23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 26:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 22:T4f6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious UTorrent.C potentially unwanted application Sample 64d7da86d5fe… — Score 90/100 — Hybrid Analysis","description":"Malicious verdict for sample 64d7da86d5fe…. Malware family: UTorrent.C potentially unwanted application. Threat score 90/100. 4/27 AV engines flagged this file. 7 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/64d7da86d5fee292b2186c3f6ce59c88ed42725427c48a7d3384e4e5679b20b3","keywords":["Malicious","UTorrent.C potentially unwanted application","malware analysis","sandbox report","threat intelligence","64d7da86d5fee292b2186c3f6ce59c88ed42725427c48a7d3384e4e5679b20b3"],"about":{"@type":"SoftwareApplication","name":"uTorrent.exe","applicationCategory":["peexe","executable"],"identifier":"64d7da86d5fee292b2186c3f6ce59c88ed42725427c48a7d3384e4e5679b20b3","additionalType":"Malicious sample"},"threatScore":90,"malwareFamily":"UTorrent.C potentially unwanted application","antivirusDetections":{"malicious":4,"total":27},"behavioralIndicators":{"malicious":7,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T67c,File "64d7da86d5fee292b2186c3f6ce59c88ed42725427c48a7d3384e4e5679b20b3.crt" is a certificate (Owner: CN=BitTorrent Inc, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=BitTorrent Inc, L=San Francisco, ST=California, C=US, Issuer: CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa c10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US, SerialNumber: 5732c1574e6af828e1b4f93abb34ed08, Valid From: 06/04/2013 19:00:00, Until: 09/03/2016 18:59:59, Fingerprints: MD5=FD:18:06:45:B9:08:82:AF:D3:23:7C:DF:00:7C:05:68; SHA1=CC:94:05:7C:48:29:F3:5E:1E:E2:19:CD:5F:3B:17:08:00:F1:48:A5) File "64d7da86d5fee292b2186c3f6ce59c88ed42725427c48a7d3384e4e5679b20b3.crt" is a certificate (Owner: CN=Symantec Time Stamping Services Signer - G4, O=Symantec Corporation, C=US, Issuer: CN=Symantec Time Stamping Services CA - G2, O=Symantec Corporation, C=US, SerialNumber: ecff438c8febf356e04d86a981b1a50, Valid From: 10/17/2012 19:00:00, Until: 12/29/2020 17:59:59, Fingerprints: MD5=08:32:B6:5C:C3:E3:A4:9B:C3:81:BA:95:E1:B5:87:37; SHA1=65:43:99:29:B6:79:73:EB:19:2D:6F:F2:43:E6:76:7A:DF:08:34:E4) File "64d7da86d5fee292b2186c3f6ce59c88ed42725427c48a7d3384e4e5679b20b3.crt" is a certificate (Owner: CN=Symantec Time Stamping Services CA - G2, O=Symantec Corporation, C=US, Issuer: CN=Thawte Timestamping CA, OU=Thawte Certification, O=Thawte, L=Durbanville, ST=Western Cape, C=ZA, SerialNumber: 7e93ebfb7cc64e59ea4b9a77d406fc3b, Valid From: 12/20/2012 18:00:00, Until: 12/30/2020 17:59:59, Fingerprints: MD5=7B:A3:69:EE:9A:BD:81:E0:FC:76:74:E9:70:9E:15:1D; SHA1=6C:07:45:3F:FD:DA:08:B8:37:07:C0:9B:82:FB:3D:15:F3:53:36:B1)25:Ta90,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAeBSURBVFhHrVaLU5N3FuWP2Zkdp7ttd31bCyKIooKCCYSCCkGg1MUWCKCgiSHyCAkPWV2WFq1YtQVFGkjIm4SXq/bltGIdrdixrm3t1q1QfEDg7L2/LwFsogO7+zF3PgJf7jn33nPP7wsLW+C1r0cBjSMF5W4FDvUmocKbDF1vMsq9adC4t2OB6eb3uKpTBq1NjkqPAlV9KajqfwPVHF4F9PS5mkhU9SXTPQmVXjmRk+Hg/4PMng8TcLBHRklTUEOAHPo+Bk8TdwYXBPolEoKIh7rikVN3ZCLmV2KIp1Qd8dA5GFyqsqYvDYaBNBgpDP2p4l5Dd0P/dkGMO6LvU9Dzs52o8GzDIQq1PXFhRFTn4qBzyamtCn/lEqBxYAeM/TtQO7BT3Pkzk2FyTILHw2PhcQS6oOtlEonQ2BPmR6LgzEaqfJtIJNrOlXPFDDy4kyIddSIyiAARmUNC0oNCGoebSLBIqQM6IlDemwi1bcuLSfzlxHpoLFtpjly9NHep7QyeLqJ+