6f9b9d4f8153f48e80ddcfa6385ae6f921f52616309e060c23cf0ad483fd3597

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
utorrent_installer.exe
Size 2.1MB
Sample260722-pemthavalc
SHA256 6f9b9d4f8153f48e80ddcfa6385ae6f921f52616309e060c23cf0ad483fd3597
MD5 714ada893ae14b670988102df301bb95
SHA1 40a3a72e5aeb291ffbee4693ea0f9fbcfd4a98bd
SHA512 2d92b4700202b2521293082b501031d5a2658c1eba928c2cdb9a9f2d3dfbdbc4ac2663351bec22f619bd98ab5ee44903f4ae1dcc10719d3500d6fac117d95172
SSDEEP 24576:bXNrSLScusMmOvjjhzvLJyfRIBA1VeQ/+g0Fi4ETLRXuFU6zj8GXYL5GfrIwiCZh:YuI2hU1l+g0Fi4cRXMsm4MfrIpCqC
TLSH
T1B8A5CF3BB28B753EE06A5A3A7A76E210583F7E6165134C06D6E4D84CCF350B01E3E796
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit defense_evasion discovery installer persistence spyware stealer trojan upx

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
74	5084	utorrent_installer.tmp

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	uTorrent.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	utorrent_installer.tmp

Executes dropped EXE 13 IoCs

pid	Process
5084	utorrent_installer.tmp
3176	uTorrent.exe
3976	utorrent.exe
880	saBSI.exe
4116	cookie_mmm_irs_ppi_008_585.exe
1600	OperaGXSetup.exe
5068	setup.exe
3308	setup.exe
4344	setup.exe
4164	setup.exe
4108	setup.exe
388	icarus.exe
3820	saBSI.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	utorrent.exe
Key opened	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Wine	utorrent.exe

Loads dropped DLL 11 IoCs

pid	Process
3176	uTorrent.exe
3176	uTorrent.exe
3176	uTorrent.exe
3176	uTorrent.exe
3176	uTorrent.exe
5068	setup.exe
4116	cookie_mmm_irs_ppi_008_585.exe
3308	setup.exe
4344	setup.exe
4164	setup.exe
4108	setup.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks for any installed AV software in registry 1 TTPs 10 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir	utorrent_installer.tmp
Key opened	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\AVG\AV\Dir	utorrent_installer.tmp
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	icarus.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	utorrent_installer.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast	utorrent_installer.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avast Software\Avast	utorrent_installer.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	utorrent_installer.tmp
Key opened	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Avast Software\Avast	utorrent_installer.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir	utorrent_installer.tmp
Key opened	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\AVAST Software\Avast	utorrent_installer.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	setup.exe
File opened (read-only)	\??\F:	setup.exe
File opened (read-only)	\??\D:	setup.exe
File opened (read-only)	\??\F:	setup.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	cookie_mmm_irs_ppi_008_585.exe
File opened for modification	\??\PhysicalDrive0	icarus.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0003000000000743-90.dat	upx
behavioral1/memory/3976-96-0x0000000000400000-0x0000000000D17000-memory.dmp	upx
behavioral1/memory/3976-122-0x0000000000400000-0x0000000000D17000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1836	5084	WerFault.exe	84
760	5084	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	utorrent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cookie_mmm_irs_ppi_008_585.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaGXSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	saBSI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	utorrent_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	utorrent_installer.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uTorrent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	saBSI.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/4856-1-0x0000000000010000-0x00000000000F5000-memory.dmp	innosetup
behavioral1/memory/4856-10-0x0000000000010000-0x00000000000F5000-memory.dmp	innosetup
behavioral1/memory/4856-313-0x0000000000010000-0x00000000000F5000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	utorrent_installer.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	utorrent_installer.tmp
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	icarus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	icarus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	icarus.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-app	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-skin	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\.btkey\Content Type = "application/x-bittorrent-key"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\.btsearch\OpenWithProgids	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Applications\uTorrent.exe\shell\ = "open"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\.btapp\Content Type = "application/x-bittorrent-app"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-app\Extension = ".btapp"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Applications\uTorrent.exe\shell\open\command	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\FalconBetaAccount	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Magnet\URL Protocol	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\.btskin\ = "uTorrent"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\.btkey	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Applications	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Magnet	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Magnet\shell	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\uTorrent\shell\open\command	utorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-appinst	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\.btkey\ = "uTorrent"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Applications\uTorrent.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe\" \"%1\" /SHELLASSOC"	utorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-skin\Extension = ".btskin"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\.btsearch	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\.btskin\Content Type = "application/x-bittorrent-skin"	utorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-appinst\Extension = ".btinstall"	utorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-key	utorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-key\Extension = ".btkey"	utorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\7CCD586D-2ABC-42FF-A23B-3731F4F183D9 = "0EC03442A4E93B807782D73BF46C389D"	cookie_mmm_irs_ppi_008_585.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-skin\Extension = ".btskin"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-key	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\.btsearch\OpenWithProgids\uTorrent	utorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-app\Extension = ".btapp"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\.btinstall	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\.btinstall\Content Type = "application/x-bittorrent-appinst"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-appinst\Extension = ".btinstall"	utorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F	cookie_mmm_irs_ppi_008_585.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Magnet\shell\open	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Magnet\shell\ = "open"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\.btapp	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\uTorrent\Content Type\ = "application/x-bittorrent"	utorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\56C7A9DA-4B11-406A-8B1A-EFF157C294D6 = "22901dd1-9df1-49ab-8536-fda2eb0b40bc"	cookie_mmm_irs_ppi_008_585.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Magnet\shell\open\command	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Magnet\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\maindoc.ico"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\.btapp\ = "uTorrent"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Applications\uTorrent.exe\shell	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\uTorrent\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe\" \"%1\" /SHELLASSOC"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-appinst	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Magnet\ = "Magnet URI"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Magnet\DefaultIcon	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\uTorrent	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\FalconBetaAccount\remote_access_client_id = "0034496117"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-app	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\uTorrent\shell	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\uTorrent\Content Type	utorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-skin	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Applications\uTorrent.exe	utorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\5E1D6A55-0134-486E-A166-38C2E4919BB1 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAWRc1vbFr4UWB9V+uHvDuyAQAAAACAAAAAAAQZgAAAAEAACAAAAA5a00kqA6N3WAB0RZ8TQxTuFUagjRJxv31f5/94a+qVAAAAAAOgAAAAAIAACAAAACELZ+WmzeqeoC9yXoSYEaFGbDjb1xwqIGmOH5D9e7JKYAAAAA62rHkBYbUbOt2oHudgVYSY4xCqMAvCxl1U1UAf4A9lXrm6Bhuy+7AalAtAac5tIxjsBCaHoVAar46nLam6/zN0q+XCI55d10qrZV+m3uFt4exW9Bfq5lLJXUH4STrgiIDHFHO4HyDj62gwn9QXgjQfIuSlUBuaM5gAK1PmumKfUAAAACBI4LnDE+Wt9+wchZ7yYEK1gHLxwsyPTLL9uN++9glJibFDZ3HQEuh0jYU/T7L/t464tYBMQ5tSUDdArT26Nax"	cookie_mmm_irs_ppi_008_585.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\.btinstall\ = "uTorrent"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-key\Extension = ".btkey"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Magnet\Content Type = "application/x-magnet"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Magnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe\" \"%1\" /SHELLASSOC"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\uTorrent\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\maindoc.ico"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\uTorrent\shell\open	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\uTorrent\shell\ = "open"	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\.btskin	utorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\uTorrent\DefaultIcon	utorrent.exe

