0365daacdcde2fb93b2d972a46490b9cc4ca6f76e13f7ab745acf9dbcb92c32f

Analysis

max time kernel
145s
max time network
150s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01-02-2023 12:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

utorrent_installer.exe
Size

1.7MB
MD5

d9e40e69322f6a227a665097adb91e70
SHA1

4ebfa5d35cca579373626f0056ebb6e41223d291
SHA256

0365daacdcde2fb93b2d972a46490b9cc4ca6f76e13f7ab745acf9dbcb92c32f
SHA512

f1ca58bf1e4c41bddefcacf443a631bd60520de30e5d1ef70a9eeb869f06aeeb0e8fbc7c6be58bd3d3ab2ee6bd23f85f62cdfc5f12369317e53f06065fe3cbf7
SSDEEP

24576:o4nXubIQGyxbPV0db26sdar9f7Zymuz7lnAjEHLcfVLKswfsI:oqe3f679fVyh71SaLcfxOfsI

Score

8^/10

discovery evasion persistence upx

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 9 IoCs

pid	Process
1140	utorrent_installer.tmp
1672	uTorrent.exe
1860	utorrent.exe
1296	uTorrent.exe
2044	utorrentie.exe
896	utorrentie.exe
1644	utorrentie.exe
1804	utorrentie.exe
1668	utorrentie.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00060000000142a5-79.dat	upx
behavioral1/files/0x00060000000142a5-81.dat	upx
behavioral1/files/0x00060000000142a5-84.dat	upx
behavioral1/memory/1860-91-0x0000000000400000-0x0000000000D1D000-memory.dmp	upx
behavioral1/files/0x00060000000146e3-92.dat	upx
behavioral1/files/0x00060000000146e3-93.dat	upx
behavioral1/files/0x00060000000146e3-94.dat	upx
behavioral1/memory/1860-98-0x0000000000400000-0x0000000000D1D000-memory.dmp	upx
behavioral1/files/0x00060000000146e3-101.dat	upx
behavioral1/files/0x00060000000146e3-110.dat	upx
behavioral1/memory/1296-113-0x0000000000400000-0x0000000000D1D000-memory.dmp	upx
behavioral1/memory/1296-130-0x0000000000400000-0x0000000000D1D000-memory.dmp	upx

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Wine	utorrent.exe
Key opened	\REGISTRY\MACHINE\Software\Wow6432Node\Wine	uTorrent.exe
Key opened	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Wine	uTorrent.exe
Key opened	\REGISTRY\MACHINE\Software\Wow6432Node\Wine	utorrent.exe

Loads dropped DLL 25 IoCs

pid	Process
1364	utorrent_installer.exe
1140	utorrent_installer.tmp
1140	utorrent_installer.tmp
1672	uTorrent.exe
1672	uTorrent.exe
1672	uTorrent.exe
1672	uTorrent.exe
1672	uTorrent.exe
1672	uTorrent.exe
1860	utorrent.exe
1860	utorrent.exe
1860	utorrent.exe
1860	utorrent.exe
1860	utorrent.exe
1860	utorrent.exe
1672	uTorrent.exe
1296	uTorrent.exe
1296	uTorrent.exe
1296	uTorrent.exe
1296	uTorrent.exe
1296	uTorrent.exe
1296	uTorrent.exe
1296	uTorrent.exe
1296	uTorrent.exe
1296	uTorrent.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\ut = "C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe /MINIMIZED"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\ut = "\"C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe\" /MINIMIZED"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run	utorrent.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 42 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	uTorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CROSS_DOMAIN_REDIRECT_MITIGATION\utorrentie.exe = "0"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CC2F6CB1-A232-11ED-AE55-6A950B37D0A0} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af00000000020000000000106600000001000020000000bc2406e66d96aab26e08994fb804880720d9d4fbb4ee1cbe61b6ed75f9bb6352000000000e8000000002000020000000ab7926a9fef2675e6f67580cc956fc62b469e5cf93a74ba6462ffcd6be78671a90000000bd89a2cca675646ad97089a9425af6eeebd44d3611b3524721978dc3761d47e768cb7b0ba0215b098d699984e43e67bc0818bc384eca2012c9053b5afb3c1cf1b26a5f8caf350ee32e6f99bf26265f4c706d9546b3bab7b9bca9f8c2b5565ef6c7f6a25dd03ab86547620d40dbe38210d90e3b4dcf309fc030970605125f422bbdb7c141542f005677e898dc7df140624000000082ec0a250b0117b94ca0592e7735c8a162fe150df596ebe0abdafb21b8f671b8db017699f160c7aae94f96f3df720af6704078ced1429fa9aead8b62bd3d40e4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION\utorrentie.exe = "1"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CROSS_DOMAIN_REDIRECT_MITIGATION	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\utorrentie.exe = "11000"	uTorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b05453a23f36d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af000000000200000000001066000000010000200000003f555df258632bf3e5c8e3b5947fce14a37e8f85196235708845c6da41387bc2000000000e8000000002000020000000321aba6181251685a763994dae2d0cde97fbeb6923a14461259c85e9aa7db2992000000073880224b8744ec7ec03985dd23b87f58c85e10ed19f4774e329bce9a899c38540000000b9bea6bbfdf0e6b69dc2b1b75bb091119f4e9f58ea12e6e0c68861e881e7c81e9e5c8926c4d419875baa387ce0b4afd570198521eab07b5f954552369e1fec14	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\bittorrent\URL Protocol	utorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-app	utorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-skin	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\MIME\Database\Content Type\application/x-bittorrent-skin\Extension = ".btskin"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.torrent\Content Type = "application/x-bittorrent"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\uTorrent\shell	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\uTorrent\Content Type\ = "application/x-bittorrent"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.btsearch\ = "uTorrent"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Applications	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\MIME\Database\Content Type\application/x-bittorrent-app\Extension = ".btapp"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.btinstall	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.btsearch\OpenWithProgids	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Magnet\shell	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Magnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe\" \"%1\" /SHELLASSOC"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\bittorrent\DefaultIcon	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\bittorrent\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\maindoc.ico"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Applications\uTorrent.exe\shell\open\command	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.torrent\ = "uTorrent"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.torrent\OpenWithProgids	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.torrent\OpenWithProgids\uTorrent	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\bittorrent\shell\open	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Magnet\URL Protocol	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\bittorrent\shell\open\command	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.btskin\Content Type = "application/x-bittorrent-skin"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\MIME\Database\Content Type\application/x-bittorrent-appinst\Extension = ".btinstall"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Magnet\DefaultIcon	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\bittorrent	utorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-app\Extension = ".btapp"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\FalconBetaAccount	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\uTorrent	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\MIME\Database\Content Type\application/x-bittorrent	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\uTorrent\Content Type	utorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent\Extension = ".torrent"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\uTorrent\shell\open\command	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.btsearch	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Applications\uTorrent.exe	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.btinstall\Content Type = "application/x-bittorrent-appinst"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.btkey	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.btkey\Content Type = "application/x-bittorrent-key"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\MIME\Database\Content Type	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Magnet\shell\open	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Magnet\shell\ = "open"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\bittorrent\Content Type = "application/x-bittorrent-protocol"	utorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-key	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.btsearch\OpenWithProgids\uTorrent	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Magnet\shell\open\command	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\bittorrent\ = "bittorrent URI"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.btapp	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.btskin	utorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-appinst	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Applications\uTorrent.exe\shell\open	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\MIME\Database	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\uTorrent\shell\ = "open"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Magnet\ = "Magnet URI"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\bittorrent\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe\" \"%1\" /SHELLASSOC"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml\Extension = ".btsearch"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Magnet\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\maindoc.ico"	utorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-appinst\Extension = ".btinstall"	utorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.btapp\Content Type = "application/x-bittorrent-app"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\MIME\Database\Content Type\application/x-bittorrent-key\Extension = ".btkey"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Applications\uTorrent.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe\" \"%1\" /SHELLASSOC"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\MIME\Database\Content Type\application/x-bittorrent-appinst	utorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-key\Extension = ".btkey"	utorrent.exe

