f63240082e6fe7f88706b94a8d2f8cda68bd420bfff1c22140a1403041347d5a

Analysis

max time kernel
236s
max time network
238s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-01-2024 12:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Downloads.exe
Size

4.0MB
MD5

cd8f4e150be0693f4b1336a6c9702702
SHA1

57be21a8e57685ed144acacf3d55e3c6a0d5edac
SHA256

f63240082e6fe7f88706b94a8d2f8cda68bd420bfff1c22140a1403041347d5a
SHA512

2fc2da8396ee36c9ecf62400302980da203070195e9f4b6fe4f6c6f3b5ccfc8d8b64850ed158e1d539f0e9a9bdce7e00db9848dc03bdaf5ae77494b779989077
SSDEEP

98304:FszYBRrkXK0TX8hokq4+cbrHiNWvcRvi227kVy2KRE2PEdD3rDD:kYIXL8hg4zaYvcc/o7KREN9rX

Score

8^/10

discovery evasion persistence upx

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 7 IoCs

pid	Process
2576	utorrent_installer.exe
2936	utorrent.exe
2324	uTorrent.exe
328	utorrentie.exe
1156	utorrentie.exe
880	utorrentie.exe
2164	utorrentie.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Wine	uTorrent.exe
Key opened	\REGISTRY\MACHINE\Software\Wow6432Node\Wine	utorrent.exe
Key opened	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Wine	utorrent.exe
Key opened	\REGISTRY\MACHINE\Software\Wow6432Node\Wine	uTorrent.exe

Loads dropped DLL 16 IoCs

pid	Process
2576	utorrent_installer.exe
2576	utorrent_installer.exe
2576	utorrent_installer.exe
2576	utorrent_installer.exe
2576	utorrent_installer.exe
2936	utorrent.exe
2936	utorrent.exe
2936	utorrent.exe
2936	utorrent.exe
2324	uTorrent.exe
2576	utorrent_installer.exe
2324	uTorrent.exe
2324	uTorrent.exe
2324	uTorrent.exe
2324	uTorrent.exe
2324	uTorrent.exe