UEmRgboBCrozKUGiNwMGSw6MXXtQ25GPuvZiHO4upA1JhNadIELjikNJ16bQJDKb1qGoI5aEIxezZAIstJnqqVoGlAhkomFI6SeRLo3Dmov3bQYMXXPg5t2v8PDXn8HXexdV0PaSmN1boHFuxgHnRuw+vSGYxO73o6C2UvVinaiNHpqrUwmjPRvGPgZPJ1AiMMTguwSJevpcO0CdIXIGz04MXrUK0LnXrQefi8oPujZD7dwkCOx3/IaA8mg0is5uQLUlE0YTt7AQdWeL0dSlRcdAC85crBatlqqnIBL11AH+XQiSxUmjarQWwjc1+QyBaUzj8GAODjgI3BGLMgIvs69H7sm1s13IbopAafdm1J4vgOeLLozcu4axR6MziR5PjlHVmaJanj1XLnTgFyILVfiDazuGRz4J6sKX33sJmMHXU8SglGKvLWaWQO7xCGh6tkBv3oV/j/4UlID/0P31UaF6QcIvSAPPnsLg94CqviQ0u9RB35+a9qGqVyGA99miCXytCGE/mY0xyDsVBa0zAZWuFFy46ghJ4O4v18VGzLRcAKf6nZANiNzPuw2V1jTc+fFGUI4Ld0wESuD2KAFeYo9ENhUetqtxLQo/ioHWlUg7K0OTrZSmNh2SRPPlfPIF9gbJltmCqzzJfnAZ7bqk9tPehqDvT/ie0CEWL4CLrWtQbF+DPW3hCNthXIVCEiBb5iFyLb1Vibv3b4ckcPluz4zTseWy21V4ZWLXGVzbGy/UXt6dggdj94NyOL5pFeBFtggU90RAZY5EWGrNMhS0x0DnZssk76eTzPrJhyEJPJ74VbS8QrSbgl2OwMWOE7CG1my/k8Rmi0XnP44F5Xg0MYZS23pBoIgIFFnWIExRvQQF/hGwb3PUmfMwOTkRksT5q/XCViV3o4qpao07jgjQmrn8SndGo7xzO8YfjwXl6BtpnyGg6qIRpOpXYM8HUXRYbKVzXKqo0vYGrn37WUgC34/dkiomUG53oGo2l1I7rZhfZOrORFwadgflYH2dvFSOYksUCjuiSYT10XjzWDgO9MSJysQs3VtDCimQrf1KjXA0rjhgLqX2ddKKMQFHJDRtqbBdbgtZBJPo/9KCvc1KhOU2bobyyCqUmGKpA1tpG7YIApXdGXg4/iBkAna7Bk+uZCwMzKAiIoXKy0zUndY3cf3OFyG/z3+cnp6eNSKFfjHy26KpnZKKhaBsCbg47HxugsmpCTR7y7DPHEsVS3tdYlmH/e1yaFuz0O5tFut89Yd+XP/pUlAen883SyCpfDGyWlaj1LJRHBhqFhS1uNFS9FwCogr6uXJjCEe6DkD7QRYBZ6Ph3F4yMzumpqeoyikcHspCEa3ekcHduHLPhR/GRnDv4Q303+ycJfBWQxxSDH/C221r6aSKlcK5AQdNyeQJIy8kEfjn46fjGH/yrOrtN45L68ZrFwj6XGgOh/bsb96gE7R/RHrTcqhMUTRXOrHIt/nUslw6PS8Ccx966nuE88O1z4L7iRRawpF3dnXw+8BbdfHYVvEH5Jx4DcXmKFK0pOqKTiUmfaE9gc96tli++MD5js4LrppFrLL6q2bgQFAX3vn4NWQ20P6HupLKl0Je8zJyTq6EqjtSiGtfVxyGbwcfsQwqqqSkPLLinjUS6FzAQPv993zT68hpWfXi98L4/YsgM76E7NblKCCnYgG1umtCm9LorZBtnktCZQ0XxPI/Xo2sEyvm92a8iUgk6hdBeXwJ8s6tRFm7DKOPfglJopHedhhkRmz+DgS6wYLLO7cKyveWzw88MJr4spcQp/s9Uo++Qq9Pq+H6rJPOh0lhIHOv4fuDz1H663ibqs45tRw7Di9dGHiARLJ6BTaU/Q4J1Yvwzl/luP3dTfzr5x8xNj6KpxNPwGYyNeUTJ6mKKi3okkB3t69E1sllSDv6KlJ0K/878LkiTSz7M+JLXsbf2/RwXTDj068GMXzzCm7duY5v//kNTJ+2YFfrUmQcW4y0v72KZOMrUOiW/e/AoTbF8K4aTacNaD1/BGfM7+IjcwtOmZqxsyYCcs2SBYP+B5a8Tg6Cw6DdAAAAAElFTkSuQmCC1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"64d7da86d5fee292b2186c3f6ce59c88ed42725427c48a7d3384e4e5679b20b3","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":90,"unified_at_epoch_ms":1790441411160,"unified_at":"2026-09-26T16:50:11.160Z","metadata":{"hashes":{"sha256":"64d7da86d5fee292b2186c3f6ce59c88ed42725427c48a7d3384e4e5679b20b3","sha1":"9ad3ff714d627fff64a4a0ae28dd0873b41fd67a","md5":"14ee6c0e28d6e407db35f7b12e3fac03","sha512":"0d180e2bedbee3af6e13ff7e80ba5059efabfda3065818feeedc6fc7d90dcc70ef4f3f2ef4537439f958d048f467ff2084fd2c8b0a676bdbbc603a5bd738b8c2","ssdeep":"24576:C0AFcAs1q77Ae58/MOtwwOE8dmM3xaAen80aS4cYy8pCPf5Msk1Xl61NCWhc78yX:2FCMn8kzcM/0Ictf5Dk1XluRcLpM3BI","ssdeep_chunks":["24576:C0AFcAs","24576:0AFcAs1","24576:AFcAs1q","24576:FcAs1q7","24576:cAs1q77","24576:As1q77A","24576:s1q77Ae","24576:1q77Ae5","24576:q77Ae58","24576:77Ae58/","24576:7Ae58/M","24576:Ae58/MO","24576:e58/MOt","24576:58/MOtw","24576:8/MOtww","24576:/MOtwwO","24576:MOtwwOE","24576:OtwwOE8","24576:twwOE8d","24576:wwOE8dm","24576:wOE8dmM","24576:OE8dmM3","24576:E8dmM3x","24576:8dmM3xa","24576:dmM3xaA","24576:mM3xaAe","24576:M3xaAen","24576:3xaAen8","24576:xaAen80","24576:aAen80a","24576:Aen80aS","24576:en80aS4","24576:n80aS4c","24576:80aS4cY","24576:0aS4cYy","24576:aS4cYy8","24576:S4cYy8p","24576:4cYy8pC","24576:cYy8pCP","24576