Modifies system certificate store 2 TTPs 15 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 0f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	utorrent_installer.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c909000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c01400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e52000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a	uTorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6	utorrent_installer.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	utorrent_installer.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	utorrent_installer.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\801D62D07B449D5C5C035C98EA61FA443C2A58FE\Blob = 0f0000000100000014000000f53631b5177626eb6541df5563c8187d9dca421a09000000010000005e000000305c06082b0601050507030306082b0601050507030106082b0601050507030206082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b06010505070308060a2b0601040182370a030453000000010000002400000030223020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c014000000010000001400000055e481d11180bed889b908a331f9a1240916b9701d0000000100000010000000e871723e266f38af5d49cda2a502669c0b000000010000001000000045006e00740072007500730074000000030000000100000014000000801d62d07b449d5c5c035c98ea61fa443c2a58fe2000000001000000600400003082045c30820344a00302010202043863b966300d06092a864886f70d01010505003081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f7269747920283230343829301e170d3939313232343137353035315a170d3139313232343138323035315a3081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f726974792028323034382930820122300d06092a864886f70d01010105000382010f003082010a0282010100ad4d4ba91286b2eaa320071516642a2b4bd1bf0b4a4d8eed8076a567b77840c07342c868c0db532bdd5eb8769835938b1a9d7c133a0e1f5bb71ecfe524141eb181a98d7db8cc6b4b03f1020cdcaba54024007f7494a19d0829b3880bf587779d55cde4c37ed76a64ab851486955b9732506f3dc8ba660ce3fcbdb849c176894919fdc0a8bd89a3672fc69fbc711960b82de92cc99076667b94e2af78d665535d3cd69cb2cf2903f92fa450b2d448ce0532558afdb2644c0ee4980775db7fdfb9085560853029f97b48a46986e3353f1e865d7a7a15bdef008e1522541700902693bc0e496891bff847d39d9542c10e4ddf6f26cfc3182162664370d6d5c007e10203010001a3743072301106096086480186f8420101040403020007301f0603551d2304183016801455e481d11180bed889b908a331f9a1240916b970301d0603551d0e0416041455e481d11180bed889b908a331f9a1240916b970301d06092a864886f67d0741000410300e1b0856352e303a342e3003020490300d06092a864886f70d010105050003820101005947ac21848a17c99c89531eba80851ac63c4e3eb19cb67cc6925d186402e3d3060811617c63e32b9d31037076d2a328a0f4bb9a6373ed6de52adbed14a92bc63611d02beb078ba5da9e5c199d5612f55429c805edb2122a8df4031bffe7921087b03ab5c39d053712a3c7f415b9d5a439169b533a2391f1a882a26a8868c1790222bcaaa6d6aedfb0145fb887d0dd7c7f7bffaf1ccfe6db07ad5edb859dd02b0d33db04d1e64940132b76fb3ee99c890f15ce18b08578214f6b4f0efa3667cd07f2ff08d0e2ded9bf2aafb88786213c04cab794687fcf3ce998d738ffecc0d950f02e4b58ae466fd02ec360da725572bd4c459e61babf84819203d1d2697cc5	uTorrent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\801D62D07B449D5C5C035C98EA61FA443C2A58FE\Blob = 040000000100000010000000ba21ea20d6dddb8fc1578b40ada1fcfc0f0000000100000014000000f53631b5177626eb6541df5563c8187d9dca421a09000000010000005e000000305c06082b0601050507030306082b0601050507030106082b0601050507030206082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b06010505070308060a2b0601040182370a030453000000010000002400000030223020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c014000000010000001400000055e481d11180bed889b908a331f9a1240916b9701d0000000100000010000000e871723e266f38af5d49cda2a502669c0b000000010000001000000045006e00740072007500730074000000030000000100000014000000801d62d07b449d5c5c035c98ea61fa443c2a58fe19000000010000001000000091fad483f14848a8a69b18b805cdbb3a2000000001000000600400003082045c30820344a00302010202043863b966300d06092a864886f70d01010505003081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f7269747920283230343829301e170d3939313232343137353035315a170d3139313232343138323035315a3081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f726974792028323034382930820122300d06092a864886f70d01010105000382010f003082010a0282010100ad4d4ba91286b2eaa320071516642a2b4bd1bf0b4a4d8eed8076a567b77840c07342c868c0db532bdd5eb8769835938b1a9d7c133a0e1f5bb71ecfe524141eb181a98d7db8cc6b4b03f1020cdcaba54024007f7494a19d0829b3880bf587779d55cde4c37ed76a64ab851486955b9732506f3dc8ba660ce3fcbdb849c176894919fdc0a8bd89a3672fc69fbc711960b82de92cc99076667b94e2af78d665535d3cd69cb2cf2903f92fa450b2d448ce0532558afdb2644c0ee4