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 040000000100000010000000e94fb54871208c00df70f708ac47085b0f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b81900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b4200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	saBSI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 5c0000000100000004000000001000001900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c040000000100000010000000e94fb54871208c00df70f708ac47085b200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	saBSI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8	saBSI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 0f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b8200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	saBSI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 1900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	saBSI.exe

Script User-Agent 6 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	6	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	9	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	10	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	50	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	65	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	84	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
5084	utorrent_installer.tmp
5084	utorrent_installer.tmp
5084	utorrent_installer.tmp
5084	utorrent_installer.tmp
5084	utorrent_installer.tmp
5084	utorrent_installer.tmp
5084	utorrent_installer.tmp
5084	utorrent_installer.tmp
5084	utorrent_installer.tmp
5084	utorrent_installer.tmp
5084	utorrent_installer.tmp
5084	utorrent_installer.tmp
880	saBSI.exe
880	saBSI.exe
880	saBSI.exe
880	saBSI.exe
880	saBSI.exe
880	saBSI.exe
880	saBSI.exe
880	saBSI.exe
880	saBSI.exe
880	saBSI.exe
3820	saBSI.exe
3820	saBSI.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	3976	utorrent.exe
Token: SeRestorePrivilege	388	icarus.exe
Token: SeTakeOwnershipPrivilege	388	icarus.exe
Token: SeRestorePrivilege	388	icarus.exe
Token: SeTakeOwnershipPrivilege	388	icarus.exe
Token: SeRestorePrivilege	388	icarus.exe
Token: SeTakeOwnershipPrivilege	388	icarus.exe
Token: SeRestorePrivilege	388	icarus.exe
Token: SeTakeOwnershipPrivilege	388	icarus.exe
Token: SeDebugPrivilege	388	icarus.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5084	utorrent_installer.tmp

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 5084	4856	utorrent_installer.exe	84
PID 5084 wrote to memory of 3176	5084	utorrent_installer.tmp	110
PID 3176 wrote to memory of 3976	3176	uTorrent.exe	112
PID 5084 wrote to memory of 880	5084	utorrent_installer.tmp	115
PID 5084 wrote to memory of 4116	5084	utorrent_installer.tmp	117
PID 5084 wrote to memory of 1600	5084	utorrent_installer.tmp	118
PID 1600 wrote to memory of 5068	1600	OperaGXSetup.exe	120
PID 5068 wrote to memory of 3308	5068	setup.exe	121
PID 5068 wrote to memory of 4344	5068	setup.exe	122
PID 5068 wrote to memory of 4164	5068	setup.exe	123
PID 4164 wrote to memory of 4108	4164	setup.exe	124
PID 4116 wrote to memory of 388	4116	cookie_mmm_irs_ppi_008_585.exe	126
PID 880 wrote to memory of 3820	880	saBSI.exe	135