:Yy8pCPf","24576:y8pCPf5","24576:8pCPf5M","24576:pCPf5Ms","24576:CPf5Msk","24576:Pf5Msk1","24576:f5Msk1X","24576:5Msk1Xl","24576:Msk1Xl6","24576:sk1Xl61","24576:k1Xl61N","24576:1Xl61NC","24576:Xl61NCW","24576:l61NCWh","24576:61NCWhc","24576:1NCWhc7","24576:NCWhc78","24576:CWhc78y","24576:Whc78yX","49152:C0AFcAs","49152:0AFcAs1","49152:AFcAs1q","49152:FcAs1q7","49152:cAs1q77","49152:As1q77A","49152:s1q77Ae","49152:1q77Ae5","49152:q77Ae58","49152:77Ae58/","49152:7Ae58/M","49152:Ae58/MO","49152:e58/MOt","49152:58/MOtw","49152:8/MOtww","49152:/MOtwwO","49152:MOtwwOE","49152:OtwwOE8","49152:twwOE8d","49152:wwOE8dm","49152:wOE8dmM","49152:OE8dmM3","49152:E8dmM3x","49152:8dmM3xa","49152:dmM3xaA","49152:mM3xaAe","49152:M3xaAen","49152:3xaAen8","49152:xaAen80","49152:aAen80a","49152:Aen80aS","49152:en80aS4","49152:n80aS4c","49152:80aS4cY","49152:0aS4cYy","49152:aS4cYy8","49152:S4cYy8p","49152:4cYy8pC","49152:cYy8pCP","49152:Yy8pCPf","49152:y8pCPf5","49152:8pCPf5M","49152:pCPf5Ms","49152:CPf5Msk","49152:Pf5Msk1","49152:f5Msk1X","49152:5Msk1Xl","49152:Msk1Xl6","49152:sk1Xl61","49152:k1Xl61N","49152:1Xl61NC","49152:Xl61NCW","49152:l61NCWh","49152:61NCWhc","49152:1NCWhc7","49152:NCWhc78","49152:CWhc78y","49152:Whc78yX","24576:2FCMn8k","24576:FCMn8kz","24576:CMn8kzc","24576:Mn8kzcM","24576:n8kzcM/","24576:8kzcM/0","24576:kzcM/0I","24576:zcM/0Ic","24576:cM/0Ict","24576:M/0Ictf","24576:/0Ictf5","24576:0Ictf5D","24576:Ictf5Dk","24576:ctf5Dk1","24576:tf5Dk1X","24576:f5Dk1Xl","24576:5Dk1Xlu","24576:Dk1XluR","24576:k1XluRc","24576:1XluRcL","24576:XluRcLp","24576:luRcLpM","24576:uRcLpM3","24576:RcLpM3B","24576:cLpM3BI"],"imphash":"fc7f06562544d2475b2544b76aa1336b"},"file_info":{"file_name":"uTorrent.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":1774432,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499297441000,"last_seen":1690925567000,"last_multi_scan":1690925567000}},"detections":{"summary":{"verdict":"malicious","score":90,"tags":null},"stats":{"av":{"malicious_count":4,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":11,"suspicious_count":17,"malicious_count":7,"total":35},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/grayware_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/uTorrent.C potentially unwanted application","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Trojan.DQD.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"UTorrent.C potentially unwanted application","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts domains","description":"\"i-50.b-000.xyz.bench.utorrent.com\"\n \"download-lb.utorrent.com\"\n \"router.utorrent.com\"\n \"router.bittorrent.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"54.243.238.29:80\"\n \"67.215.238.66:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\HYD4790.tmp.1443258662\\index.hta.log\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\HYD4790.tmp.1443258662\\HTA\\install.1443258662.zip\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\HYD4790.tmp.1443258662\\HTA\\index.hta\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\HYD4790.tmp.1443258662\\HTA\\uninstall.hta\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\HYD4790.tmp.1443258662\\HTA\\3rdparty\\OCComSDK.dll\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\64d7da86d5fee292b2186c3f6ce59c88ed42725427c48a7d3384e4e5679b20b3\"\n \"Local\\\"\n \"Local\\WininetStartupMutex\"\n \"Local\\WininetConnectionMutex\"\n \"Local\\WininetProxyRegistryMutex\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /endpoint/hydra-ut/os/win/track/stable/browser/firefox/os-region/US/os-lang/en/os-ver/6.1/enc-ver/109813873/ HTTP/1.1\nHost: download-lb.utorrent.com\nUser-Agent: Hydra HttpRequest\nConnection: close\nContent-Length: 0\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"\" loaded module \"DNSAPI.DLL\" at base 75630000\n \"\" loaded module \"NTDLL\" at base 77BE0000\n \"\" loaded module \"ADVAPI32.DLL\" at base 77480000\n \"\" loaded module \"C:\\WINDOWS\\SYSTEM32\\MSWSOCK.DLL\" at base 75770000\n \"\" loaded module \"C:\\WINDOWS\\WINSXS\\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.17514_NONE_72D18A4386696C80\\GDIPLUS.DLL\" at base 747F0000\n \"\" loaded module \"SECUR32.DLL\" at base 75AC0000\n \"\" loaded module \"C:\\WINDOWS\\SYSTEM32\\WSHIP6.DLL\" at base 75760000\n \"\" loaded module \"CRYPT32.DLL\" at base 75DB0000\n \"\" loaded module \"CRYPTSP.DLL\" at base 757B0000","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"DnsQuery_A@DNSAPI.dll\"\n \"DnsRecordListFree@DNSAPI.dll\"\n \"NtSetInformationFile@ntdll.dll\"\n \"AdjustTokenPrivileges@ADVAPI32.dll\"\n \"OpenProcessToken@ADVAPI32.dll\"\n \"LookupPrivilegeValueA@ADVAPI32.dll\"\n \"CheckTokenMembership@ADVAPI32.dll\"\n \"GetTokenInformation@ADVAPI32.dll\"\n \"WSPStartup@mswsock.dll\"\n \"InitSecurityInterfaceA@Secur32.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"\" (Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\", Key: \"STATE\")","origin":"Registry Access","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"mshta.exe\" with commandline \"\"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\HYD4790.tmp.1443258662\\HTA\\index.hta?utorrent\" \"Z:\\64d7da86d5fee292b2186c3f6ce59c88ed42725427c48a7d3384e4e5679b20b3\" /LOG \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\HYD4790.tmp.1443258662\\index.hta.log\" /PID \"1320\" /CID \"-t0oY68VwpIzqzen\" /VERSION \"109813873\" /OS \"6.1\" /BROWSERS \"\\\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\\\"\nC:\\Program Files\\Internet Explorer\\iexplore.exe\" /ARCHITECTURE \"32\" /LANG \"en\" /USERNAME \"PSPUBWS\" /SID \"S-1-5-21-4162757579-3804539371-4239455898-1000\" /CLIENT \"utorrent\"\" (UID: 01008390-00003892)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"LookupAccountNameLocalW@SECHOST.DLL at 00988359-00001320-77C4228D-1004251\n LookupAccountNameLocalW@SECHOST.DLL at 00988359-00001320-77C4228D-1004298","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"64d7da86d5fee292b2186c3f6ce59c88ed42725427c48a7d3384e4e5679b20b3.crt\" has type \"data\"\n \"utt2486.tmp\" has type \"Unknown\"\n \"1f91d2d17ea675d4c2c3192e241743f9_e47c61d2-1dae-480e-827a-ae8d797649df\" has type \"data\"\n \"pspubws@localhost[1].txt\" has type \"ASCII text\"\n \"settings.dat.new\" has type \"data\"\n \"index.hta.log\" has type \"ASCII text, with CRLF line terminators\"\n \"install.1443258662.zip\" has type \"Zip archive data, at least v2.0 to extract\"\n \"index.hta\" has type \"HTML document, ASCII text\"\n \"uninstall.hta\" has type \"HTML document, ASCII text\"\n \"OCComSDK.dll\" has type \"Unknown\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"UPX1\n .rsrc with unusual entropies 7.99986578446\n 7.01707792901","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file is packed with UPX","description":"Section name UPX0\n