980775db7fdfb9085560853029f97b48a46986e3353f1e865d7a7a15bdef008e1522541700902693bc0e496891bff847d39d9542c10e4ddf6f26cfc3182162664370d6d5c007e10203010001a3743072301106096086480186f8420101040403020007301f0603551d2304183016801455e481d11180bed889b908a331f9a1240916b970301d0603551d0e0416041455e481d11180bed889b908a331f9a1240916b970301d06092a864886f67d0741000410300e1b0856352e303a342e3003020490300d06092a864886f70d010105050003820101005947ac21848a17c99c89531eba80851ac63c4e3eb19cb67cc6925d186402e3d3060811617c63e32b9d31037076d2a328a0f4bb9a6373ed6de52adbed14a92bc63611d02beb078ba5da9e5c199d5612f55429c805edb2122a8df4031bffe7921087b03ab5c39d053712a3c7f415b9d5a439169b533a2391f1a882a26a8868c1790222bcaaa6d6aedfb0145fb887d0dd7c7f7bffaf1ccfe6db07ad5edb859dd02b0d33db04d1e64940132b76fb3ee99c890f15ce18b08578214f6b4f0efa3667cd07f2ff08d0e2ded9bf2aafb88786213c04cab794687fcf3ce998d738ffecc0d950f02e4b58ae466fd02ec360da725572bd4c459e61babf84819203d1d2697cc5	uTorrent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e51d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af33313353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703030f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c92000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a	uTorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	utorrent_installer.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d4624030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e709000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	utorrent_installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\801D62D07B449D5C5C035C98EA61FA443C2A58FE	uTorrent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\801D62D07B449D5C5C035C98EA61FA443C2A58FE\Blob = 19000000010000001000000091fad483f14848a8a69b18b805cdbb3a030000000100000014000000801d62d07b449d5c5c035c98ea61fa443c2a58fe0b000000010000001000000045006e007400720075007300740000001d0000000100000010000000e871723e266f38af5d49cda2a502669c14000000010000001400000055e481d11180bed889b908a331f9a1240916b97053000000010000002400000030223020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c009000000010000005e000000305c06082b0601050507030306082b0601050507030106082b0601050507030206082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b06010505070308060a2b0601040182370a03040f0000000100000014000000f53631b5177626eb6541df5563c8187d9dca421a2000000001000000600400003082045c30820344a00302010202043863b966300d06092a864886f70d01010505003081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f7269747920283230343829301e170d3939313232343137353035315a170d3139313232343138323035315a3081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f726974792028323034382930820122300d06092a864886f70d01010105000382010f003082010a0282010100ad4d4ba91286b2eaa320071516642a2b4bd1bf0b4a4d8eed8076a567b77840c07342c868c0db532bdd5eb8769835938b1a9d7c133a0e1f5bb71ecfe524141eb181a98d7db8cc6b4b03f1020cdcaba54024007f7494a19d0829b3880bf587779d55cde4c37ed76a64ab851486955b9732506f3dc8ba660ce3fcbdb849c176894919fdc0a8bd89a3672fc69fbc711960b82de92cc99076667b94e2af78d665535d3cd69cb2cf2903f92fa450b2d448ce0532558afdb2644c0ee4980775db7fdfb9085560853029f97b48a46986e3353f1e865d7a7a15bdef008e1522541700902693bc0e496891bff847d39d9542c10e4ddf6f26cfc3182162664370d6d5c007e10203010001a3743072301106096086480186f8420101040403020007301f0603551d2304183016801455e481d11180bed889b908a331f9a1240916b970301d0603551d0e0416041455e481d11180bed889b908a331f9a1240916b970301d06092a864886f67d0741000410300e1b0856352e303a342e3003020490300d06092a864886f70d010105050003820101005947ac21848a17c99c89531eba80851ac63c4e3eb19cb67cc6925d186402e3d3060811617c63e32b9d31037076d2a328a0f4bb9a6373ed6de52adbed14a92bc63611d02beb078ba5da9e5c199d5612f55429c805edb2122a8df4031bffe7921087b03ab5c39d053712a3c7f415b9d5a439169b533a2391f1a882a26a8868c1790222bcaaa6d6aedfb0145fb887d0dd7c7f7bffaf1ccfe6db07ad5edb859dd02b0d33db04d1e64940132b76fb3ee99c890f15ce18b08578214f6b4f0efa3667cd07f2ff08d0e2ded9bf2aafb88786213c04cab794687fcf3ce998d738ffecc0d950f02e4b58ae466fd02ec360da725572bd4c459e61babf84819203d1d2697cc5	uTorrent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 19000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a92000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	utorrent_installer.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e260f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a040000000100000010000000324a4bbbc863699bbe749ac6dd1d46242000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	utorrent_installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5	uTorrent.exe