C:\Users\Admin\AppData\Local\Temp\utorrent_installer.exe
"C:\Users\Admin\AppData\Local\Temp\utorrent_installer.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Users\Admin\AppData\Local\Temp\is-SFWC4MB882.tmp\utorrent_installer.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-SFWC4MB882.tmp\utorrent_installer.tmp" /SL5="$701E0,902674,878080,C:\Users\Admin\AppData\Local\Temp\utorrent_installer.exe"
  2⤵
  - Downloads MZ/PE file
  - Checks computer location settings
  - Executes dropped EXE
  - Checks for any installed AV software in registry
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\Users\Admin\AppData\Local\Temp\is-86VQQC8WP6.tmp\uTorrent.exe
    "C:\Users\Admin\AppData\Local\Temp\is-86VQQC8WP6.tmp\uTorrent.exe" /S /FORCEINSTALL 0110000101001110
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3176
  - - C:\Users\Admin\AppData\Local\Temp\nsp72F0.tmp\utorrent.exe
      "C:\Users\Admin\AppData\Local\Temp\nsp72F0.tmp\utorrent.exe" /S /FORCEINSTALL 0110000101001110
      4⤵
      Executes dropped EXE
      Identifies Wine through registry keys
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:3976
- - C:\Users\Admin\AppData\Local\Temp\is-86VQQC8WP6.tmp\component0_extract\saBSI.exe
    "C:\Users\Admin\AppData\Local\Temp\is-86VQQC8WP6.tmp\component0_extract\saBSI.exe" /affid 91082 PaidDistribution=true CountryCode=GB InstallID=GnjW1demg6X8ZZTgo4g7wLV3xy0AZM6iNvcXRFYRIXed27eF3Y63Mbj9u11V0b2F5Xu5pb2H79WkrxCTWVP
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:880
  - - C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe
      "C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe" /install /affid 91082 PaidDistribution=true InstallID=GnjW1demg6X8ZZTgo4g7wLV3xy0AZM6iNvcXRFYRIXed27eF3Y63Mbj9u11V0b2F5Xu5pb2H79WkrxCTWVP saBsiVersion=4.1.1.865 CountryCode=GB /no_self_update
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3820
- - C:\Users\Admin\AppData\Local\Temp\is-86VQQC8WP6.tmp\component1_extract\cookie_mmm_irs_ppi_008_585.exe
    "C:\Users\Admin\AppData\Local\Temp\is-86VQQC8WP6.tmp\component1_extract\cookie_mmm_irs_ppi_008_585.exe" /silent /ws /psh:agiSfNdEguKiaaD3u2Y5EV15HwzJtvILFzqkz4JYjtNSbgZWgB9PMOOc3AFUbolks4kLOp5S0H8C8YPJjX /cookie:mmm_irs_ppi_008_585_b
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4116
  - - C:\Windows\Temp\asw-88d78542-44e5-4b7e-89ff-deff69a18ac2\common\icarus.exe
      C:\Windows\Temp\asw-88d78542-44e5-4b7e-89ff-deff69a18ac2\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-88d78542-44e5-4b7e-89ff-deff69a18ac2\icarus-info.xml /install /silent /ws /psh:agiSfNdEguKiaaD3u2Y5EV15HwzJtvILFzqkz4JYjtNSbgZWgB9PMOOc3AFUbolks4kLOp5S0H8C8YPJjX /cookie:mmm_irs_ppi_008_585_b
      4⤵
      Executes dropped EXE
      Checks for any installed AV software in registry
      Writes to the Master Boot Record (MBR)
      Checks processor information in registry
      Suspicious use of AdjustPrivilegeToken
      PID:388
- - C:\Users\Admin\AppData\Local\Temp\is-86VQQC8WP6.tmp\component2_extract\OperaGXSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\is-86VQQC8WP6.tmp\component2_extract\OperaGXSetup.exe" --silent --allusers=0 --otd=utm.medium:apb,utm.source:ais,utm.campaign:operagx,utm.id:BjYV7wS29ESIu6l4B06TYbHavr6NUYC7D7q79emzlJb89o0Z7j8Dm1B77toBcrmSEa6gWvaBELmEyJ3
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1600
  - - C:\Users\Admin\AppData\Local\Temp\7zS046C378A\setup.exe
      C:\Users\Admin\AppData\Local\Temp\7zS046C378A\setup.exe --silent --allusers=0 --otd=utm.medium:apb,utm.source:ais,utm.campaign:operagx,utm.id:BjYV7wS29ESIu6l4B06TYbHavr6NUYC7D7q79emzlJb89o0Z7j8Dm1B77toBcrmSEa6gWvaBELmEyJ3 --server-tracking-blob=ZTlkNzM2OWE0ZmQ4NmRjMzMxY2ZkYzc3NDNiOGNjOWVlYzY4NTQ1ZWE3ZGI3MGQ3M2VjZjg1N2MzNmRmNjI5ZDp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yIiwidGltZXN0YW1wIjoiMTc1Nzg0NzYzNS4zNjE1IiwidXNlcmFnZW50IjoicHl0aG9uLXJlcXVlc3RzLzIuMzIuMyIsInV0bSI6e30sInV1aWQiOiIyYjBlYWY3NC00NGQ4LTQ2NjktYWNiZC1lYzUzNmZmMzhhYzYifQ==
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Enumerates connected drives
      Suspicious use of WriteProcessMemory
      PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\7zS046C378A\setup.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS046C378A\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=121.0.5600.81 --initial-client-data=0x260,0x264,0x268,0x23c,0x26c,0x7ffdf5978ef0,0x7ffdf5978efc,0x7ffdf5978f08
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3308
    - - C:\Users\Admin\AppData\Local\Temp\.opera\f691a42e-a525-439b-b938-a9e61e6e0922 Opera GX Installer Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\f691a42e-a525-439b-b938-a9e61e6e0922 Opera GX Installer Temp\setup.exe" --version
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\7zS046C378A\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS046C378A\setup.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=5068 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\f691a42e-a525-439b-b938-a9e61e6e0922 Opera GX Installer Temp\opera_package_20260722131648" --session-guid=28345e6e-c4b3-4a58-aa31-ae3a8abb6c89 --server-tracking-blob="YTkyOGJhZTJkNjZmNmY0NGQyMWExZWQ4YzQzZmFiYzc1ZWFjMDA2ZTE3ZTdmY2E1NGJjNjcyMjdmMWFhM2UzYjp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzU3ODQ3NjM1LjM2MTUiLCJ1c2VyYWdlbnQiOiJweXRob24tcmVxdWVzdHMvMi4zMi4zIiwidXRtIjp7ImNhbXBhaWduIjoib3BlcmFneCIsImlkIjoiQmpZVjd3UzI5RVNJdTZsNEIwNlRZYkhhdnI2TlVZQzdEN3E3OWVtemxKYjg5bzBaN2o4RG0xQjc3dG9CY3JtU0VhNmdXdmFCRUxtRXlKMyIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6ImFpcyJ9LCJ1dWlkIjoiMmIwZWFmNzQtNDRkOC00NjY5LWFjYmQtZWM1MzZmZjM4YWM2In0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=4C08000000000000
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        Suspicious use of WriteProcessMemory
        