Section name UPX1","origin":"Static Parser","relevance":10,"id":"static-7","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\", Key: \"MACHINEGUID\")\n \"mshta.exe\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\", Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"\"POST /e?i=50 HTTP/1.1\nHost: i-50.b-000.xyz.bench.utorrent.com\nUser-Agent: Hydra HttpRequest\nConnection: close\nContent-Length: 186\" with no payload\n \"POST /e?i=50 HTTP/1.1\nHost: i-50.b-000.xyz.bench.utorrent.com\nUser-Agent: Hydra HttpRequest\nConnection: close\nContent-Length: 200\" with no payload\n \"POST /e?i=50 HTTP/1.1\nHost: i-50.b-000.xyz.bench.utorrent.com\nUser-Agent: Hydra HttpRequest\nConnection: close\nContent-Length: 212\" with no payload\n \"POST /e?i=50 HTTP/1.1\nHost: i-50.b-000.xyz.bench.utorrent.com\nUser-Agent: Hydra HttpRequest\nConnection: close\nContent-Length: 229\" with no payload","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"C:\\Users\\PSPUBWS\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\History\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\pspubws@localhost[1].txt\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"level":"suspicious","category":"Installation/Persistance","name":"The input sample dropped/contains a certificate file","description":"$24","origin":"Binary File","relevance":10,"id":"binary-12","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"level":"suspicious","category":"Network Related","name":"Found potential URL in binary/memory","description":"\"http://localhost:0/proxy/0/\"","origin":"File/Memory","relevance":2,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 54.243.238.29 on port 80 is sent without HTTP header\n TCP traffic to 67.215.238.66 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":10,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"Z:\\64d7da86d5fee292b2186c3f6ce59c88ed42725427c48a7d3384e4e5679b20b3\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\HYD4790.tmp\" for deletion\n \"Z:\\64d7da86d5fee292b2186c3f6ce59c88ed42725427c48a7d3384e4e5679b20b3\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\pspubws@localhost[1].txt\" for deletion\n \"Z:\\64d7da86d5fee292b2186c3f6ce59c88ed42725427c48a7d3384e4e5679b20b3\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\pspubws@localhost[2].txt\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Roaming\\uTorrent\\settings.dat\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Roaming\\uTorrent\\settings.dat.new\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\HYD4790.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\pspubws@localhost[1].txt\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\pspubws@localhost[2].txt\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"mshta.exe\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")\n \"mshta.exe\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"level":"suspicious","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"mshta.exe\" (Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\", Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"mshta.exe\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\", Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"LoadLibraryA\n GetProcAddress\n VirtualProtect\n VirtualAlloc","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"mshta.exe\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\", Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Queries/modifies