MicrosoftEdgeUpdate.exe (PID: 5164)
      • MicrosoftEdgeUpdate.exe (PID: 8556)
      • MicrosoftEdgeUpdate.exe (PID: 8656)
      • installer.exe (PID: 9020)
      • identity_helper.exe (PID: 8348)
      • installer.exe (PID: 8704)
      • utorrentie.exe (PID: 7680)
      • helper.exe (PID: 900)
      • servicehost.exe (PID: 7996)
      • uihost.exe (PID: 9224)
      • updater.exe (PID: 7508)
      • MicrosoftEdge_X64_134.0.3124.68.exe (PID: 10192)
      • setup.exe (PID: 10180)
      • MicrosoftEdgeUpdate.exe (PID: 7528)
      • utorrentie.exe (PID: 7504)
      • setup.exe (PID: 10088)
      • utorrentie.exe (PID: 4040)
      • msedgewebview2.exe (PID: 8764)
      • msedgewebview2.exe (PID: 8756)
      • msedgewebview2.exe (PID: 10072)
      • msedgewebview2.exe (PID: 9940)
      • msedgewebview2.exe (PID: 10076)
      • msedgewebview2.exe (PID: 8816)
      • msedgewebview2.exe (PID: 6724)
      • msedgewebview2.exe (PID: 7904)
      • msedgewebview2.exe (PID: 9508)
      • msedgewebview2.exe (PID: 7756)
      • msedgewebview2.exe (PID: 5480)
      • msedgewebview2.exe (PID: 5980)

    • Process checks computer location settings

      • utorrent_installer.tmp (PID: 5204)
      • uTorrent.exe (PID: 7020)
      • utorrent_installer.tmp (PID: 776)
      • MicrosoftEdgeUpdate.exe (PID: 5164)
      • servicehost.exe (PID: 7996)
      • setup.exe (PID: 10088)
      • msedgewebview2.exe (PID: 9508)
      • msedgewebview2.exe (PID: 7756)
      • msedgewebview2.exe (PID: 8756)
      • msedgewebview2.exe (PID: 7904)

    • The sample compiled with russian language support

      • utorrent_installer.tmp (PID: 776)

    • Application launched itself

      • chrome.exe (PID: 1628)
      • msedge.exe (PID: 6108)
      • msedge.exe (PID: 8964)

    • Checks proxy server information

      • utorrent_installer.tmp (PID: 776)
      • uTorrent.exe (PID: 7020)
      • utorrent.exe (PID: 5304)
      • saBSI.exe (PID: 7564)
      • uTorrent.exe (PID: 7536)
      • utorrentie.exe (PID: 7488)
      • saBSI.exe (PID: 5188)
      • utorrentie.exe (PID: 2656)
      • utorrentie.exe (PID: 5988)
      • MicrosoftEdgeUpdate.exe (PID: 8484)
      • MicrosoftEdgeUpdate.exe (PID: 8656)
      • utorrentie.exe (PID: 7492)
      • utorrentie.exe (PID: 7680)
      • slui.exe (PID: 6228)
      • MicrosoftEdgeUpdate.exe (PID: 7528)
      • msedgewebview2.exe (PID: 8756)

    • Reads the software policy settings

      • slui.exe (PID: 7860)
      • utorrent_installer.tmp (PID: 776)
      • saBSI.exe (PID: 7564)
      • saBSI.exe (PID: 5188)
      • utorrentie.exe (PID: 2656)
      • MicrosoftEdgeUpdate.exe (PID: 8656)
      • MicrosoftEdgeUpdate.exe (PID: 8484)
      • utorrentie.exe (PID: 7492)
      • utorrentie.exe (PID: 5988)
      • utorrentie.exe (PID: 7680)
      • installer.exe (PID: 8704)
      • uTorrent.exe (PID: 7536)
      • servicehost.exe (PID: 7996)
      • uihost.exe (PID: 9224)
      • slui.exe (PID: 6228)
      • updater.exe (PID: 7508)
      • MicrosoftEdgeUpdate.exe (PID: 7528)