        PID:4164
      - C:\Users\Admin\AppData\Local\Temp\7zS046C378A\setup.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS046C378A\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=121.0.5600.81 --initial-client-data=0x26c,0x270,0x274,0x23c,0x278,0x7ffdf4838ef0,0x7ffdf4838efc,0x7ffdf4838f08
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4108
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 704
    3⤵
    - Program crash
    PID:1836
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 704
    3⤵
    - Program crash
    PID:760

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}
1⤵
- System Location Discovery: System Language Discovery
PID:2300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5084 -ip 5084
1⤵
PID:3876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5084 -ip 5084
1⤵
PID:4564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sfx.log

Path C:\ProgramData\Avast Software\Icarus\Logs\sfx.log
Size 11KB
SHA256 006e4ce25612a86a160c8639ee4f61cb0c7096ad90e1c76282c788536c878fdb
MD5 15f5190041894f56dbe6f4e8837552e8
SHA1 ce3fb7fade330beb606a022f58c292e1bc1ad1f2
SHA512 05f6aa7a468ee05748143c604ecab25700fb1ac7969de90a6c04fc6223733489d5e77c671365c4df500a4e66aa3b2a1f144a92bdf007d411228fb4027add2fd6
SSDEEP 192:oK8ZSyCef12vCZ4XyCes12TfAjMjIWBaXZdTVqhiwsMZyCes12S9:oLvCKOOvCFSfAjMjIgapdTVq0nCF99
TLSH
T12F32755A503E70F706266786E699BFECBBD5704C2EEC1620398C304C637BA27D756A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

saBSI.exe

Path C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe
Size 1.5MB
SHA256 5ec42b168f2541dbb413d6f87aa5569470a2b0c6c574c3e655242461a4524763
MD5 7a1b6316d5d64a740b847d8261ea3e83
SHA1 e130deed179693218679e09f0eef6fb33c369146
SHA512 355f190eb5c83b14ea7ca19c901ff9124962a25f78ff03f1bc9f09387751f8def203e47f017ac0bd295c70ace8efbdc5f193d92d67207329aa1db4dbd0cc7183
SSDEEP 24576:8Vxe28BXUGuG2bjI+O5IRumwloSRB0nPUa6xDuC4d+bk+2miTwX/yQw01:8Vxeyk+tWoS/0PUa6xDv40bk+BiTwXF5
TLSH
T142757C133283C031EC6211B08969DFAB86ADB4345B6148DB67D06E6ED8F22D15E35B7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS046C378A\setup.exe
Size 8.1MB
SHA256 8be09d18795860b08ce3ee4f21c05b3205fba0541ac174cfae1a66d19b21b8ea
MD5 d63c07838f3e41bdc17e273487509c77
SHA1 e4e6908c4a4842bce89344df18edaebefb231fc5
SHA512 e70390900ac7cf9a875811d36a0e4d22b8ddefe229a60879919c9b76640b775742ef014a90292da336691358bdadc45a01a6ad72c7c5251aa546f3a6b29ddcf8
SSDEEP 98304:Xpp/1c07niyCsCZbVz7ZTlS25vSOdFBI3++wteEmn:3177W77ZT35KB3+Bqn
TLSH
T161869E43F3E901A8E0AFE9749B3A5222D5757C864B34A2DF06D43A251E72FD45B3CB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Opera_installer_2607221216476645068.dll

Path C:\Users\Admin\AppData\Local\Temp\Opera_installer_2607221216476645068.dll
Size 7.5MB
SHA256 7cac08fa3fc954671ddbeeae0a9c6c44b31b1e47ee8cf0591f6ce4f012fc0b02
MD5 69e432e06ab253be69c119ade50d2935
SHA1 b0f34191da482d1dd62f0356d63032a68e4ea687
SHA512 2856bb9c16099bc3a23a67d69c647decdcbe36552bd281dc63e1bbdaed0f6680652c10698af1234a78f25db4ed671b0bcf6577add4fdc89a6e9c22f8f5859265
SSDEEP 98304:M/1c07niyCsCZbVz7ZTlS25vSOdFBI3++wteEmL:K177W77ZT35KB3+BqL
TLSH
T182869E43F3E900A8E0AFED749B3A562295757C864B34A2DF06D43A251E72FD4973CB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

107.png

Path C:\Users\Admin\AppData\Local\Temp\is-86VQQC8WP6.tmp\107.png
Size 47KB
SHA256 0c430e56d69435d8ab31cbb5916a73a47d11ef65b37d289ee7d11130adf25856
MD5 4cfff8dc30d353cd3d215fd3a5dbac24
SHA1 0f4f73f0dddc75f3506e026ef53c45c6fafbc87e
SHA512 9d616f19c2496be6e89b855c41befc0235e3ce949d2b2ae7719c823f10be7fe0809bddfd93e28735b36271083dd802ae349b3ab7b60179b269d4a18c6cef4139
SSDEEP 768:RtwR1Dy4rQznr1GYfvLn6froelhVNSyCPtSOeVlTTqYueg:zwR1DybhPwhvSyClSOk/geg
TLSH
T18623F1618E36D41ED38BE69B1F1D9824277AF197F59C1673866879230C039ADCC1DCAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