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	8	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	10	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1672	uTorrent.exe
1672	uTorrent.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
1296	uTorrent.exe
1296	uTorrent.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1296	uTorrent.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	596	taskmgr.exe
Token: SeManageVolumePrivilege	1860	utorrent.exe
Token: SeManageVolumePrivilege	1296	uTorrent.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
1140	utorrent_installer.tmp
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
1296	uTorrent.exe
1296	uTorrent.exe
1296	uTorrent.exe
532	iexplore.exe
1296	uTorrent.exe

Suspicious use of SendNotifyMessage 42 IoCs

pid	Process
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
596	taskmgr.exe
1296	uTorrent.exe
1296	uTorrent.exe
1296	uTorrent.exe
1296	uTorrent.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
532	iexplore.exe
532	iexplore.exe
1532	IEXPLORE.EXE
1532	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 1140	1364	utorrent_installer.exe	28
PID 1364 wrote to memory of 1140	1364	utorrent_installer.exe	28
PID 1364 wrote to memory of 1140	1364	utorrent_installer.exe	28
PID 1364 wrote to memory of 1140	1364	utorrent_installer.exe	28
PID 1364 wrote to memory of 1140	1364	utorrent_installer.exe	28
PID 1364 wrote to memory of 1140	1364	utorrent_installer.exe	28
PID 1364 wrote to memory of 1140	1364	utorrent_installer.exe	28
PID 1140 wrote to memory of 1672	1140	utorrent_installer.tmp	29
PID 1140 wrote to memory of 1672	1140	utorrent_installer.tmp	29
PID 1140 wrote to memory of 1672	1140	utorrent_installer.tmp	29
PID 1140 wrote to memory of 1672	1140	utorrent_installer.tmp	29
PID 1672 wrote to memory of 1860	1672	uTorrent.exe	33
PID 1672 wrote to memory of 1860	1672	uTorrent.exe	33
PID 1672 wrote to memory of 1860	1672	uTorrent.exe	33
PID 1672 wrote to memory of 1860	1672	uTorrent.exe	33
PID 1140 wrote to memory of 1296	1140	utorrent_installer.tmp	36
PID 1140 wrote to memory of 1296	1140	utorrent_installer.tmp	36
PID 1140 wrote to memory of 1296	1140	utorrent_installer.tmp	36
PID 1140 wrote to memory of 1296	1140	utorrent_installer.tmp	36
PID 1296 wrote to memory of 2044	1296	uTorrent.exe	38
PID 1296 wrote to memory of 2044	1296	uTorrent.exe	38
PID 1296 wrote to memory of 2044	1296	uTorrent.exe	38
PID 1296 wrote to memory of 2044	1296	uTorrent.exe	38
PID 1296 wrote to memory of 896	1296	uTorrent.exe	39
PID 1296 wrote to memory of 896	1296	uTorrent.exe	39
PID 1296 wrote to memory of 896	1296	uTorrent.exe	39
PID 1296 wrote to memory of 896	1296	uTorrent.exe	39
PID 1296 wrote to memory of 532	1296	uTorrent.exe	40
PID 1296 wrote to memory of 532	1296	uTorrent.exe	40
PID 1296 wrote to memory of 532	1296	uTorrent.exe	40
PID 1296 wrote to memory of 532	1296	uTorrent.exe	40
PID 532 wrote to memory of 1532	532	iexplore.exe	41
PID 532 wrote to memory of 1532	532	iexplore.exe	41
PID 532 wrote to memory of 1532	532	iexplore.exe	41
PID 532 wrote to memory of 1532	532	iexplore.exe	41
PID 1296 wrote to memory of 1644	1296	uTorrent.exe	44
PID 1296 wrote to memory of 1644	1296	uTorrent.exe	44
PID 1296 wrote to memory of 1644	1296	uTorrent.exe	44
PID 1296 wrote to memory of 1644	1296	uTorrent.exe	44
PID 1296 wrote to memory of 1804	1296	uTorrent.exe	45
PID 1296 wrote to memory of 1804	1296	uTorrent.exe	45
PID 1296 wrote to memory of 1804	1296	uTorrent.exe	45
PID 1296 wrote to memory of 1804	1296	uTorrent.exe	45
PID 1296 wrote to memory of 1668	1296	uTorrent.exe	46
PID 1296 wrote to memory of 1668	1296	uTorrent.exe	46
PID 1296 wrote to memory of 1668	1296	uTorrent.exe	46
PID 1296 wrote to memory of 1668	1296	uTorrent.exe	46

C:\Users\Admin\AppData\Local\Temp\utorrent_installer.exe
"C:\Users\Admin\AppData\Local\Temp\utorrent_installer.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Users\Admin\AppData\Local\Temp\is-JJMFJ.tmp\utorrent_installer.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-JJMFJ.tmp\utorrent_installer.tmp" /SL5="$70122,874637,815104,C:\Users\Admin\AppData\Local\Temp\utorrent_installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies system certificate store
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1140
- - C:\Users\Admin\AppData\Local\Temp\is-MHRC1.tmp\uTorrent.exe
    "C:\Users\Admin\AppData\Local\Temp\is-MHRC1.tmp\uTorrent.exe" /S /FORCEINSTALL 1110010101111110
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1672
  - - C:\Users\Admin\AppData\Local\Temp\utorrent\utorrent.exe
      "C:\Users\Admin\AppData\Local\Temp\utorrent\utorrent.exe" /S /FORCEINSTALL 1110010101111110
      4⤵
      Executes dropped EXE
      Identifies Wine through registry keys
      Loads dropped DLL
      Adds Run key to start application
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:1860
- - C:\Users\Admin\AppData\Roaming\uTorrent\uTorrent.exe
    "C:\Users\Admin\AppData\Roaming\uTorrent\uTorrent.exe"
    3⤵
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - Adds Run key to start application
    - Modifies Internet Explorer settings
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1296
  - - C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_46590\utorrentie.exe
      "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_46590\utorrentie.exe" uTorrent_1296_003BA410_1664152123 µTorrent4823DF041B09 uTorrent ie unp
      4⤵
      Executes dropped EXE
      PID:2044
  - - C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_46590\utorrentie.exe
      "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_46590\utorrentie.exe" uTorrent_1296_003BAA88_627266897 µTorrent4823DF041B09 uTorrent ie unp
      4⤵
      Executes dropped EXE
      PID:896
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://utorrent.com/prodnews?v=3%2e6%2e0%2e1%2e46590&pv=0.0.0.0.0
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:532
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:532 CREDAT:275457 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1532
  - - C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_46590\utorrentie.exe
      "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_46590\utorrentie.exe" uTorrent_1296_003BB328_1340015112 µTorrent4823DF041B09 uTorrent ie unp
      4⤵
      Executes dropped EXE
      PID:1644
  - - C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_46590\utorrentie.exe
      "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_46590\utorrentie.exe" uTorrent_1296_003BB550_888388999 µTorrent4823DF041B09 uTorrent ie unp
      4⤵
      Executes dropped EXE
      PID:1804
  - - C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_46590\utorrentie.exe
      "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_46590\utorrentie.exe" uTorrent_1296_003BBDF0_1960065148 µTorrent4823DF041B09 uTorrent ie unp
      4⤵
      Executes dropped EXE
      PID:1668

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:596

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}
1⤵
PID:1644

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}
1⤵
PID:360

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}
1⤵
PID:764

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
faa80c908a8ea946c95bbb898db5e805

SHA1
5971cb0603472310748ba0dec09dcd33eb2bd624

SHA256
8399b1aed9a0492d5f3ca1e0f3fee87b3c56cec8a29094981fdd3354fbab3b30

SHA512
2155e94bb0771ccfba0a895e5bda38ea8b2cd9886bafa74ac3559aac0cc72940770dc698e5de7295eb8d16f551b9e28c47eb77f65beb78c47421f3c1c95873a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06b029d6f0eef716adc43912529e9c1e

SHA1
ad2749a5decdaff7a66dd9b9834650f23733c3c5

SHA256
e6f81150263b705f0422851d537ae7502d316e34a249a316fa704d028b3411b5

SHA512
47e850d1157221b36faed6d11d5e8bdf76a13219c832bdad8d3e89cd70f5905d4f1bf38ae24d8d354dd7006b53ddb0004653b50ab64c456ba8133cf711163865

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-JJMFJ.tmp\utorrent_installer.tmp

Filesize
3.0MB

MD5
9a777cdc480689793142d6f078d8f0b5

SHA1
cb1e715b6bad3919d98124e9eb9e2c53036122dd

SHA256
c06e4c58f103d4f57495aecfa67c43380031c77c83fa4a040c72c51700376df2

SHA512
b03b71a2fa7adb65220e767460a2e8b0ffa030fba8d29a2f5b186d48a51c48fbd5c287d22a6ffa9e19cd629c6bcd6d4c9f6f06c02045c27ffff9ce12b5fcedcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-JJMFJ.tmp\utorrent_installer.tmp