UPX packed file 34 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0006000000016b98-50.dat	upx
behavioral1/files/0x0006000000016b98-47.dat	upx
behavioral1/memory/2936-53-0x0000000000400000-0x00000000009D2000-memory.dmp	upx
behavioral1/files/0x0006000000016b98-55.dat	upx
behavioral1/files/0x0006000000016cee-66.dat	upx
behavioral1/memory/2936-81-0x0000000000400000-0x00000000009D2000-memory.dmp	upx
behavioral1/memory/2936-82-0x0000000000400000-0x00000000009D2000-memory.dmp	upx
behavioral1/files/0x0006000000016d5c-94.dat	upx
behavioral1/memory/2936-99-0x0000000000400000-0x00000000009D2000-memory.dmp	upx
behavioral1/files/0x0006000000016d5c-86.dat	upx
behavioral1/files/0x0006000000016d5c-90.dat	upx
behavioral1/memory/2936-114-0x0000000000400000-0x00000000009D2000-memory.dmp	upx
behavioral1/files/0x0006000000016d5c-113.dat	upx
behavioral1/memory/2324-117-0x0000000000400000-0x00000000009D2000-memory.dmp	upx
behavioral1/files/0x0006000000016d5c-123.dat	upx
behavioral1/memory/2324-172-0x0000000000400000-0x00000000009D2000-memory.dmp	upx
behavioral1/memory/2324-179-0x0000000000400000-0x00000000009D2000-memory.dmp	upx
behavioral1/memory/2324-609-0x0000000000400000-0x00000000009D2000-memory.dmp	upx
behavioral1/memory/2324-610-0x0000000000400000-0x00000000009D2000-memory.dmp	upx
behavioral1/memory/2324-611-0x0000000000400000-0x00000000009D2000-memory.dmp	upx
behavioral1/memory/2324-616-0x0000000000400000-0x00000000009D2000-memory.dmp	upx
behavioral1/memory/2324-618-0x0000000000400000-0x00000000009D2000-memory.dmp	upx
behavioral1/memory/2324-826-0x0000000000400000-0x00000000009D2000-memory.dmp	upx
behavioral1/memory/2324-1052-0x0000000000400000-0x00000000009D2000-memory.dmp	upx
behavioral1/memory/2324-1053-0x0000000000400000-0x00000000009D2000-memory.dmp	upx
behavioral1/memory/2324-1054-0x0000000000400000-0x00000000009D2000-memory.dmp	upx
behavioral1/memory/2324-1055-0x0000000000400000-0x00000000009D2000-memory.dmp	upx
behavioral1/memory/2324-1057-0x0000000000400000-0x00000000009D2000-memory.dmp	upx
behavioral1/memory/2324-1064-0x0000000000400000-0x00000000009D2000-memory.dmp	upx
behavioral1/memory/2324-1231-0x0000000000400000-0x00000000009D2000-memory.dmp	upx
behavioral1/memory/2324-1232-0x0000000000400000-0x00000000009D2000-memory.dmp	upx
behavioral1/memory/2324-1233-0x0000000000400000-0x00000000009D2000-memory.dmp	upx
behavioral1/memory/2324-1234-0x0000000000400000-0x00000000009D2000-memory.dmp	upx
behavioral1/memory/2324-1236-0x0000000000400000-0x00000000009D2000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\ut = "C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe /MINIMIZED"	utorrent.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 44 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	Downloads.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\utorrentie.exe = "11000"	uTorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000007dde860237d3b3f8bff620e63f8a00301fe097fe52a583cd3bc3d365f4cf9350000000000e8000000002000020000000ef33fe3b745cc694dec81891e3f7c80e824ef13dc0bc77ac1e40f6aae426f1ab90000000457f499b9395e7b099918546f9dfe61c8b727969933f9abd26a35e89dd1f115f848e0377677350f1feae8a5775df68e37e74fdadaf56465314272c570632402efd31dc1440374570f07e656b65b293fae45082c920959ff5f737f997dcf960f41624443fffaf09a29db3a7d0639971e59c239fa73eb2448e813c93976c2a42690d9687f64715c3a44d94f1ec74311a9040000000c1d17bf78bf52c0ea66739a2b7d3de08130da7533eebeffce4115c515b1d02812816e2bb7c885de11ead48f587484d5a53d54bb26311e2cf95e9d54338792d6b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410273421"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	uTorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION\utorrentie.exe = "1"	uTorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CROSS_DOMAIN_REDIRECT_MITIGATION\utorrentie.exe = "0"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000d5dfb686511bebd02fd9c7e2f5cda099e021f7511e6665e9ceb78df4a239c122000000000e8000000002000020000000e86f9cec0236b66763a46eb5c9f82d8b2061be37cc56e4f95e4fd6e7d63d2a41200000007d196a78ac9b2960dac9b9feaabdb14606c53a7ec35e76f4d1211f2ae037ed4540000000d3ddbd741e3e3f41f60ee5d10cbe6d834a62773fd0985375e7fb40e1d439b606c99f318d01e9efec19390927b29cc059fb8d15f3ace74d2acc9061fdc5110697	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CROSS_DOMAIN_REDIRECT_MITIGATION	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F1501D91-A89F-11EE-B930-EAAD54D9E991} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1064b0caac3cda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\uTorrent\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\maindoc.ico"	utorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-key\Extension = ".btkey"	utorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-app\Extension = ".btapp"	utorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-skin	utorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-skin\Extension = ".btskin"	utorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent\Extension = ".torrent"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.btsearch\Content Type = "application/x-bittorrentsearchdescription+xml"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\Magnet\shell	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\bittorrent\ = "bittorrent URI"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.btapp\ = "uTorrent"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\MIME\Database\Content Type\application/x-bittorrent-skin	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.btkey	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\uTorrent	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\uTorrent\shell	utorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\bittorrent\shell\open\command	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.btapp\Content Type = "application/x-bittorrent-app"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.torrent\Content Type = "application/x-bittorrent"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\uTorrent\shell\ = "open"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.btsearch	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.btkey\Content Type = "application/x-bittorrent-key"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\Applications\uTorrent.exe\shell\open\command	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\MIME\Database\Content Type	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\Magnet\ = "Magnet URI"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.btskin\Content Type = "application/x-bittorrent-skin"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.btsearch\OpenWithProgids	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\Applications\uTorrent.exe\shell	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\uTorrent\shell\open	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.btapp	utorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-app	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\MIME\Database\Content Type\application/x-bittorrent-key\Extension = ".btkey"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\FalconBetaAccount	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.torrent\ = "uTorrent"	utorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\Magnet\DefaultIcon	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\bittorrent\Content Type = "application/x-bittorrent-protocol"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\MIME	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\bittorrent\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe\" \"%1\" /SHELLASSOC"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\bittorrent\shell\ = "open"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\MIME\Database\Content Type\application/x-bittorrent-app	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.btkey\ = "uTorrent"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\MIME\Database	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\Magnet	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\Magnet\URL Protocol	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\Magnet\shell\open	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\Magnet\shell\ = "open"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\bittorrent	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\bittorrent\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\maindoc.ico"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\MIME\Database\Content Type\application/x-bittorrent-appinst\Extension = ".btinstall"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\FalconBetaAccount\remote_access_client_id = "0973431699"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\MIME\Database\Content Type\application/x-bittorrent	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\uTorrent\Content Type\ = "application/x-bittorrent"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\Magnet\shell\open\command	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\Magnet\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\maindoc.ico"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\Applications	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\uTorrent\shell\open\command	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.btskin\ = "uTorrent"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\MIME\Database\Content Type\application/x-bittorrent-skin\Extension = ".btskin"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\MIME\Database\Content Type\application/x-bittorrent-key	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.btinstall\ = "uTorrent"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\uTorrent\DefaultIcon	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\Magnet\Content Type = "application/x-magnet"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\Magnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe\" \"%1\" /SHELLASSOC"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\MIME\Database\Content Type\application/x-bittorrent-app\Extension = ".btapp"	utorrent.