108.png

Path C:\Users\Admin\AppData\Local\Temp\is-86VQQC8WP6.tmp\108.png
Size 42KB
SHA256 2ddd50ca3bb30387c309b0a627cc14f2820352679caa1d59f0dd35aed9540453
MD5 faff96fb8080a98bd1def3c4f9cce9c1
SHA1 466c66dfaed49d93dd7d8a1e42919a4f03613efa
SHA512 ad87ccc0bcb0115d5e7255935c5bd2b5eeb85b75f46206987d85f0f5e04afce054b0b3cee3d7577039db6ddbff1f0fdfdca657b7877376e4f97c80c5ed7514b7
SSDEEP 768:53E5YnNz2SLHvDYgWfGHV8L77Yy/oksC+x8+RfWpzrdYnsi2anUpMQb3HGJ2:536Ynl2SLrYHAWHDgEqCSskn0nqA
TLSH
T11613F1B8B8DE416DDDDED6B8FCE66FF564816437CC84D1EA800CB028518E784366636B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

109.png

Path C:\Users\Admin\AppData\Local\Temp\is-86VQQC8WP6.tmp\109.png
Size 152KB
SHA256 2f116cdef55e05549d6f06913afe39a91b715b188e110188c7fbf7f5eb69b318
MD5 4e2421d76f1b0c5627f732d4e945a023
SHA1 89e3de5bcbfe50c18f17b5ee731dd24213f1812d
SHA512 13c97b5ec52344b605d1b9658dbe15ca05841fdb786f2e06ab52a4f80ca6398adfa7c0dda304ec343ab733df85d9a9da29012ac21d96e680a19ecbbfeb0b9001
SSDEEP 3072:zkL8PqE1l4NJoxLiog7R+1tNx+ZEaLbplAfkFO/lb95N:zFowWo7tv8bpyp9j
TLSH
T138E3121A702324BAB44EF4D6F1DB65C2EC22AAFD214D10A7D79A5C7428C0B66FC5D2C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

component0.zip

Path C:\Users\Admin\AppData\Local\Temp\is-86VQQC8WP6.tmp\component0.zip
Size 515KB
SHA256 cc6f4faf4e8a9f4d2269d1d69a69ea326f789620fb98078cc98597f3cb998589
MD5 f68008b70822bd28c82d13a289deb418
SHA1 06abbe109ba6dfd4153d76cd65bfffae129c41d8
SHA512 fa482942e32e14011ae3c6762c638ccb0a0e8ec0055d2327c3acc381dddf1400de79e4e9321a39a418800d072e59c36b94b13b7eb62751d3aec990fb38ce9253
SSDEEP 12288:ib5kasT/hWZEu58IbccPqwozk/2rYJb69+J2W:M5kzT/hWZjfbccPOzk/aIb3J2W
TLSH
T1C8B4237E2323A734A201E7A425373B520A1E63C6733C15EB7EC1AB927D3053D76A456B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

saBSI.exe

Path C:\Users\Admin\AppData\Local\Temp\is-86VQQC8WP6.tmp\component0_extract\saBSI.exe
Size 1.1MB
SHA256 f5aa950381fbcea7d730aa794974ca9e3310384a95d6cf4d015fbdbd9797b3e4
MD5 143255618462a577de27286a272584e1
SHA1 efc032a6822bc57bcd0c9662a6a062be45f11acb
SHA512 c0a084d5c0b645e6a6479b234fa73c405f56310119dd7c8b061334544c47622fdd5139db9781b339bb3d3e17ac59fddb7d7860834ecfe8aad6d2ae8c869e1cb9
SSDEEP 24576:WF66IUpqM/XAl0drYaL6NFEXXN6abiklqOYadJ0CbmpV4CsCa0wDisO4qG:k/M0drYaIaXXOAqOYadJ0Cbmrhq0wTb5
TLSH
T1D2458D317586C031E1A211B219F9EBA585ADB8359F7244CBB7C05F2ED930AD25E36F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

component1.zip

Path C:\Users\Admin\AppData\Local\Temp\is-86VQQC8WP6.tmp\component1.zip
Size 782KB
SHA256 4a59596213b8e401401fad6249213596400943f72f98d8810c48538374137f52
MD5 2c7be73f369c90ce32bbf5b6edcd9cd4
SHA1 aabd8f656ea80ea72dd17f2819fbee64e6f4b560
SHA512 312502f64439a7debfee5b47197e481eab490604803bd07eda5fa3d1a1e8e7de3e6e687693932ee5aee85e56ee059b790a7f47a3754f6818e14fa1cf6a0a7815
SSDEEP 12288:YV/ZeZ0C6U6lQzc2+KcqaYTmydhmdfLNz+g5WOcmpMi2VWmSKAf+4l:g/MZ0RTv2hnKydhEz0OcoMiCWNfj
TLSH
T1FA053380AE40F676EB81CA213FA7E5DF35538D923BC1797D61548088322DB6EF5CB258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookie_mmm_irs_ppi_008_585.exe