Filesize
3.0MB

MD5
9a777cdc480689793142d6f078d8f0b5

SHA1
cb1e715b6bad3919d98124e9eb9e2c53036122dd

SHA256
c06e4c58f103d4f57495aecfa67c43380031c77c83fa4a040c72c51700376df2

SHA512
b03b71a2fa7adb65220e767460a2e8b0ffa030fba8d29a2f5b186d48a51c48fbd5c287d22a6ffa9e19cd629c6bcd6d4c9f6f06c02045c27ffff9ce12b5fcedcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-MHRC1.tmp\uTorrent.exe

Filesize
16.0MB

MD5
4b4149c544ea79accc7cb55015fcc0fa

SHA1
15c3057a1cf0bbc1fce679effbd5a41f4ede32d1

SHA256
761be1c00f156caa8d04db5bd0e2f7b3f12fd0b4b9f29bd4e0af13125f2e4646

SHA512
5665497d1099c50effa031718989208b48f1e76e5d19de26892c33163981e2183ce991a84e0be45ba9d67a0b61730f41fcec63c0b6505d218ddc058cc1e726d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-MHRC1.tmp\uTorrent.exe

Filesize
16.0MB

MD5
4b4149c544ea79accc7cb55015fcc0fa

SHA1
15c3057a1cf0bbc1fce679effbd5a41f4ede32d1

SHA256
761be1c00f156caa8d04db5bd0e2f7b3f12fd0b4b9f29bd4e0af13125f2e4646

SHA512
5665497d1099c50effa031718989208b48f1e76e5d19de26892c33163981e2183ce991a84e0be45ba9d67a0b61730f41fcec63c0b6505d218ddc058cc1e726d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\utorrent\datachannel.dll

Filesize
1.3MB

MD5
88477392128d8d6a1b310fedd8da6eea

SHA1
9770f6eb494e5c6969d38b2d99a650788fafbf6a

SHA256
0da7803bdd72de8f635336057d3d672b645d4da963e5c61544a4c5a2e8289fd8

SHA512
9d17b76286dbfba33a83d62c1404fc445da0f6c3942b6139e2ed52cec6269a5b3fca4ae4ec68f2976a8aac1150069fc4a0801103ed5f72b87a8277f0cff764d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\utorrent\libcrypto-3.dll

Filesize
3.6MB

MD5
a6ad50c212af59dd55540c0f2d0aa726

SHA1
790987aba7e05bf7ef3112ea3c281b89f95bc9ed

SHA256
fe0d5ae8d42c622fcbff51ba0f5f33a1e46413f98993e7d216f7b463887f399c

SHA512
2b253ffe0edd35bb0fe822c81daeb206509b01c28a05d2d8f82273ce7f702adfcc5481c00ea0c2fc96db6a891a370ded7aec6c41f4f5e7313c3f8172481b865c

Download Submit
C:\Users\Admin\AppData\Local\Temp\utorrent\libssl-3.dll

Filesize
605KB

MD5
f0a84546ec2e90432b4640602b955dc0

SHA1
51deb3ad7d178c043084160a58fe4a3b9ae0bb97

SHA256
e036ede168df29fe641519dee38f62048f5992adeb3aafc65fd353db52280326

SHA512
d292ffe34893d16a93a282a1fefb3298e3cd605e54784bcd37c70d4e9b66d40b33a292337dcd741bab6425158d18f800fd5d942120d770cecbb022ccf4601ae2

Download Submit
C:\Users\Admin\AppData\Local\Temp\utorrent\utorrent.exe

Filesize
2.6MB

MD5
06f659e92a757aec084403ec483e3d55

SHA1
272898b63a12f386c7e51c059690a79b2d95807e

SHA256
98053c48d68fdcbfce8905c70305f2ad69cc2775691106d321a52e09bc64f983

SHA512
5510ebfe240d18ea5de8686e1977ed06712ca2203cf29d01a3326d08f047272f67518b16394d50c7aa05712cb78d3a24323f2eb4bdadc2c2d21c57ba396f60ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\utorrent\utorrent.exe

Filesize
2.6MB

MD5
06f659e92a757aec084403ec483e3d55

SHA1
272898b63a12f386c7e51c059690a79b2d95807e

SHA256
98053c48d68fdcbfce8905c70305f2ad69cc2775691106d321a52e09bc64f983

SHA512
5510ebfe240d18ea5de8686e1977ed06712ca2203cf29d01a3326d08f047272f67518b16394d50c7aa05712cb78d3a24323f2eb4bdadc2c2d21c57ba396f60ea

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3385717845-2518323428-350143044-1000\1f91d2d17ea675d4c2c3192e241743f9_dae2938e-27ce-4a80-bf74-6da89b87415b

Filesize
1KB

MD5
5873ab015af10fb47dd167ae73d75f53

SHA1
edf0648408c8651a84395523221d0e9924f414bb

SHA256
61a022e2d520618296ecd94158760b825e71ed8e21d354196f4f23ff28d69b87

SHA512
90db7ea63c4ad8c0958c981e0bf144c5e2703c97f232c5e022abce4992e260e330db498a501b918f562f0376a9f4537681608e22593ad7bb578f9636982f6ee7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\9IWBJTQT.txt

Filesize
89B

MD5
4d956a344c0459a038f871c6941fe106

SHA1
a1a6cd9756e261f6d781d61ade65b55fa221b88f

SHA256
e298389bfb7c2ebe0edeb3028a801e638a18c8d0116cc146ac1a1094cfa249e6

SHA512
75961633674552b27e8fbf0700aee84a0920aaf53c9b541389647ec59d6ea3dfe98f1a8dc3735d55b4deaac5ca2ace5290d8b925d607dabad07836cc6936a2ea

Download Submit
C:\Users\Admin\AppData\Roaming\uTorrent\datachannel.dll

Filesize
1.3MB

MD5
88477392128d8d6a1b310fedd8da6eea

SHA1
9770f6eb494e5c6969d38b2d99a650788fafbf6a

SHA256
0da7803bdd72de8f635336057d3d672b645d4da963e5c61544a4c5a2e8289fd8

SHA512
9d17b76286dbfba33a83d62c1404fc445da0f6c3942b6139e2ed52cec6269a5b3fca4ae4ec68f2976a8aac1150069fc4a0801103ed5f72b87a8277f0cff764d2

Download Submit
C:\Users\Admin\AppData\Roaming\uTorrent\libcrypto-3.dll

Filesize
3.6MB

MD5
a6ad50c212af59dd55540c0f2d0aa726

SHA1
790987aba7e05bf7ef3112ea3c281b89f95bc9ed

SHA256
fe0d5ae8d42c622fcbff51ba0f5f33a1e46413f98993e7d216f7b463887f399c

SHA512
2b253ffe0edd35bb0fe822c81daeb206509b01c28a05d2d8f82273ce7f702adfcc5481c00ea0c2fc96db6a891a370ded7aec6c41f4f5e7313c3f8172481b865c