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\801D62D07B449D5C5C035C98EA61FA443C2A58FE	uTorrent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\801D62D07B449D5C5C035C98EA61FA443C2A58FE\Blob = 0f0000000100000014000000f53631b5177626eb6541df5563c8187d9dca421a09000000010000005e000000305c06082b0601050507030306082b0601050507030106082b0601050507030206082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b06010505070308060a2b0601040182370a030453000000010000002400000030223020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c014000000010000001400000055e481d11180bed889b908a331f9a1240916b9701d0000000100000010000000e871723e266f38af5d49cda2a502669c0b000000010000001000000045006e00740072007500730074000000030000000100000014000000801d62d07b449d5c5c035c98ea61fa443c2a58fe2000000001000000600400003082045c30820344a00302010202043863b966300d06092a864886f70d01010505003081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f7269747920283230343829301e170d3939313232343137353035315a170d3139313232343138323035315a3081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f726974792028323034382930820122300d06092a864886f70d01010105000382010f003082010a0282010100ad4d4ba91286b2eaa320071516642a2b4bd1bf0b4a4d8eed8076a567b77840c07342c868c0db532bdd5eb8769835938b1a9d7c133a0e1f5bb71ecfe524141eb181a98d7db8cc6b4b03f1020cdcaba54024007f7494a19d0829b3880bf587779d55cde4c37ed76a64ab851486955b9732506f3dc8ba660ce3fcbdb849c176894919fdc0a8bd89a3672fc69fbc711960b82de92cc99076667b94e2af78d665535d3cd69cb2cf2903f92fa450b2d448ce0532558afdb2644c0ee4980775db7fdfb9085560853029f97b48a46986e3353f1e865d7a7a15bdef008e1522541700902693bc0e496891bff847d39d9542c10e4ddf6f26cfc3182162664370d6d5c007e10203010001a3743072301106096086480186f8420101040403020007301f0603551d2304183016801455e481d11180bed889b908a331f9a1240916b970301d0603551d0e0416041455e481d11180bed889b908a331f9a1240916b970301d06092a864886f67d0741000410300e1b0856352e303a342e3003020490300d06092a864886f70d010105050003820101005947ac21848a17c99c89531eba80851ac63c4e3eb19cb67cc6925d186402e3d3060811617c63e32b9d31037076d2a328a0f4bb9a6373ed6de52adbed14a92bc63611d02beb078ba5da9e5c199d5612f55429c805edb2122a8df4031bffe7921087b03ab5c39d053712a3c7f415b9d5a439169b533a2391f1a882a26a8868c1790222bcaaa6d6aedfb0145fb887d0dd7c7f7bffaf1ccfe6db07ad5edb859dd02b0d33db04d1e64940132b76fb3ee99c890f15ce18b08578214f6b4f0efa3667cd07f2ff08d0e2ded9bf2aafb88786213c04cab794687fcf3ce998d738ffecc0d950f02e4b58ae466fd02ec360da725572bd4c459e61babf84819203d1d2697cc5	uTorrent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\801D62D07B449D5C5C035C98EA61FA443C2A58FE\Blob = 19000000010000001000000091fad483f14848a8a69b18b805cdbb3a030000000100000014000000801d62d07b449d5c5c035c98ea61fa443c2a58fe0b000000010000001000000045006e007400720075007300740000001d0000000100000010000000e871723e266f38af5d49cda2a502669c14000000010000001400000055e481d11180bed889b908a331f9a1240916b97053000000010000002400000030223020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c009000000010000005e000000305c06082b0601050507030306082b0601050507030106082b0601050507030206082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b06010505070308060a2b0601040182370a03040f0000000100000014000000f53631b5177626eb6541df5563c8187d9dca421a2000000001000000600400003082045c30820344a00302010202043863b966300d06092a864886f70d01010505003081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f7269747920283230343829301e170d3939313232343137353035315a170d3139313232343138323035315a3081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f726974792028323034382930820122300d06092a864886f70d01010105000382010f003082010a0282010100ad4d4ba91286b2eaa320071516642a2b4bd1bf0b4a4d8eed8076a567b77840c07342c868c0db532bdd5eb8769835938b1a9d7c133a0e1f5bb71ecfe524141eb181a98d7db8cc6b4b03f1020cdcaba54024007f7494a19d0829b3880bf587779d55cde4c37ed76a64ab851486955b9732506f3dc8ba660ce3fcbdb849c176894919fdc0a8bd89a3672fc69fbc711960b82de92cc99076667b94e2af78d665535d3cd69cb2cf2903f92fa450b2d448ce0532558afdb2644c0ee4980775db7fdfb9085560853029f97b48a46986e3353f1e865d7a7a15bdef008e1522541700902693bc0e496891bff847d39d9542c10e4ddf6f26cfc3182162664370d6d5c007e10203010001a3743072301106096086480186f8420101040403020007301f0603551d2304183016801455e481d11180bed889b908a331f9a1240916b970301d0603551d0e0416041455e481d11180bed889b908a331f9a1240916b970301d06092a864886f67d0741000410300e1b0856352e303a342e3003020490300d06092a864886f70d010105050003820101005947ac21848a17c99c89531eba80851ac63c4e3eb19cb67cc6925d186402e3d3060811617c63e32b9d31037076d2a328a0f4bb9a6373ed6de52adbed14a92bc63611d02beb078ba5da9e5c199d5612f55429c805edb2122a8df4031bffe7921087b03ab5c39d053712a3c7f415b9d5a439169b533a2391f1a882a26a8868c1790222bcaaa6d6aedfb0145fb887d0dd7c7f7bffaf1ccfe6db07ad5edb859dd02b0d33db04d1e64940132b76fb3ee99c890f15ce18b08578214f6b4f0efa3667cd07f2ff08d0e2ded9bf2aafb88786213c04cab794687fcf3ce998d738ffecc0d950f02e4b58ae466fd02ec360da725572bd4c459e61babf84819203d1d2697cc5	uTorrent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\801D62D07B449D5C5C035C98EA61FA443C2A58FE\Blob = 040000000100000010000000ba21ea20d6dddb8fc1578b40ada1fcfc0f0000000100000014000000f53631b5177626eb6541df5563c8187d9dca421a09000000010000005e000000305c06082b0601050507030306082b0601050507030106082b0601050507030206082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b06010505070308060a2b0601040182370a030453000000010000002400000030223020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c014000000010000001400000055e481d11180bed889b908a331f9a1240916b9701d0000000100000010000000e871723e266f38af5d49cda2a502669c0b000000010000001000000045006e00740072007500730074000000030000000100000014000000801d62d07b449d5c5c035c98ea61fa443c2a58fe19000000010000001000000091fad483f14848a8a69b18b805cdbb3a2000000001000000600400003082045c30820344a00302010202043863b966300d06092a864886f70d01010505003081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f7269747920283230343829301e170d3939313232343137353035315a170d3139313232343138323035315a3081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f726974792028323034382930820122300d06092a864886f70d01010105000382010f003082010a0282010100ad4d4ba91286b2eaa320071516642a2b4bd1bf0b4a4d8eed8076a567b77840c07342c868c0db532bdd5eb8769835938b1a9d7c133a0e1f5bb71ecfe524141eb181a98d7db8cc6b4b03f1020cdcaba54024007f7494a19d0829b3880bf587779d55cde4c37ed76a64ab851486955b9732506f3dc8ba660ce3fcbdb849c176894919fdc0a8bd89a3672fc69fbc711960b82de92cc99076667b94e2af78d665535d3cd69cb2cf2903f92fa450b2d448ce0532558afdb2644c0ee4980775db7fdfb9085560853029f97b48a46986e3353f1e865d7a7a15bdef008e1522541700902693bc0e496891bff847d39d9542c10e4ddf6f26cfc3182162664370d6d5c007e10203010001a3743072301106096086480186f8420101040403020007301f0603551d2304183016801455e481d11180bed889b908a331f9a1240916b970301d0603551d0e0416041455e481d11180bed889b908a331f9a1240916b970301d06092a864886f67d0741000410300e1b0856352e303a342e3003020490300d06092a864886f70d010105050003820101005947ac21848a17c99c89531eba80851ac63c4e3eb19cb67cc6925d186402e3d3060811617c63e32b9d31037076d2a328a0f4bb9a6373ed6de52adbed14a92bc63611d02beb078ba5da9e5c199d5612f55429c805edb2122a8df4031bffe7921087b03ab5c39d053712a3c7f415b9d5a439169b533a2391f1a882a26a8868c1790222bcaaa6d6aedfb0145fb887d0dd7c7f7bffaf1ccfe6db07ad5edb859dd02b0d33db04d1e64940132b76fb3ee99c890f15ce18b08578214f6b4f0efa3667cd07f2ff08d0e2ded9bf2aafb88786213c04cab794687fcf3ce998d738ffecc0d950f02e4b58ae466fd02ec360da725572bd4c459e61babf84819203d1d2697cc5	uTorrent.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2936	utorrent.exe
2324	uTorrent.exe
2324	uTorrent.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3036	Downloads.exe
2324	uTorrent.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	2936	utorrent.exe
Token: SeManageVolumePrivilege	2324	uTorrent.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2324	uTorrent.exe
2324	uTorrent.exe
2324	uTorrent.exe
2744	iexplore.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2324	uTorrent.exe
2324	uTorrent.exe
2324	uTorrent.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3036	Downloads.exe
3036	Downloads.exe
2744	iexplore.exe
2744	iexplore.exe
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 2936	2576	utorrent_installer.exe	31
PID 2576 wrote to memory of 2936	2576	utorrent_installer.exe	31
PID 2576 wrote to memory of 2936	2576	utorrent_installer.exe	31
PID 2576 wrote to memory of 2936	2576	utorrent_installer.exe	31
PID 2936 wrote to memory of 2324	2936	utorrent.exe	36
PID 2936 wrote to memory of 2324	2936	utorrent.exe	36
PID 2936 wrote to memory of 2324	2936	utorrent.exe	36
PID 2936 wrote to memory of 2324	2936	utorrent.exe	36
PID 2324 wrote to memory of 328	2324	uTorrent.exe	37
PID 2324 wrote to memory of 328	2324	uTorrent.exe	37
PID 2324 wrote to memory of 328	2324	uTorrent.exe	37
PID 2324 wrote to memory of 328	2324	uTorrent.exe	37
PID 2324 wrote to memory of 1156	2324	uTorrent.exe	38
PID 2324 wrote to memory of 1156	2324	uTorrent.exe	38
PID 2324 wrote to memory of 1156	2324	uTorrent.exe	38
PID 2324 wrote to memory of 1156	2324	uTorrent.exe	38
PID 2324 wrote to memory of 880	2324	uTorrent.exe	39
PID 2324 wrote to memory of 880	2324	uTorrent.exe	39
PID 2324 wrote to memory of 880	2324	uTorrent.exe	39
PID 2324 wrote to memory of 880	2324	uTorrent.exe	39
PID 2324 wrote to memory of 2164	2324	uTorrent.exe	40
PID 2324 wrote to memory of 2164	2324	uTorrent.exe	40
PID 2324 wrote to memory of 2164	2324	uTorrent.exe	40
PID 2324 wrote to memory of 2164	2324	uTorrent.exe	40
PID 2324 wrote to memory of 2744	2324	uTorrent.exe	41
PID 2324 wrote to memory of 2744	2324	uTorrent.exe	41
PID 2324 wrote to memory of 2744	2324	uTorrent.exe	41
PID 2324 wrote to memory of 2744	2324	uTorrent.exe	41
PID 2744 wrote to memory of 2700	2744	iexplore.exe	42
PID 2744 wrote to memory of 2700	2744	iexplore.exe	42
PID 2744 wrote to memory of 2700	2744	iexplore.exe	42
PID 2744 wrote to memory of 2700	2744	iexplore.exe	42