Path C:\Users\Admin\AppData\Local\Temp\is-86VQQC8WP6.tmp\component1_extract\cookie_mmm_irs_ppi_008_585.exe
Size 1.7MB
SHA256 2ab4329fb77df9f5b70ac45d9fc005f019c8ef930eabf82e6a10052f9cbeec2d
MD5 11a225495371d91ef254a5c69c967ea6
SHA1 ab136cbac42cc54a6aa15f7eb43eec1c6647dc74
SHA512 5012d9fbc9401b5c5a377f100560c637adc98d319749bb599a0a0487417915f647032430ef027c69cf1a8fecc2d63a741f1aaec71611dcf292db109a35c45023
SSDEEP 24576:tuRu5fl3AFG8CWgd3jEDigqqP9WhavTXeS0h0lhSMXlOncOy9x6mWFI/RV:bJlQU8CJjqF0wuS5icLxxWe
TLSH
T198859E207B42C07AD49A01B1992CBBAAC16DAE744F6550DB73F03F2D6D711C22B35BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

component2.zip

Path C:\Users\Admin\AppData\Local\Temp\is-86VQQC8WP6.tmp\component2.zip
Size 3.6MB
SHA256 52ea32c4123bc367fc61f6624d0ac7a3d677a7eb169687c3daa3d975fbea4a5b
MD5 dc29d3a3d119cde5912aa66d95f26062
SHA1 2aaa52b1a53867706888eb2f3bf530454c2a690f
SHA512 25d975174a9d3d5417eb025083c8ea33b46d7e2b53f0574a9f4d2c950885b8e7ca1bd115a30bc0022ce870063a0adb76477064bfeffb81b1b3421dbc48d33c2c
SSDEEP 49152:NVAbwQwEiXhnkSxkrFHQ1YUyWuT+SNBRk2ZatSkJsfofgWJZ9C3c1yUH5MQdds3L:rA/iXtsWiUyjHNBRkhQkn4WjV9b00AW8
TLSH
T165062331BBC1E472E7A321324F78F3599A7EF6940E550A977B480A5D8F70282A635F07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperaGXSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\is-86VQQC8WP6.tmp\component2_extract\OperaGXSetup.exe
Size 3.6MB
SHA256 47e56b4975eeb5ed4c5f492046c069e735173c3d1b6f10a8f2dbeac5210a20a3
MD5 9fd9ddb996e1e4327d2dc25034d2280d
SHA1 2094bac602b2e0c62a854e09b2fdf77871cc6eab
SHA512 5c7f788f41eeb63580d3e52a46a45497648eca3c5b34687585f9f178329792a6cc2619d85ea7e2bf9e24ebfab22dababfcfa91248759ecc34198fac384926d0c
SSDEEP 49152:MVAbwQwEiXhnkSxkrFHQ1YUyWuT+SNBRk2ZatSkJsfofgWJZ9C3c1yUH5MQdds3U:AA/iXtsWiUyjHNBRkhQkn4WjV9b00AWb
TLSH
T1D4062331BBC1E472E7A321324F78F3599A7EF6940E550A977B480A5D8F70282A635F07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uTorrent.exe

Path C:\Users\Admin\AppData\Local\Temp\is-86VQQC8WP6.tmp\uTorrent.exe
Size 3.7MB
SHA256 e2837e13d80e4602b0c2d711c6d6c17217f4a80c8ff0b33dd90df219f025f3b7
MD5 7b1bcf79461ed67aa315a4e156dc83f7
SHA1 d15d84e371af61b2497d0f825167d8d19caa9ea6
SHA512 3857a4642a0e5911d46a96ee66309fc414997b347500dd90e8a88f8c578de615849d24ce02080cb30633ec822e2ec2e0503ea86819ba05d3a9ef795cb43c21f4
SSDEEP 98304:yg3iGC5mAyFoVCVMZUkPk0XdC/eBWLhR4qdGcQi:ywi95jooCM+gC2B6hR4/O
TLSH
T145063361E664FC6AE57885F5008B53CE9C63BC07F26C2BB387A1363B7B312415A94F49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

utorrent_installer.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-SFWC4MB882.tmp\utorrent_installer.tmp
Size 4.2MB
SHA256 bc475d8c7bb2aab62adc06f7be24c7856d72ad80fe4a5c5b8c3996e9d03b2107
MD5 a20301eaf78ef3a073ae0f5520bd7e5c
SHA1 957cb563679f455aef1615517220909e930f8cf0
SHA512 67590ca2b14fc3c9dd10b89fb37ec40b7b5790be26efeb0c5992e2aeebf6f3124be4d0dd873c108fe68cac9b7086dd20930aea2acaec07849e5a676ca10372c5
SSDEEP 98304:DYU5hnuOajWwMPdCpepI3GrwrA+JI333Y:dxuHjWfZIzZ
TLSH
T1CA168F03B388753EE4671A3A583FA284983F7E213A26CD4B6BF40D5C8F395416D2A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INetC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp72F0.tmp\INetC.dll
Size 24KB
SHA256 c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502
MD5 640bff73a5f8e37b202d911e4749b2e9
SHA1 9588dd7561ab7de3bca392b084bec91f3521c879
SHA512 39c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a
SSDEEP 384:wv1j9e9dEs+rN+qFLAjNXT37vYnOrvFhSL+ZwcSyekzANZBJ:w1AvEs3HBLzYn29vYh
TLSH
T1F2B2E69157EA135EF7F19F347475EB2249BBBC214821C8CF5633268E19B2242E930727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp72F0.tmp\System.dll
Size 12KB
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsisFirewall.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp72F0.tmp\nsisFirewall.dll
Size 8KB
SHA256 53be5716ad80945cb99681d5dbda60492f5dfb206fbfdb776b769b3eeb18d2c2
MD5 f5bf81a102de52a4add21b8a367e54e0
SHA1 cf1e76ffe4a3ecd4dad453112afd33624f16751c
SHA512 6e280a75f706474ad31b2ce770fa34f54cb598528fac4477c466200a608b79c0f9b84011545595d9ba94331ad08e2f51bd42de91f92379db27686a28ba351256
SSDEEP 96:8SMPv+eLDUDp+weLv2lstU+0IgNB2Aa20kdArfOwJKbFrMiRsuHdRYL:wnxLDUwp6sgN2RDrzJMMmsuYL
TLSH
T16DF1F936B7E18171C26F02B09F4F569DE1F8E66067E0013377628B5D2EB029DE836526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