Download Submit
C:\Users\Admin\AppData\Roaming\uTorrent\libssl-3.dll

Filesize
605KB

MD5
f0a84546ec2e90432b4640602b955dc0

SHA1
51deb3ad7d178c043084160a58fe4a3b9ae0bb97

SHA256
e036ede168df29fe641519dee38f62048f5992adeb3aafc65fd353db52280326

SHA512
d292ffe34893d16a93a282a1fefb3298e3cd605e54784bcd37c70d4e9b66d40b33a292337dcd741bab6425158d18f800fd5d942120d770cecbb022ccf4601ae2

Download Submit
C:\Users\Admin\AppData\Roaming\uTorrent\settings.dat

Filesize
8KB

MD5
87ba63733601b89223e1a6fccc6c93ca

SHA1
20b839cf4a1b7043b95fb3fd86cf0b001bfd586f

SHA256
3198cf1e185311c97b89c72d51a3c99f987cc8b592f437e7ee5151db06a8d0ae

SHA512
4cc700609d5cc06e567e630163a2bb51ffa8e67ad42a49aea8cabe186eab177550a218633d4d45d2f25003dc547c5d51c2b37f6e31f717079abefb367e304e44

Download Submit
C:\Users\Admin\AppData\Roaming\uTorrent\uTorrent.exe

Filesize
2.6MB

MD5
06f659e92a757aec084403ec483e3d55

SHA1
272898b63a12f386c7e51c059690a79b2d95807e

SHA256
98053c48d68fdcbfce8905c70305f2ad69cc2775691106d321a52e09bc64f983

SHA512
5510ebfe240d18ea5de8686e1977ed06712ca2203cf29d01a3326d08f047272f67518b16394d50c7aa05712cb78d3a24323f2eb4bdadc2c2d21c57ba396f60ea

Download Submit
C:\Users\Admin\AppData\Roaming\utorrent\uTorrent.exe

Filesize
2.6MB

MD5
06f659e92a757aec084403ec483e3d55

SHA1
272898b63a12f386c7e51c059690a79b2d95807e

SHA256
98053c48d68fdcbfce8905c70305f2ad69cc2775691106d321a52e09bc64f983

SHA512
5510ebfe240d18ea5de8686e1977ed06712ca2203cf29d01a3326d08f047272f67518b16394d50c7aa05712cb78d3a24323f2eb4bdadc2c2d21c57ba396f60ea

Download Submit
C:\Users\Admin\AppData\Roaming\utorrent\updates\3.6.0_46590\utorrentie.exe

Filesize
407KB

MD5
e3c7c62f4e1e7e041e5b4e51c08602db

SHA1
1c2b73310ea7b075d5c3ae9ef83611e2c125795e

SHA256
0db1007bc3d645bffb1466c2e325a512317099c4f7d6dbbc2cbc45b8622c3f48

SHA512
a8734b17a81d363becb5ec5207fce03b534c7f29cafc2ec79866c049534665435af638904df8087e596309de129059acc54682478c0a5949ea3a7c9deae296e1

Download Submit
C:\Users\Admin\AppData\Roaming\utorrent\updates\3.6.0_46590\utorrentie.exe

Filesize
407KB

MD5
e3c7c62f4e1e7e041e5b4e51c08602db

SHA1
1c2b73310ea7b075d5c3ae9ef83611e2c125795e

SHA256
0db1007bc3d645bffb1466c2e325a512317099c4f7d6dbbc2cbc45b8622c3f48

SHA512
a8734b17a81d363becb5ec5207fce03b534c7f29cafc2ec79866c049534665435af638904df8087e596309de129059acc54682478c0a5949ea3a7c9deae296e1

Download Submit
C:\Users\Admin\AppData\Roaming\utorrent\updates\3.6.0_46590\utorrentie.exe

Filesize
407KB

MD5
e3c7c62f4e1e7e041e5b4e51c08602db

SHA1
1c2b73310ea7b075d5c3ae9ef83611e2c125795e

SHA256
0db1007bc3d645bffb1466c2e325a512317099c4f7d6dbbc2cbc45b8622c3f48

SHA512
a8734b17a81d363becb5ec5207fce03b534c7f29cafc2ec79866c049534665435af638904df8087e596309de129059acc54682478c0a5949ea3a7c9deae296e1

Download Submit
C:\Users\Admin\AppData\Roaming\utorrent\updates\3.6.0_46590\utorrentie.exe

Filesize
407KB

MD5
e3c7c62f4e1e7e041e5b4e51c08602db

SHA1
1c2b73310ea7b075d5c3ae9ef83611e2c125795e

SHA256
0db1007bc3d645bffb1466c2e325a512317099c4f7d6dbbc2cbc45b8622c3f48

SHA512
a8734b17a81d363becb5ec5207fce03b534c7f29cafc2ec79866c049534665435af638904df8087e596309de129059acc54682478c0a5949ea3a7c9deae296e1

Download Submit
C:\Users\Admin\AppData\Roaming\utorrent\updates\3.6.0_46590\utorrentie.exe

Filesize
407KB

MD5
e3c7c62f4e1e7e041e5b4e51c08602db

SHA1
1c2b73310ea7b075d5c3ae9ef83611e2c125795e

SHA256
0db1007bc3d645bffb1466c2e325a512317099c4f7d6dbbc2cbc45b8622c3f48

SHA512
a8734b17a81d363becb5ec5207fce03b534c7f29cafc2ec79866c049534665435af638904df8087e596309de129059acc54682478c0a5949ea3a7c9deae296e1

Download Submit
\Users\Admin\AppData\Local\Temp\is-JJMFJ.tmp\utorrent_installer.tmp

Filesize
3.0MB

MD5
9a777cdc480689793142d6f078d8f0b5

SHA1
cb1e715b6bad3919d98124e9eb9e2c53036122dd

SHA256
c06e4c58f103d4f57495aecfa67c43380031c77c83fa4a040c72c51700376df2

SHA512
b03b71a2fa7adb65220e767460a2e8b0ffa030fba8d29a2f5b186d48a51c48fbd5c287d22a6ffa9e19cd629c6bcd6d4c9f6f06c02045c27ffff9ce12b5fcedcf

Download Submit
\Users\Admin\AppData\Local\Temp\is-MHRC1.tmp\botva2.dll

Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
\Users\Admin\AppData\Local\Temp\is-MHRC1.tmp\uTorrent.exe