C:\Users\Admin\AppData\Local\Temp\Downloads.exe
"C:\Users\Admin\AppData\Local\Temp\Downloads.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3036

C:\Users\Admin\Desktop\utorrent_installer.exe
"C:\Users\Admin\Desktop\utorrent_installer.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Users\Admin\AppData\Local\Temp\nsj8190.tmp\utorrent.exe
  "C:\Users\Admin\AppData\Local\Temp\nsj8190.tmp\utorrent.exe"
  2⤵
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2936
- - C:\Users\Admin\AppData\Roaming\uTorrent\uTorrent.exe
    uTorrent.exe /NOINSTALL /BRINGTOFRONT
    3⤵
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - Modifies Internet Explorer settings
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2324
  - - C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_46986\utorrentie.exe
      "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_46986\utorrentie.exe" uTorrent_2324_039C8460_1718933298 µTorrent4823DF041B09 uTorrent ie unp
      4⤵
      Executes dropped EXE
      PID:328
  - - C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_46986\utorrentie.exe
      "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_46986\utorrentie.exe" uTorrent_2324_039D4C80_438162076 µTorrent4823DF041B09 uTorrent ie unp
      4⤵
      Executes dropped EXE
      PID:1156
  - - C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_46986\utorrentie.exe
      "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_46986\utorrentie.exe" uTorrent_2324_039D4EE0_583197549 µTorrent4823DF041B09 uTorrent ie unp
      4⤵
      Executes dropped EXE
      PID:880
  - - C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_46986\utorrentie.exe
      "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_46986\utorrentie.exe" uTorrent_2324_039D5140_808786405 µTorrent4823DF041B09 uTorrent ie unp
      4⤵
      Executes dropped EXE
      PID:2164
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://utorrent.com/prodnews?v=3%2e6%2e0%2e0%2e46986&pv=0.0.0.0.0
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2744
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2744 CREDAT:275457 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2700

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}
1⤵
PID:2428

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}
1⤵
PID:2132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8924af28db7748f141f4b35f857b0163

SHA1
eb7081a3f62b9a1ed5962b0ccbbcb562b3cd3018

SHA256
a8a6d98ee996d73e3bc489947192fe4a3f5cedd36843b9dbf7bcf46c90ab321a

SHA512
4275637fdea67c6668535ac5f20faa10fce82d7d20e3fa4206722d19a564051abff5fe0f9207c86df02a86a7653fb073003f8d82c6c8e776972f1236ee6139b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
952e1ba6c1ba81764bcd260734cffc11

SHA1
0f9f83977035786319321c0f8f05c6f8cee9b1de

SHA256
d0df384273bf9c045b3d7b150ea65e9c5ebc985a2a887a0ee859d2c5cefefdf3

SHA512
db4447c7ca74e1d9dcd073b4d6d98738eed96832bc7cd8ba3a0c012ee3ded78e280c2c2a16a8b7459087eca7f15c58cf94b03a3cd0f45c301e4558c9febed835

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3db99e042b1d06b4a3638f984c8f416e

SHA1
33ccf3ec8afcebe21a2c517703f368a187c63791

SHA256
c243b8591ff9e586655078b4c65596f2aa36e81cb2141565cc47492ed5e24e57

SHA512
0e495fd069427100a41845507f629450a76dab3ca3ae4f19f84b37e29a7e290d47ac25e4d5eb459249106c99b5fab5f0b5916d79dcb26f6489785fcd20e37491

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e1986e7a918f4212bd9795dca7c47aa

SHA1
1cff4c9911ad63e3dcfa6a181618bbfe1c129796

SHA256
38a3b9232da76c149be1e3b2fbdd0069e4384e01c0b345727b7364aff56f084e

SHA512
677d6016d3bfa11989b33543f24fb23707d73161c81293cec1fbebd9d76ef76e4cf29f9577532931f5417dfb71ee743aa02a2139006815cdab89373840b8a1d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
448617901b2a5f5cc1963c2f463b2789

SHA1
51f085831e4c5bfc0800a2134c3a186e2b3ef464

SHA256
93e58a6ad6632cd71eccfb010604b041ec53015391e0080f9e550403f00f9fba

SHA512
75ce52a9f56ab428b81f9a6c09cac624c6ac8ac49fd5d332643264764a4c96c56c146eb66272a06ad8e112c68356d461c28ceafd671d2e7461ce000919947be8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74664a966a7ecd93e66dee7ee8be89f3

SHA1
904409381dbdad20185054e061903f578073613d

SHA256
18437e6340d6b2bcb3c9679ed3db3e1435ca000c90108ff56912f211be26daeb

SHA512
55d182c2ad5d3fe7fec968966f5d2ddfd4fa8cf19301ed6bd30a3f96dffc106e761bf6c777626049ba395fcbecd2d62c6d0828d237c75b4ca6c43067b24c2b17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
492b7db5cbae124ee3ab4a576d15a5ce