    • Reads the machine GUID from the registry

      • utorrent_installer.tmp (PID: 776)
      • utorrent.exe (PID: 5304)
      • saBSI.exe (PID: 7564)
      • uTorrent.exe (PID: 7536)
      • utorrentie.exe (PID: 2656)
      • utorrentie.exe (PID: 7492)
      • utorrentie.exe (PID: 5988)
      • installer.exe (PID: 8704)
      • utorrentie.exe (PID: 7680)
      • servicehost.exe (PID: 7996)
      • saBSI.exe (PID: 5188)
      • uihost.exe (PID: 9224)
      • updater.exe (PID: 7508)
      • MicrosoftEdgeUpdate.exe (PID: 8656)
      • msedgewebview2.exe (PID: 8756)

    • Compiled with Borland Delphi (YARA)

      • utorrent_installer.exe (PID: 7900)
      • utorrent_installer.tmp (PID: 5204)
      • utorrent_installer.exe (PID: 1012)
      • utorrent_installer.tmp (PID: 776)

    • Detects InnoSetup installer (YARA)

      • utorrent_installer.exe (PID: 7900)
      • utorrent_installer.tmp (PID: 5204)
      • utorrent_installer.exe (PID: 1012)
      • utorrent_installer.tmp (PID: 776)

    • The sample compiled with english language support

      • utorrent_installer.tmp (PID: 776)
      • uTorrent.exe (PID: 7020)
      • utorrent.exe (PID: 5304)
      • uTorrent.exe (PID: 7536)
      • saBSI.exe (PID: 7564)
      • MicrosoftEdgeWebView2Setup.exe (PID: 6300)
      • MicrosoftEdgeUpdate.exe (PID: 5164)
      • installer.exe (PID: 9020)
      • installer.exe (PID: 8704)

    • Creates files or folders in the user directory

      • uTorrent.exe (PID: 7020)
      • utorrent.exe (PID: 5304)
      • uTorrent.exe (PID: 7536)
      • utorrentie.exe (PID: 7488)
      • utorrentie.exe (PID: 5988)
      • utorrentie.exe (PID: 7492)
      • utorrentie.exe (PID: 2656)
      • MicrosoftEdgeUpdate.exe (PID: 5164)
      • utorrentie.exe (PID: 7680)
      • helper.exe (PID: 900)
      • MicrosoftEdgeUpdate.exe (PID: 8656)
      • MicrosoftEdge_X64_134.0.3124.68.exe (PID: 10192)
      • setup.exe (PID: 10180)
      • setup.exe (PID: 10088)
      • msedgewebview2.exe (PID: 8816)
      • msedgewebview2.exe (PID: 8764)
      • msedgewebview2.exe (PID: 10076)
      • msedgewebview2.exe (PID: 8756)

    • Autorun file from Registry key

      • utorrent.exe (PID: 5304)
      • uTorrent.exe (PID: 7536)
      • MicrosoftEdgeUpdate.exe (PID: 5164)

    • Creates files in the program directory

      • saBSI.exe (PID: 7564)
      • saBSI.exe (PID: 5188)
      • installer.exe (PID: 9020)
      • installer.exe (PID: 8704)
      • servicehost.exe (PID: 7996)
      • uihost.exe (PID: 9224)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 8484)
      • identity_helper.exe (PID: 8348)
      • MicrosoftEdgeUpdate.exe (PID: 7528)
      • msedgewebview2.exe (PID: 8756)

    • UPX packer has been detected

      • uTorrent.exe (PID: 7536)

    • Reads CPU info

      • msedgewebview2.exe (PID: 8756)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
291
Monitored processes
143
Malicious processes
22
Suspicious processes
9