Filesize
16.0MB

MD5
4b4149c544ea79accc7cb55015fcc0fa

SHA1
15c3057a1cf0bbc1fce679effbd5a41f4ede32d1

SHA256
761be1c00f156caa8d04db5bd0e2f7b3f12fd0b4b9f29bd4e0af13125f2e4646

SHA512
5665497d1099c50effa031718989208b48f1e76e5d19de26892c33163981e2183ce991a84e0be45ba9d67a0b61730f41fcec63c0b6505d218ddc058cc1e726d6

Download Submit
\Users\Admin\AppData\Local\Temp\nst8BAE.tmp\FindProcDLL.dll

Filesize
3KB

MD5
b4faf654de4284a89eaf7d073e4e1e63

SHA1
8efcfd1ca648e942cbffd27af429784b7fcf514b

SHA256
c0948b2ec36a69f82c08935fac4b212238b6792694f009b93b4bdb478c4f26e3

SHA512
eef31e332be859cf2a64c928bf3b96442f36fe51f1a372c5628264a0d4b2fc7b3e670323c8fb5ffa72db995b8924da2555198e7de7b4f549d9e0f9e6dbb6b388

Download Submit
\Users\Admin\AppData\Local\Temp\nst8BAE.tmp\INetC.dll

Filesize
24KB

MD5
640bff73a5f8e37b202d911e4749b2e9

SHA1
9588dd7561ab7de3bca392b084bec91f3521c879

SHA256
c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502

SHA512
39c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a

Download Submit
\Users\Admin\AppData\Local\Temp\nst8BAE.tmp\INetC.dll

Filesize
24KB

MD5
640bff73a5f8e37b202d911e4749b2e9

SHA1
9588dd7561ab7de3bca392b084bec91f3521c879

SHA256
c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502

SHA512
39c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a

Download Submit
\Users\Admin\AppData\Local\Temp\nst8BAE.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
\Users\Admin\AppData\Local\Temp\nst8BAE.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
\Users\Admin\AppData\Local\Temp\nst8BAE.tmp\nsisFirewall.dll

Filesize
8KB

MD5
f5bf81a102de52a4add21b8a367e54e0

SHA1
cf1e76ffe4a3ecd4dad453112afd33624f16751c

SHA256
53be5716ad80945cb99681d5dbda60492f5dfb206fbfdb776b769b3eeb18d2c2

SHA512
6e280a75f706474ad31b2ce770fa34f54cb598528fac4477c466200a608b79c0f9b84011545595d9ba94331ad08e2f51bd42de91f92379db27686a28ba351256

Download Submit
\Users\Admin\AppData\Local\Temp\utorrent\datachannel.dll

Filesize
1.3MB

MD5
88477392128d8d6a1b310fedd8da6eea

SHA1
9770f6eb494e5c6969d38b2d99a650788fafbf6a

SHA256
0da7803bdd72de8f635336057d3d672b645d4da963e5c61544a4c5a2e8289fd8

SHA512
9d17b76286dbfba33a83d62c1404fc445da0f6c3942b6139e2ed52cec6269a5b3fca4ae4ec68f2976a8aac1150069fc4a0801103ed5f72b87a8277f0cff764d2

Download Submit
\Users\Admin\AppData\Local\Temp\utorrent\libcrypto-3.dll

Filesize
3.6MB

MD5
a6ad50c212af59dd55540c0f2d0aa726

SHA1
790987aba7e05bf7ef3112ea3c281b89f95bc9ed

SHA256
fe0d5ae8d42c622fcbff51ba0f5f33a1e46413f98993e7d216f7b463887f399c

SHA512
2b253ffe0edd35bb0fe822c81daeb206509b01c28a05d2d8f82273ce7f702adfcc5481c00ea0c2fc96db6a891a370ded7aec6c41f4f5e7313c3f8172481b865c

Download Submit
\Users\Admin\AppData\Local\Temp\utorrent\libssl-3.dll

Filesize
605KB

MD5
f0a84546ec2e90432b4640602b955dc0

SHA1
51deb3ad7d178c043084160a58fe4a3b9ae0bb97

SHA256
e036ede168df29fe641519dee38f62048f5992adeb3aafc65fd353db52280326

SHA512
d292ffe34893d16a93a282a1fefb3298e3cd605e54784bcd37c70d4e9b66d40b33a292337dcd741bab6425158d18f800fd5d942120d770cecbb022ccf4601ae2

Download Submit
\Users\Admin\AppData\Local\Temp\utorrent\utorrent.exe

Filesize
2.6MB

MD5
06f659e92a757aec084403ec483e3d55

SHA1
272898b63a12f386c7e51c059690a79b2d95807e

SHA256
98053c48d68fdcbfce8905c70305f2ad69cc2775691106d321a52e09bc64f983

SHA512
5510ebfe240d18ea5de8686e1977ed06712ca2203cf29d01a3326d08f047272f67518b16394d50c7aa05712cb78d3a24323f2eb4bdadc2c2d21c57ba396f60ea

Download Submit
\Users\Admin\AppData\Roaming\utorrent\datachannel.dll

Filesize
1.3MB

MD5
88477392128d8d6a1b310fedd8da6eea

SHA1
9770f6eb494e5c6969d38b2d99a650788fafbf6a

SHA256
0da7803bdd72de8f635336057d3d672b645d4da963e5c61544a4c5a2e8289fd8

SHA512
9d17b76286dbfba33a83d62c1404fc445da0f6c3942b6139e2ed52cec6269a5b3fca4ae4ec68f2976a8aac1150069fc4a0801103ed5f72b87a8277f0cff764d2

Download Submit
\Users\Admin\AppData\Roaming\utorrent\libcrypto-3.dll

Filesize
3.6MB

MD5
a6ad50c212af59dd55540c0f2d0aa726

SHA1
790987aba7e05bf7ef3112ea3c281b89f95bc9ed

SHA256
fe0d5ae8d42c622fcbff51ba0f5f33a1e46413f98993e7d216f7b463887f399c

SHA512
2b253ffe0edd35bb0fe822c81daeb206509b01c28a05d2d8f82273ce7f702adfcc5481c00ea0c2fc96db6a891a370ded7aec6c41f4f5e7313c3f8172481b865c

Download Submit
\Users\Admin\AppData\Roaming\utorrent\libssl-3.dll

Filesize
605KB

MD5
f0a84546ec2e90432b4640602b955dc0

SHA1
51deb3ad7d178c043084160a58fe4a3b9ae0bb97

SHA256
e036ede168df29fe641519dee38f62048f5992adeb3aafc65fd353db52280326

SHA512
d292ffe34893d16a93a282a1fefb3298e3cd605e54784bcd37c70d4e9b66d40b33a292337dcd741bab6425158d18f800fd5d942120d770cecbb022ccf4601ae2