SHA1
6ddb46959a524964096b50cf51ac8773fe0a7770

SHA256
a369b4c67721164f2b2923cb02226501d5c6b7912d60ea327a6c91339c7341d6

SHA512
779488254361562410d1de1b78d9bcb7ecae52b3fb556b374db16cfeffb8164083c2c29deb02510d5a0694184cee87bf991326e3c7b7a0983229dab4ae068026

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebc665b4eb97c0a272e53734fa46e959

SHA1
9e6cef7dd6538f0bad3716abd74a325deac74a9f

SHA256
88dc3860ecd74bd6bc6b3ac9c15581d37165e7ae9d6713263333e5d450b16fb9

SHA512
21d983bdc63b1a44282ab2babcfd2ecf580e2c62d7c6bc35ea9fc7c1bff3c2b7cefb2a2467b4331b0c953dc87bc36971f63c5b445087047522977037ad0c1437

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f6855c8c8071c2d6906acafc3e0d105

SHA1
80df3c97d8386c71f92e9e150246f7ee986ae4b4

SHA256
435285a99cd252ba9a5505ef055e361ae03668d7d3fa3e956ea906343825cada

SHA512
adf635239e9bb95068e9c04c230bd1ecd7db9ff34e2cac59d0fb3e722f8a33fc9cf69d27d322c8479331d4354ce2377d21c73479eb467ad57bb67274a38c9584

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3dde58b64b7cba1d4b40301e3761d8d3

SHA1
6dd023aed2364dd76432bf353ee0b9c930732b8e

SHA256
962b3d05232c86663ed6bfc7d5a6c09ef3be190ade93b62c6b6b5a1b569555e4

SHA512
4053e777307068c9dbf174a18e5845c1ab77f1e6a3a1e10bc170a770510aed5fc480164a18ad0c12ec5d641b491ab83400f797406f81453b33d1932937c0bc7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab516D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar522C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj8190.tmp\bt_datachannel.dll

Filesize
47KB

MD5
8f96d16738e796f42effc359d8b4749b

SHA1
35c89abc5a166b0576c256209ca3ca0ceea4f245

SHA256
7201af50ec8c3157e155b88a00d5aced4ecb92755379d9f15f456c28c400747d

SHA512
6d6dfa23dbfc581496dc62fdeb2137c9bca553161050239b9e1cd82feaeede558d39800014de4251d769c657d18b43aaeb0fb23fcab358a88614a8702085df04

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj8190.tmp\bt_datachannel.dll

Filesize
618KB

MD5
1140cc0b2190adb6a6cffe4149f44dd4

SHA1
950f1a4165cdc513bdb7b9b085b196f678f12de5

SHA256
cd2678e7bb816280ba7ea3cccd4fc4ce080fcc6bcc1ad80211259b2ac1fd2d11

SHA512
bd63ef8af0e2fab7c12af3d0650e859861d1d790883882b7497d849b18514aba54be09fb9089878a80b9d6f7c5318ddb8908639d7f19d2065886116de05d7b92

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj8190.tmp\utorrent.exe

Filesize
629KB

MD5
05ab1d4fcdd44b58b5b3d59504c030aa

SHA1
8ce0bfa56e9722c6bd188cb0279997e559f596f7

SHA256
e728b340ad43fb91a9fb5555fee1f2b03a407c34c469c4f832688f858cbcaff8

SHA512
4ce031ffc9c12051328c4f60332239413f8ab2efb3b6d30a4a409418a5af738638c3d69b8255601451729e066786097a4ba2e30511ba3a659d7ceaf7c261fc51

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj8190.tmp\utorrent.exe

Filesize
813KB

MD5
264171ae90a3448d18b556801e179906

SHA1
9b2a843f275311d6bed37a8ceaf611362d397409

SHA256
5ecef2273afd52a54352e074f8e74391fdb76da80ff0345e55b3b5837d3bff63

SHA512
c448ddfb5fd950bfeeb0c233a633732c0648b8662c75efac1e39a1b52a9de6777633db77274b6911d3b3342fd5909736d0f8cb82099411727db50d314436829f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1603059206-2004189698-4139800220-1000\1f91d2d17ea675d4c2c3192e241743f9_ed99f2be-c877-4736-8218-f1e1b6598c0d

Filesize
1KB

MD5
1a050719514b46717ffc65d8268b95a6

SHA1
545d9af1e65d1fe935c67ae150bddb11798455d7

SHA256
14b98c59fcd34fbd62386ad63790baecb40e70023331995170f7f2e9d0b614b2

SHA512
e0d7447b35c08a8a5009bbca593e80af695b77782ca53887556c96d02262ca1cda74827ee1263641525bc9129be74e2e9f30b45ea065a83784b1ec4439ac6edb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\HWQZR3H7.txt

Filesize
89B

MD5
135b92969cfd99f3247a0392267e71fe

SHA1
6fe1ae1a9292919f14bbbcece932a5f918b79f1e

SHA256
017a2fd6ecdc2d70e0417e2b110682471fde6bf5652db37e1526b16867faf740

SHA512
4e7465167d0cecb184b509016f99936fc59a889ee2b515adb84a5111c0f96f993c701e920d5a81e61b19f1e30aa2992771829703d27027743bae3bdd563faf1b

Download Submit
C:\Users\Admin\AppData\Roaming\uTorrent\bt_datachannel.dll

Filesize
64KB

MD5
e3fa9ca9116e6168886b3969fc3c7ff0

SHA1
35daa3082b7ed8216b1819302bb386cb77f75ef6

SHA256
4e1b9d3e483e5364d2e00944e03b553f08946a9c85ef1aa4ed40b83c9b2bb6c3

SHA512
e55922768d6ca2e3cd43a03d3cf4ae1ed4fba475f0ecdaca8391bfdca3f9bbf048a12f14a01b33ba3670ed99aba3294aa1f673a4ca0247f165c71de910e9fdc8

Download Submit
C:\Users\Admin\AppData\Roaming\uTorrent\settings.dat

Filesize
8KB

MD5
27baba75c112f6e111fef26bda84f032

SHA1
165bb3094c8e4d58457878a18104f3c4bd0a0e4a

SHA256
be212f02752c11e565be46175e88f84a81e9c6b2dd6a3d8c0826348d683f41c1

SHA512
dad03c17b1720c06e4e9c76266394f948f662bb17a3e07bd7a3a13f434898aa9ed3998f9af353f8d16e61962074c373946ce62c3064952e122ad96e43faf8ab4