utorrent.exe

Path C:\Users\Admin\AppData\Local\Temp\nsp72F0.tmp\utorrent.exe
Size 3.5MB
SHA256 285127f8530fcdb0166cf37c97e60a13ecff7d57d3f0066e7cec0e89188e9ae2
MD5 657775f666c15e8ac34687e994dba93c
SHA1 7462a199219a13700b48b3bfb094dcb6273d29cf
SHA512 a8ac6aa8ec3453c7d098b42f4b163ae8fe04c335213a9dd7ed39be76758064064b71d4d0dc1573c575f2a3d7df6a62cbf22323220dddfbd2d74220580375065f
SSDEEP 98304:O12+yYUKanBkVVZHvXzSoInsqsCBVCpTLNMYuA4FGPsI:O1BU5nC1bS1dspTBuNy
TLSH
T179063392DE312E84E0FE52F514694AA84121EE4A7D5C1F334231763D5F360C2EABADE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
Size 40B
SHA256 3a7bb162b5ada053cdb12dea56ad10ef322b976650f1c74bb4528eccf0a7f13d
MD5 a85c98b58f4a44114ac8c27c5cb26bd8
SHA1 0658eb4809c3102980fcdce4457f5e8b9f8b729b
SHA512 c142b81164c7b6b8190fe9e4aabbd026f6788b6b76f3f83f2462aa2347f3527da78495fce6340d7f94c5dba4bea99c3d1bb8f3a7b5539b75680b0bc3a2ebb3a3
MD5 SHA1 SHA512

Submit Download

icarus.exe

Path C:\Windows\Temp\asw-88d78542-44e5-4b7e-89ff-deff69a18ac2\common\icarus.exe
Size 9.3MB
SHA256 48bd9a443922dbb3115b502e274d04a52093452ae1893b994d2f069b75a4b8e3
MD5 e9de3472b63f6b1feebdc0158d785368
SHA1 c7a09f82285ee44837ae4d1fc2d315bb4f8997f1
SHA512 1aae253e12e0723291f4070d5638fd992927da72423cc5c9f99d56495b132c179bae7930376dc80265636ba22d71cb3bc4b109afd5a33e370dd9dab572cbb496
SSDEEP 98304:v/GbIjdIM5fQyjRVa0dHGnkpIw7N23YhHtXM:v/GkjdIWfFPPHGnkpIw7N23YhHtXM
TLSH
T1A8A66C1EBA6D01E5C1FEE1788A47641BEE717C95033996DB66E08D461F23AF09E3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icarus_mod.dll

Path C:\Windows\Temp\asw-88d78542-44e5-4b7e-89ff-deff69a18ac2\common\icarus_mod.dll
Size 16KB
SHA256 450267277b701624056ce7e2c106bca2d6a7540c346c1bdbb0cf0cde3bb044e3
MD5 8bda40f35eb88e50d52a776d74b33b0e
SHA1 e3964c8e39125c68d1d941f418f14e138366ff05
SHA512 667b3ee3e4c374550b55af4c8fe167532ce7b50485a74e6df7cb23816add400c8a1d310c435a939dabe1722cef57f669dd8793a8fb00595f93aa6e720d481aae
SSDEEP 192:3DSfyQYbG0TJqx/ql3pPIKfhig1/C59jq7Ggfv5jMdPf43x++Xa21R1bRpzIQ:3D+OGGAa3pwKNsZqnv9Mwx7bLRRFH
TLSH
T18F724A473F302582EFC78D74A4D88BA7AD7073A1AF5548D61574819CADA4BC23A7812F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

product-def.xml

Path C:\Windows\Temp\asw-88d78542-44e5-4b7e-89ff-deff69a18ac2\common\product-def.xml
Size 2.2MB
SHA256 7f3013ef6908be0fa291371582144b0d2eec0afe90a683ba96e352384341946e
MD5 91f66f8220d3f8b0792b03715602f5cc
SHA1 f0d26cefd389b5492463cef1a2fc6b97dcdb9514
SHA512 d34c3c6bdff4e5e8687a01a49a9aa4f986ea8749bb69d086d1a1a3251ea34521b1efd4015aa6163abdeada84aff81f7e94e76e0f3132ba5a90d945aee2651c46
SSDEEP 24576:VpmyL0k5X+Biz9w5bfe1XZoap/6M6nHKjT00NRtlMIeg:WywkBhSeG0D2g
TLSH
T124B55F76359E7C6F714A50FBB480BC80629FDD788DE05C97F1B33240A252EA29E75A70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

product-info.xml

Path C:\Windows\Temp\asw-88d78542-44e5-4b7e-89ff-deff69a18ac2\common\product-info.xml
Size 11KB
SHA256 eca4b91c7356245b6199a0bfe6c0a732d5e84d265c398c7c70cf352f158f25cf
MD5 ef89db6ce3fe81b3555a3d483f2cc26e
SHA1 4d9ef9f9b1583b09cdc75abf4045c62b03f6593f
SHA512 47439ba99a5197892718487f373181478a85fa0e29fd2fa5eabc22091a01d4e8b2fe0aac136d46282b5628e0127c2c05db8b086acf69283ad37f6b55af2c66c3
SSDEEP 192:/xy4KAxEOLSMRmNpB/81fxvaeQc7U8wqOVvN/3cLWG3vV/vG3E1AqldWDjuLsWcR:jKwzmemNjE1wCw8yCj3XWn7Cse4
TLSH
T1B9323275201CFF6B321FA0D3E0D5B59121AFFC1D8F942C27E1273640A2AF568B906975
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epps.edat