Download Submit
\Users\Admin\AppData\Roaming\utorrent\uTorrent.exe

Filesize
2.6MB

MD5
06f659e92a757aec084403ec483e3d55

SHA1
272898b63a12f386c7e51c059690a79b2d95807e

SHA256
98053c48d68fdcbfce8905c70305f2ad69cc2775691106d321a52e09bc64f983

SHA512
5510ebfe240d18ea5de8686e1977ed06712ca2203cf29d01a3326d08f047272f67518b16394d50c7aa05712cb78d3a24323f2eb4bdadc2c2d21c57ba396f60ea

Download Submit
\Users\Admin\AppData\Roaming\utorrent\uTorrent.exe

Filesize
2.6MB

MD5
06f659e92a757aec084403ec483e3d55

SHA1
272898b63a12f386c7e51c059690a79b2d95807e

SHA256
98053c48d68fdcbfce8905c70305f2ad69cc2775691106d321a52e09bc64f983

SHA512
5510ebfe240d18ea5de8686e1977ed06712ca2203cf29d01a3326d08f047272f67518b16394d50c7aa05712cb78d3a24323f2eb4bdadc2c2d21c57ba396f60ea

Download Submit
\Users\Admin\AppData\Roaming\utorrent\uTorrent.exe

Filesize
2.6MB

MD5
06f659e92a757aec084403ec483e3d55

SHA1
272898b63a12f386c7e51c059690a79b2d95807e

SHA256
98053c48d68fdcbfce8905c70305f2ad69cc2775691106d321a52e09bc64f983

SHA512
5510ebfe240d18ea5de8686e1977ed06712ca2203cf29d01a3326d08f047272f67518b16394d50c7aa05712cb78d3a24323f2eb4bdadc2c2d21c57ba396f60ea

Download Submit
\Users\Admin\AppData\Roaming\utorrent\updates\3.6.0_46590\utorrentie.exe

Filesize
407KB

MD5
e3c7c62f4e1e7e041e5b4e51c08602db

SHA1
1c2b73310ea7b075d5c3ae9ef83611e2c125795e

SHA256
0db1007bc3d645bffb1466c2e325a512317099c4f7d6dbbc2cbc45b8622c3f48

SHA512
a8734b17a81d363becb5ec5207fce03b534c7f29cafc2ec79866c049534665435af638904df8087e596309de129059acc54682478c0a5949ea3a7c9deae296e1

Download Submit
\Users\Admin\AppData\Roaming\utorrent\updates\3.6.0_46590\utorrentie.exe

Filesize
407KB

MD5
e3c7c62f4e1e7e041e5b4e51c08602db

SHA1
1c2b73310ea7b075d5c3ae9ef83611e2c125795e

SHA256
0db1007bc3d645bffb1466c2e325a512317099c4f7d6dbbc2cbc45b8622c3f48

SHA512
a8734b17a81d363becb5ec5207fce03b534c7f29cafc2ec79866c049534665435af638904df8087e596309de129059acc54682478c0a5949ea3a7c9deae296e1

Download Submit
\Users\Admin\AppData\Roaming\utorrent\updates\3.6.0_46590\utorrentie.exe

Filesize
407KB

MD5
e3c7c62f4e1e7e041e5b4e51c08602db

SHA1
1c2b73310ea7b075d5c3ae9ef83611e2c125795e

SHA256
0db1007bc3d645bffb1466c2e325a512317099c4f7d6dbbc2cbc45b8622c3f48

SHA512
a8734b17a81d363becb5ec5207fce03b534c7f29cafc2ec79866c049534665435af638904df8087e596309de129059acc54682478c0a5949ea3a7c9deae296e1

Download Submit
\Users\Admin\AppData\Roaming\utorrent\updates\3.6.0_46590\utorrentie.exe

Filesize
407KB

MD5
e3c7c62f4e1e7e041e5b4e51c08602db

SHA1
1c2b73310ea7b075d5c3ae9ef83611e2c125795e

SHA256
0db1007bc3d645bffb1466c2e325a512317099c4f7d6dbbc2cbc45b8622c3f48

SHA512
a8734b17a81d363becb5ec5207fce03b534c7f29cafc2ec79866c049534665435af638904df8087e596309de129059acc54682478c0a5949ea3a7c9deae296e1

Download Submit
\Users\Admin\AppData\Roaming\utorrent\updates\3.6.0_46590\utorrentie.exe

Filesize
407KB

MD5
e3c7c62f4e1e7e041e5b4e51c08602db

SHA1
1c2b73310ea7b075d5c3ae9ef83611e2c125795e

SHA256
0db1007bc3d645bffb1466c2e325a512317099c4f7d6dbbc2cbc45b8622c3f48

SHA512
a8734b17a81d363becb5ec5207fce03b534c7f29cafc2ec79866c049534665435af638904df8087e596309de129059acc54682478c0a5949ea3a7c9deae296e1

Download Submit
\Users\Admin\AppData\Roaming\utorrent\updates\3.6.0_46590\utorrentie.exe

Filesize
407KB

MD5
e3c7c62f4e1e7e041e5b4e51c08602db

SHA1
1c2b73310ea7b075d5c3ae9ef83611e2c125795e

SHA256
0db1007bc3d645bffb1466c2e325a512317099c4f7d6dbbc2cbc45b8622c3f48

SHA512
a8734b17a81d363becb5ec5207fce03b534c7f29cafc2ec79866c049534665435af638904df8087e596309de129059acc54682478c0a5949ea3a7c9deae296e1

Download Submit
memory/596-75-0x000007FEFB731000-0x000007FEFB733000-memory.dmp

Filesize
8KB

Download
memory/596-77-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/596-78-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1140-64-0x0000000073C01000-0x0000000073C03000-memory.dmp

Filesize
8KB

Download
memory/1296-113-0x0000000000400000-0x0000000000D1D000-memory.dmp

Filesize
9.1MB

Download
memory/1296-130-0x0000000000400000-0x0000000000D1D000-memory.dmp

Filesize
9.1MB

Download
memory/1364-55-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/1364-61-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/1364-54-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/1364-112-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/1672-90-0x00000000042A0000-0x0000000004BBD000-memory.dmp

Filesize
9.1MB

Download
memory/1860-97-0x0000000003D60000-0x0000000003D70000-memory.dmp

Filesize
64KB

Download
memory/1860-98-0x0000000000400000-0x0000000000D1D000-memory.dmp

Filesize
9.1MB

Download
memory/1860-91-0x0000000000400000-0x0000000000D1D000-memory.dmp

Filesize
9.1MB

Download
memory/1860-96-0x0000000003D60000-0x0000000003D70000-memory.dmp

Filesize
64KB

Download
memory/1860-95-0x0000000003D60000-0x0000000003D70000-memory.dmp

Filesize
64KB

Download