Download Submit
C:\Users\Admin\AppData\Roaming\uTorrent\uTorrent.exe

Filesize
251KB

MD5
4bee512177be75918dcc992ec861b99e

SHA1
6e383d50631d18b57ecf782a45cf174fbc6d772c

SHA256
dbdc6471181a9585233fa345ba3a9d98e3ea742aa8e1134860bae66311fb174b

SHA512
3bfc2a40ae142e77b6e4877aabeb4375e62d3731bba163c2d379aa203fe337df45ed8c71b6dfd5ea191ef2eb47574239dcb27b9daeb1df38228affc83904e3d7

Download Submit
C:\Users\Admin\AppData\Roaming\uTorrent\updates.dat

Filesize
344B

MD5
9052401ba3d2b9e07d125796eb195581

SHA1
06aa58d182a535c828cba8e15a42326f2f2ece0f

SHA256
ae4929757b2ba719390de0093cab924134d2a887092c80d312d7885f8aba790a

SHA512
d5194b51b53f06e74ef78fbe179e0746aa7f541ed66059a145a7a5e4794a30bcd6a5b07eddafa97ed31604c315d76b6f818612a29655a4b424bbd054fb4f0576

Download Submit
C:\Users\Admin\AppData\Roaming\utorrent\settings.dat.old

Filesize
7KB

MD5
5d0d922d1b31ccc3e3b60ac30ffbdc39

SHA1
b960e9b05294c91ea92ad218f8b661a10f57ff4d

SHA256
fa3e26a865dbe85a969f94950a9e4e6c0cec18a32b2b72a642df1daebe11115d

SHA512
40e7eddd2a94b8b1cc85bef4d3109498b9138a03bf3d08828b444052fee1b487143ddac81c9fbd17a734eb80c757169af28b89384f1f30de30e9b68260a80dae

Download Submit
C:\Users\Admin\AppData\Roaming\utorrent\settings.dat.old

Filesize
8KB

MD5
5d6e922b9726f35d919e94c63e2aa289

SHA1
c4bdfce4b91a9e1030d3b7ff684bbbc6df87ee34

SHA256
e325611badde62130e75736e2d554aca76951e2279f14b9de0c12016472d67d9

SHA512
0011d5c09c353d5f2daa6d8db686b30eccac670c4008c533aec3d0196dca5694d06af7abb62f2f20b304d9f8245c3e639ad15a293c0b5d790ce04c5e1a75e96b

Download Submit
C:\Users\Admin\AppData\Roaming\utorrent\toolbar.benc.new

Filesize
170B

MD5
56e6e24bcdd96c2e2b50eb2f42d3fc21

SHA1
fc471a9c99a8aa321712097be834aef22d82c2d6

SHA256
477c83444fbbb163404c3bba5d5bed799857e64f4df8bff85b9a5e3c80c1f630

SHA512
c149c598c2a726570a177b93d051d66ba51fc7a30071a7740ed44583b13a302227af86edd5dd9a354ce8ec0f51b1ff44e9cd7d6b1cb799c500ed8111dd0385e3

Download Submit
C:\Users\Admin\AppData\Roaming\utorrent\uTorrent.exe

Filesize
127KB

MD5
55ae2fd0987e879b4adcc61f9fbb4f66

SHA1
5911ed528430209f7df003a84811eef08ef7d276

SHA256
06a54d5baa83ae7de993af4686a291cc8b59c24011eba13a45de3295c434fef8

SHA512
007a4734e1847e1df384d1c051c3f05049992aac8849e14cc41b2cc0ae75d240b09975505cac402db6376a134ffb9552ff8c56661416cf8cc377c363df770d6e

Download Submit
C:\Users\Admin\AppData\Roaming\utorrent\updates\3.6.0_46986.exe

Filesize
735KB

MD5
0b46bfeae3c9de134c8ae608293a0a21

SHA1
6a9c323567b6212db1d401e6d0618c74f907a948

SHA256
48992cbe22ffeb77deb9c3ee90c7758e3bd5eb736ec9343ffc5b1dd6c9e8d51b

SHA512
36892961fe5a96ce88ef5c4f53278dbaf0ff247ff594cfbcce9d55eb4801a685a2a80a04dd50c500a817f6ad197c5c7ba93ed37b5b1c796727f9210667fdc5bb

Download Submit
C:\Users\Admin\AppData\Roaming\utorrent\updates\3.6.0_46986\utorrentie.exe

Filesize
190KB

MD5
578774f3c1c7856e58effa69051193e7

SHA1
fe3a4bff265acc9d58b95a041d3327026eea237d

SHA256
91696cebdc925455ac0e6cadeae2aa93821008233197ccdcccff6d986977439b

SHA512
88d00242efcb9f81827bcede67a03411baf7a8612c5e02ff099c2c32f27ff561f6951a96359d5d9a2021d8ea8db675e6a0251a578dcb2d2d266dc72aacfe1466

Download Submit
C:\Users\Admin\AppData\Roaming\utorrent\updates\3.6.0_46986\utorrentie.exe

Filesize
372KB

MD5
13a4b3cf430cebc0d2d91ba6e58a6e77

SHA1
0e2f67619c31fad69bb08d5986b92d7884d50919

SHA256
ce35a5b4a8d0e445b6b4feaed13e0a1997e89fb2d13dba596284aa2e6474dd78

SHA512
9de0d8b8437e4f3a4080eecd6b1c31d6c78ee8d5488975460f567bd565ce422a9f49ed2b9596d6b846937844cf700c2ef62100236c86ac9e456ea2065b0b8723

Download Submit
C:\Users\Admin\AppData\Roaming\utorrent\updates\3.6.0_46986\utorrentie.exe

Filesize
264KB

MD5
a6edcb3efde39e3d60ecfb2b0e3911b9

SHA1
c13599b58286c73922ebff72223e6d475dde17ff

SHA256
e9d36b74edae25b0d163f293164415c97eb520e9a7feb63622b0da6f40d4a833

SHA512
9550ec1993705d06cbd13ca9f73e3a05cbd81d21adcb04a4844ba32dae788e63bc33afef52b72964875d5f78999c2c34cf577e7a320cec64eb2a5f3d454c09fd

Download Submit
C:\Users\Admin\AppData\Roaming\utorrent\updates\3.6.0_46986\utorrentie.exe

Filesize
189KB

MD5
7bd2eb1918fe87c9e34b2c836756d942

SHA1
6cb4cb67a6affdc68092335f3e08cc766855154a

SHA256
1a367bdee97e3263e17e9653e501dd818b26cc9476561de90fc13184f527d37b

SHA512
66e0197801219092c30ea1d90291d286efc11a9afcf7ffa9f72a34446bfcd3cb9ab6040b6a6476d3469ade344def46111e913686dd04c09d064458dacf521bfb