Behavior graph

Click at the process to see the details
start chrome.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs sppextcomobj.exe no specs slui.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs winrar.exe utorrent_installer.exe utorrent_installer.tmp no specs utorrent_installer.exe utorrent_installer.tmp slui.exe chrome.exe no specs utorrent.exe chrome.exe no specs utorrent.exe chrome.exe no specs HNetCfg.FwPolicy2 no specs chrome.exe no specs sabsi.exe #BITTORRENT utorrent.exe sabsi.exe utorrentie.exe no specs microsoftedgewebview2setup.exe utorrentie.exe utorrentie.exe microsoftedgeupdate.exe utorrentie.exe microsoftedgeupdate.exe no specs microsoftedgeupdatecomregistershell64.exe no specs svchost.exe microsoftedgeupdatecomregistershell64.exe no specs msedge.exe microsoftedgeupdatecomregistershell64.exe no specs msedge.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs microsoftedgeupdate.exe microsoftedgeupdate.exe no specs msedge.exe no specs microsoftedgeupdate.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe installer.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs installer.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs utorrentie.exe chrome.exe no specs helper.exe servicehost.exe uihost.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe no specs updater.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chrome.exe no specs microsoftedge_x64_134.0.3124.68.exe setup.exe setup.exe no specs msedge.exe no specs chrome.exe no specs msedge.exe no specs microsoftedgeupdate.exe utorrentie.exe no specs utorrentie.exe no specs msedgewebview2.exe no specs msedgewebview2.exe no specs msedgewebview2.exe no specs msedgewebview2.exe no specs msedgewebview2.exe no specs msedgewebview2.exe msedgewebview2.exe no specs msedgewebview2.exe no specs msedgewebview2.exe no specs msedge.exe no specs chrome.exe no specs msedge.exe no specs msedgewebview2.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe no specs msedgewebview2.exe no specs msedge.exe no specs msedge.exe no specs msedgewebview2.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
632"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=4200 --field-trial-handle=1920,i,14975729971651697143,16956955140257305476,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
660"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=4400 --field-trial-handle=1920,i,14975729971651697143,16956955140257305476,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
776"C:\Users\admin\AppData\Local\Temp\is-O32L2.tmp\utorrent_installer.tmp" /SL5="$4023A,875149,815616,C:\Users\admin\AppData\Local\Temp\Rar$EXa1660.31237\utorrent_installer.exe" /SPAWNWND=$30234 /NOTIFYWND=$30224 C:\Users\admin\AppData\Local\Temp\is-O32L2.tmp\utorrent_installer.tmp
utorrent_installer.exe
User:
admin
Company:
Integrity Level:
HIGH
Description:
Setup/Uninstall
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-o32l2.tmp\utorrent_installer.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
872"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=4320 --field-trial-handle=1920,i,14975729971651697143,16956955140257305476,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
900"C:\Users\admin\AppData\Roaming\uTorrent\helper\helper.exe" 33424 --hval QYuEdCj2DH3bf9hl -- -pid 7536 -version 47178C:\Users\admin\AppData\Roaming\utorrent\helper\helper.exe
uTorrent.exe
User:
admin
Company:
BitTorrent Inc.
Integrity Level:
MEDIUM
Description:
µTorrent Helper
Version:
2.1.8.2789
Modules
Images
c:\users\admin\appdata\roaming\utorrent\helper\helper.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
904"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5528 --field-trial-handle=1920,i,14975729971651697143,16956955140257305476,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1012"C:\Users\admin\AppData\Local\Temp\Rar$EXa1660.31237\utorrent_installer.exe" /SPAWNWND=$30234 /NOTIFYWND=$30224 C:\Users\admin\AppData\Local\Temp\Rar$EXa1660.31237\utorrent_installer.exe
utorrent_installer.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
uTorrent® Classic
Version:
3.6
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa1660.31237\utorrent_installer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1116"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2284 --field-trial-handle=2164,i,7371659725327237396,14542580119971787189,262144 --variations-seed-version /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1616"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=5668 --field-trial-handle=1920,i,14975729971651697143,16956955140257305476,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1616"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5896 --field-trial-handle=1920,i,14975729971651697143,16956955140257305476,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
73 452
Read events
70 280
Write events
3 086
Delete events
86

Modification events

(PID) Process:(7536) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Operation:writeName:{2781761E-28E0-4109-99FE-B9D127C57AFE} {56FFCC30-D398-11D0-B2AE-00A0C908FA49} 0xFFFF
Value:
0100000000000000BE6608892795DB01
(PID) Process:(1628) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\OpenWithProgids
Operation:writeName:WinRAR.ZIP
Value:
(PID) Process:(1660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(1660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(1660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(1660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Downloads\utorrent_installer.zip
(PID) Process:(1660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
282
Suspicious files
1 207
Text files
892
Unknown types
0

Dropped files

PID
Process
Filename
Type
1628chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF10c7a7.TMP —
MD5:—
SHA256:—
1628chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
1628chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old~RF10c7a7.TMP —
MD5:—
SHA256:—
1628chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
1628chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old~RF10c7a7.TMP —
MD5:—
SHA256:—
1628chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old~RF10c7a7.TMP —
MD5:—
SHA256:—
1628chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old —
MD5:—
SHA256:—
1628chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
1628chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old~RF10c7a7.TMP —
MD5:—
SHA256:—
1628chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old~RF10c7a7.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
151
TCP/UDP connections
578
DNS requests
276
Threats
47