Path C:\Windows\Temp\asw-88d78542-44e5-4b7e-89ff-deff69a18ac2\epps.edat
Size 80B
SHA256 c6528b50bbe1265eeb1beb88535e7f6257075daaa245ed693e9ac38511b297bf
MD5 5438e42d44c84deaf1c0d2ff11760e49
SHA1 87a6d26a9a158a169f2808ea1702daa188865498
SHA512 ff1f32e2379a4f6d0b642d31baaf558090dbe2ed6031f88f25438d0100f89651cea3af3690dbef151f3c3fce0582d0fbf5b85b7392ad7a885815d957cd8041a5
TLSH
T195A00188D40182F320A0D20073889187301A00C45E49318D79FAF94A2389B8B9AA84E0
MD5 SHA1 SHA512 TLSH

Submit Download

giet.edat

Path C:\Windows\Temp\asw-88d78542-44e5-4b7e-89ff-deff69a18ac2\giet.edat
Size 8B
SHA256 c2cb92b00918d830aa68e4d5496ca412e3bc86f88444cb3de9d52e62a877b93f
MD5 faeee7fa0a7dd54b32eb730697448ac2
SHA1 85314fe3f7a2a838afb9b5ae64f00577cdaeb664
SHA512 1640cb35c92e0214808fe14ca3658549a927817195bb16b82f87bb3cf2e7e6e623bf04f42147ee97c66a52fbb11a55f253688d5a8363f3a836044e65b21d5b3a
MD5 SHA1 SHA512

Submit Download

icarus-info.xml

Path C:\Windows\Temp\asw-88d78542-44e5-4b7e-89ff-deff69a18ac2\icarus-info.xml
Size 2KB
SHA256 c7a780427c9adbf4c54b64ca04fc12c79d9d9fbbb06bd9ffccb41d0f1e8c6811
MD5 62ce4dab8335a4091de249150a983d1b
SHA1 ea8f97154dc254602c2d4a19a709b1632a2b400f
SHA512 c7d9609daa799a0c37f711f67dc7d53f77b95703ecce314aa3063fcb6f88732ac7561fbcb4e157dda0dba7647cfccedc16df9b8bbbe4367728a2430b09d9d513
TLSH
T1F05162B9A03DDE2B372AA5EFB194F8C173DFBD455B94096341077081DC6B5F42881068
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3976-96-0x0000000000400000-0x0000000000D17000-memory.dmp

Download

memory/3976-122-0x0000000000400000-0x0000000000D17000-memory.dmp

Download

memory/4856-10-0x0000000000010000-0x00000000000F5000-memory.dmp

Download

memory/4856-1-0x0000000000010000-0x00000000000F5000-memory.dmp

Download

memory/4856-313-0x0000000000010000-0x00000000000F5000-memory.dmp

Download

memory/5084-277-0x00000000009E0000-0x0000000000E1F000-memory.dmp

Download

memory/5084-41-0x0000000003890000-0x00000000039D0000-memory.dmp

Download

memory/5084-36-0x0000000003890000-0x00000000039D0000-memory.dmp

Download

memory/5084-32-0x00000000009E0000-0x0000000000E1F000-memory.dmp

Download

memory/5084-28-0x00000000009E0000-0x0000000000E1F000-memory.dmp

Download

memory/5084-20-0x00000000009E0000-0x0000000000E1F000-memory.dmp

Download

memory/5084-11-0x00000000009E0000-0x0000000000E1F000-memory.dmp

Download

memory/5084-44-0x00000000009E0000-0x0000000000E1F000-memory.dmp

Download

memory/5084-56-0x00000000009E0000-0x0000000000E1F000-memory.dmp

Download

memory/5084-45-0x0000000003890000-0x00000000039D0000-memory.dmp

Download

memory/5084-37-0x0000000003890000-0x00000000039D0000-memory.dmp

Download

memory/5084-120-0x00000000009E0000-0x0000000000E1F000-memory.dmp

Download

memory/5084-12-0x0000000001B10000-0x0000000001B11000-memory.dmp

Download

memory/5084-54-0x0000000003890000-0x00000000039D0000-memory.dmp

Download

memory/5084-53-0x00000000009E0000-0x0000000000E1F000-memory.dmp

Download

memory/5084-51-0x0000000003890000-0x00000000039D0000-memory.dmp

Download

memory/5084-50-0x0000000003890000-0x00000000039D0000-memory.dmp

Download

memory/5084-49-0x0000000003890000-0x00000000039D0000-memory.dmp

Download

memory/5084-310-0x00000000009E0000-0x0000000000E1F000-memory.dmp

Download

memory/5084-312-0x0000000003890000-0x00000000039D0000-memory.dmp

Download

memory/5084-42-0x0000000003890000-0x00000000039D0000-memory.dmp

Download

memory/5084-311-0x00000000009E0000-0x0000000000E1F000-memory.dmp

Download

memory/5084-5-0x0000000001B10000-0x0000000001B11000-memory.dmp

Download