Download Submit
C:\Users\Admin\AppData\Roaming\utorrent\updates\3.6.0_46986\utorrentie.exe

Filesize
82KB

MD5
b9f831df56a0149d0cf6eb7e5b26ab0f

SHA1
75014364bf1c230ca16b71e8ef96aed06198b252

SHA256
baef4c34a4270b7871bc0faf3a1624622fac9a0703b59e258a90e5c67240fdaf

SHA512
065972bbabe728cbedd17825392fee0f463f37c6a18ce1cc0f7f2f165bceb9ca2bee260c7459e2dabd8fb1f593918d922e2fd16493fa19f5282ccda60767a446

Download Submit
C:\Users\Admin\Desktop\utorrent_installer.exe

Filesize
2.4MB

MD5
886092a4eb0d7147656dd308b5b86d76

SHA1
763c2126e6ee5f535cde4307575d16fe084a2f9c

SHA256
d9accff0c2c0ba878e0be2ef083e1584450ce466e16c29efb4ae401346afff40

SHA512
8ae83667fa33e595d70f386e019f7a7cb5a1ef164998ea59bcf4a280aeacc83c4106b37877e3f714cef49379f5b488a37dac4125e3802dbb1cf1817185de3a83

Download Submit
C:\Users\Admin\Desktop\utorrent_installer.exe

Filesize
1.4MB

MD5
3126b008dd855b3bce894c9b2860c015

SHA1
223625ddf82e157b01c4ae3963a123540c4506cd

SHA256
00d5586931222d8cbbc32301a768d2386928254a70486b385887ce03ce9f66d2

SHA512
25f2d1ee734c7a2c3b90e76794446e67c7ee540990abca3e48784ca007dd43e59d211549b5ed32ac306dcdda62ba347dc1b2fed64770c21ec0dd600436c6ba02

Download Submit
\Users\Admin\AppData\Local\Temp\nsj8190.tmp\INetC.dll

Filesize
24KB

MD5
640bff73a5f8e37b202d911e4749b2e9

SHA1
9588dd7561ab7de3bca392b084bec91f3521c879

SHA256
c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502

SHA512
39c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a

Download Submit
\Users\Admin\AppData\Local\Temp\nsj8190.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
\Users\Admin\AppData\Local\Temp\nsj8190.tmp\bt_datachannel.dll

Filesize
70KB

MD5
061c12549923a44edec94753d0f1f7dd

SHA1
f8bd9ea9144fa6eefe4468cf5f7fcebc000d164c

SHA256
939e264443eb4590048cbaa1e1f60be38a6e66a64b70ed69f1f2fc78f540d78c

SHA512
17a947ef069c75fc62cdb146a0ca03899c9485796d6c6d79282c71fcc9bd1be4a47aae4718d11b87197a699a5b43044608c6efd79ac20fe59e3e335636fbd7c6

Download Submit
\Users\Admin\AppData\Local\Temp\nsj8190.tmp\nsisFirewall.dll

Filesize
8KB

MD5
f5bf81a102de52a4add21b8a367e54e0

SHA1
cf1e76ffe4a3ecd4dad453112afd33624f16751c

SHA256
53be5716ad80945cb99681d5dbda60492f5dfb206fbfdb776b769b3eeb18d2c2

SHA512
6e280a75f706474ad31b2ce770fa34f54cb598528fac4477c466200a608b79c0f9b84011545595d9ba94331ad08e2f51bd42de91f92379db27686a28ba351256

Download Submit
\Users\Admin\AppData\Local\Temp\nsj8190.tmp\utorrent.exe

Filesize
812KB

MD5
d1423ba76d8653e16373768aa56fd144

SHA1
645248ecc21f265cb06f9d4d5af5c840eadc9888

SHA256
34b4ece675846543b5e72fb6857a5becd306158bfc672b29703c5c6159d8585e

SHA512
2785494afaa291d5cfaa9e2cdeaf94edb451afa01439ad60bf411677203f607032493558a779ec599cc8334aaec06b26532fd48cf7193e3d4f0940e5db1b4e94

Download Submit
\Users\Admin\AppData\Roaming\utorrent\bt_datachannel.dll

Filesize
65KB

MD5
67de3affd98dc39077d34f18fb37c091

SHA1
239ca1bf9d83276d7e0bb6252fe100e98bbdb20a

SHA256
9030286688df00d4edb47d6dd6893a2fac1f9b5a47ed8b36bb19cd2eb7f1c6c4

SHA512
12a2893aa23cc2f3e9e24c2ece423ccb6d97f4bfd5ecfaa6caf1a5438847c32fe1b317a72f9b1639ab9fbd4606f743a55f0587dd5df9706c46b89426098e5473

Download Submit
\Users\Admin\AppData\Roaming\utorrent\uTorrent.exe

Filesize
924KB

MD5
141401ea9f8fba6aa84ef4ba15f2a44d

SHA1
63d5651ca9c0662b9b3c7d716ee30b0c0d43dca7

SHA256
381fbb9209c3169319086ab93a8d722f866e62a554b8bbca6d1ad5ae70e6a260

SHA512
0b2ad7b9c999393cf40254fc5b94c1177616e3457b7f89a2f40d0ccc776ae086a597fa220ca6d145dcb39b27589ab510a7a7b1ebf720bf92685411e6464f818e

Download Submit
\Users\Admin\AppData\Roaming\utorrent\uTorrent.exe

Filesize
1.7MB

MD5
015db1c5a20d8ef197d33f9f590ce661

SHA1
76c9ebc017f20fa28b50df28a5f64fa0536ddf40

SHA256
7735772aaec66e6bb90a6dcf17f895eb8af14b07b96fb0eba0ecb448fceb777a

SHA512
55db1de5fa622960747b5b6f848c8c3949926968f67899d266ed582e322ff9224dcfc0e9e349c1e70c8a67511059ebfe6d31545d024276c5943eadb491b73b7a

Download Submit
\Users\Admin\AppData\Roaming\utorrent\uTorrent.exe

Filesize
873KB

MD5
fc5490f63e8a95cadc0fe8d25ef46992

SHA1
d8b6a030eaf9829de6f6ae3a17b02d15fd578440

SHA256
3ea90759841d7c0b63f413cac3554efb41f71a7fe518e3a0b8aaa23925c81c2c

SHA512
192ebcb474b8717f66f6ddba720049e5f966389e1b81e87098b534dedc6269be697f4369388de3f2d61f52c340e9fb8dbb08af5e1236f9a8575c025dab42625d

Download Submit
\Users\Admin\AppData\Roaming\utorrent\updates\3.6.0_46986\utorrentie.exe