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4172
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
8124
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
8124
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
856
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/pmztx7tk73bjttcb4b6ys6fixq_2025.1.3.1202/ggkkehgbnfjpeggfpleeakpidbkibbmn_2025.1.3.1202_all_afljkosaafpr5gqm7ftppqz7zq.crx3
unknown
—
—
whitelisted
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/pmztx7tk73bjttcb4b6ys6fixq_2025.1.3.1202/ggkkehgbnfjpeggfpleeakpidbkibbmn_2025.1.3.1202_all_afljkosaafpr5gqm7ftppqz7zq.crx3
unknown
—
—
whitelisted
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/pmztx7tk73bjttcb4b6ys6fixq_2025.1.3.1202/ggkkehgbnfjpeggfpleeakpidbkibbmn_2025.1.3.1202_all_afljkosaafpr5gqm7ftppqz7zq.crx3
unknown
—
—
whitelisted
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/pmztx7tk73bjttcb4b6ys6fixq_2025.1.3.1202/ggkkehgbnfjpeggfpleeakpidbkibbmn_2025.1.3.1202_all_afljkosaafpr5gqm7ftppqz7zq.crx3
unknown
—
—
whitelisted
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/pmztx7tk73bjttcb4b6ys6fixq_2025.1.3.1202/ggkkehgbnfjpeggfpleeakpidbkibbmn_2025.1.3.1202_all_afljkosaafpr5gqm7ftppqz7zq.crx3
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
2.19.11.105:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
—
—
20.198.162.76:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
SG
whitelisted
—
—
239.255.255.250:1900
—
—
—
whitelisted
—
—
74.125.206.84:443
accounts.google.com
GOOGLE
US
whitelisted
—
—
188.114.97.3:443
filecr.com
CLOUDFLARENET
NL
unknown
—
—
20.190.160.17:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.184.206
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 2.19.11.105
  • 2.19.11.120
whitelisted
client.wns.windows.com
  • 20.198.162.76
whitelisted
filecr.com
  • 188.114.97.3
  • 188.114.96.3
unknown
accounts.google.com
  • 74.125.206.84
whitelisted
login.live.com
  • 20.190.160.17
  • 40.126.32.68
  • 20.190.160.67
  • 40.126.32.74
  • 20.190.160.64
  • 20.190.160.20
  • 40.126.32.136
  • 40.126.32.72
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 23.54.109.203
whitelisted
dash.zintrack.com
  • 172.67.221.181
  • 104.21.94.97
unknown
content-autofill.googleapis.com
  • 142.250.186.138
  • 142.250.185.74
  • 142.250.184.202
  • 142.250.186.42
  • 142.250.185.234
  • 172.217.16.202
  • 142.250.186.106
  • 142.250.185.106
  • 216.58.206.42
  • 142.250.185.202
  • 142.250.185.170
  • 142.250.181.234
  • 216.58.212.170
  • 142.250.186.170
  • 142.250.185.138
  • 142.250.184.234
whitelisted

Threats

PID
Process
Class
Message
7020
uTorrent.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
5304
utorrent.exe
Potential Corporate Privacy Violation
ET P2P Bittorrent P2P Client User-Agent (uTorrent)
5304
utorrent.exe
Potential Corporate Privacy Violation
ET P2P Bittorrent P2P Client User-Agent (uTorrent)
7020
uTorrent.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
7536
uTorrent.exe
Misc activity
INFO [ANY.RUN] P2P BitTorrent Protocol
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
2196
svchost.exe
Potentially Bad Traffic
ET DNS Query for .to TLD
2196
svchost.exe
Potentially Bad Traffic
ET DNS Query to a .tk domain - Likely Hostile
7536
uTorrent.exe
Potential Corporate Privacy Violation
ET P2P BTWebClient UA uTorrent in use
7536
uTorrent.exe
Potential Corporate Privacy Violation
ET P2P BTWebClient UA uTorrent in use
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://filecr.com/pc-games/avowed-free-download-for-windows/