Filesize
493KB

MD5
e608af55645fa8e90e23885b963e2b3e

SHA1
eef7234eea30f5ee822e32395aa48f51564f34e5

SHA256
6711e67090b664773e839b390dd54e67be24987df070e5be9f9dbcf746cfe51a

SHA512
f2f868504e974c7604ca6192f9451876696a9eec854a56e01d9a0bb7b26070bdb2c1dc5e25b07b1cfcd03fdfbdd6cf0687a74f129c069ecf8ca3473e09e966c7

Download Submit
\Users\Admin\AppData\Roaming\utorrent\updates\3.6.0_46986\utorrentie.exe

Filesize
292KB

MD5
a37a2b5e7d71d2941fd558e90f3aac72

SHA1
dc56837ed772a38859feab2bdca9188096b1df21

SHA256
0395ba1da47075ff0d40e3479443ec687be0882afe644836179432c9d8d8a525

SHA512
29d395b01cb427d36417242b35590beda29daa42a72cd90c30df5e1dfd3f1a2a702794820d358b588cfd23653379cc25767d9a3afa9bef51950ae94dd8a162cf

Download Submit
\Users\Admin\AppData\Roaming\utorrent\updates\3.6.0_46986\utorrentie.exe

Filesize
228KB

MD5
3134462c03315d0ff9fd40c4a217511c

SHA1
da3ef8205d2811723f58e652218735c1c681f3a7

SHA256
28a72c647503b0d84a101d7e20bf5dafc36eed6e5365450b993421ad8f0f9785

SHA512
7297f33a9227103fd96072693754d8e5d4a13295828cc10366f2fdd6f03e1add664dbd1c481ccc6f2fedd06587e5f308b92945945984ea1b432e8f7337d75b39

Download Submit
\Users\Admin\AppData\Roaming\utorrent\updates\3.6.0_46986\utorrentie.exe

Filesize
182KB

MD5
f3c09f91db59e9a876e5c2adf4755a87

SHA1
3a9dda721fc53800c8807c908db3e8ab7f72c153

SHA256
3710a72f1ac247ec05500efe268ebc76999f81274966bf9d58b9edc17e801b5e

SHA512
b43bc93df910ce2f483f5e55afdc1abdff924f69c01990aa0316fbf36ac46c6c66d308a259ad9037a18797a06bc51d58c079aac3be2bdfb9f585b87f745305d8

Download Submit
\Users\Admin\AppData\Roaming\utorrent\updates\3.6.0_46986\utorrentie.exe

Filesize
77KB

MD5
4d68bd13dc9d6dd0924fd393928383fc

SHA1
e86f23ebba6ba596e628e542f48f6d1bf279e599

SHA256
11a6001b77df8c31c7a8c4c9d85bca041b25888e583858a08d6b6ed74d91484d

SHA512
9f275c619d329f73b2b18d78362daabf29ada492ca8fb91e02836e1e9352a79c0121ce49d342a2c8b67f9bc85d072348d790ff9a81bde8c538556552b6f1b9dd

Download Submit
memory/2324-826-0x0000000000400000-0x00000000009D2000-memory.dmp

Filesize
5.8MB

Download
memory/2324-610-0x0000000000400000-0x00000000009D2000-memory.dmp

Filesize
5.8MB

Download
memory/2324-1057-0x0000000000400000-0x00000000009D2000-memory.dmp

Filesize
5.8MB

Download
memory/2324-1236-0x0000000000400000-0x00000000009D2000-memory.dmp

Filesize
5.8MB

Download
memory/2324-1234-0x0000000000400000-0x00000000009D2000-memory.dmp

Filesize
5.8MB

Download
memory/2324-172-0x0000000000400000-0x00000000009D2000-memory.dmp

Filesize
5.8MB

Download
memory/2324-1233-0x0000000000400000-0x00000000009D2000-memory.dmp

Filesize
5.8MB

Download
memory/2324-1055-0x0000000000400000-0x00000000009D2000-memory.dmp

Filesize
5.8MB

Download
memory/2324-179-0x0000000000400000-0x00000000009D2000-memory.dmp

Filesize
5.8MB

Download
memory/2324-1232-0x0000000000400000-0x00000000009D2000-memory.dmp

Filesize
5.8MB

Download
memory/2324-609-0x0000000000400000-0x00000000009D2000-memory.dmp

Filesize
5.8MB

Download
memory/2324-1064-0x0000000000400000-0x00000000009D2000-memory.dmp

Filesize
5.8MB

Download
memory/2324-611-0x0000000000400000-0x00000000009D2000-memory.dmp

Filesize
5.8MB

Download
memory/2324-616-0x0000000000400000-0x00000000009D2000-memory.dmp

Filesize
5.8MB

Download
memory/2324-618-0x0000000000400000-0x00000000009D2000-memory.dmp

Filesize
5.8MB

Download
memory/2324-1231-0x0000000000400000-0x00000000009D2000-memory.dmp

Filesize
5.8MB

Download
memory/2324-1066-0x0000000002630000-0x0000000002631000-memory.dmp

Filesize
4KB

Download
memory/2324-117-0x0000000000400000-0x00000000009D2000-memory.dmp

Filesize
5.8MB

Download
memory/2324-1052-0x0000000000400000-0x00000000009D2000-memory.dmp

Filesize
5.8MB

Download
memory/2324-1053-0x0000000000400000-0x00000000009D2000-memory.dmp

Filesize
5.8MB

Download
memory/2324-1054-0x0000000000400000-0x00000000009D2000-memory.dmp

Filesize
5.8MB

Download
memory/2576-52-0x0000000003B10000-0x00000000040E2000-memory.dmp

Filesize
5.8MB

Download
memory/2576-98-0x0000000003B10000-0x00000000040E2000-memory.dmp

Filesize
5.8MB

Download
memory/2936-99-0x0000000000400000-0x00000000009D2000-memory.dmp

Filesize
5.8MB

Download
memory/2936-101-0x0000000003930000-0x0000000003940000-memory.dmp

Filesize
64KB

Download
memory/2936-114-0x0000000000400000-0x00000000009D2000-memory.dmp

Filesize
5.8MB

Download
memory/2936-102-0x0000000003930000-0x0000000003940000-memory.dmp

Filesize
64KB

Download
memory/2936-100-0x0000000003930000-0x0000000003940000-memory.dmp

Filesize
64KB

Download
memory/2936-53-0x0000000000400000-0x00000000009D2000-memory.dmp

Filesize
5.8MB

Download
memory/2936-81-0x0000000000400000-0x00000000009D2000-memory.dmp

Filesize
5.8MB

Download
memory/2936-82-0x0000000000400000-0x00000000009D2000-memory.dmp

Filesize
5.8MB

Download