the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"mshta.exe\" (Access type: \"QUERYVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"DISABLECACHINGOFSSLPAGES\")","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/57 Antivirus vendors marked sample as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"\" allocated 00000088 bytes of memory in \"mshta.exe\" (Protection: \"read/write\")","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a foreign process \"mshta.exe\" (PID: 00003892)\n \"\" wrote 52 bytes to a foreign process \"mshta.exe\" (PID: 00003892)\n \"\" wrote 4 bytes to a foreign process \"mshta.exe\" (PID: 00003892)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\" (Type: \"FileHandle\", Context: \"NtSetInformationFile\")","origin":"Touched Handle","relevance":5,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtSetInformationFile@NTDLL.DLL at 00988359-00001320-77C4228D-994064","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Entrypoint points to uncommon section","description":"UPX1","origin":"Static Parser","relevance":5,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"name":"Spyware/Leak","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 4 domains and 4 hosts"}],"sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":9,"imported_dlls_count":71,"dropped_files_count":0,"extracted_files_count":9,"files_written_count":43,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":9,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":4,"contacted_urls_count":3,"http_requests_count":3},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"560660700e316d3f114bb3b9","environment_id":1,"environment_description":"Windows 7 32 bit (EN)","state":"SUCCESS","verdict":"malicious","threat_score":90,"malware_family":"Application.OpenCandy","contacted_countries":["ISL","USA"],"submit_name":"uTorrent.exe","analysis_start_time":"2015-09-26T04:09:04+00:00","indicators_count":{"informative":11,"suspicious":23,"malicious":7},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"54.243.238.29","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"address":"67.215.238.66","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]}],"dns_resolutions":[{"domain":"download-lb.utorrent.com","address":"67.215.238.66","country":"United States","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"domain":"i-50.b-000.xyz.bench.utorrent.com","address":"54.243.238.29","country":"United States","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"domain":"router.utorrent.com","address":"82.221.103.244","country":"Iceland","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"domain":"router.bittorrent.com","address":"67.215.246.10","country":"United States","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]}],"http_requests":[{"host":"i-50.b-000.xyz.bench.utorrent.com","host_ip":"54.243.238.29:80","url":"/e?i=50","method":"POST","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"host":"","host_ip":"192.168.56.10:49241","url":"","method":"","response_code":"200","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"host":"download-lb.utorrent.com","host_ip":"67.215.238.66:80","url":"/endpoint/hydra-ut/os/win/track/stable/browser/firefox/os-region/US/os-lang/en/os-ver/6.1/enc-ver/109813873/","method":"GET","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}],"processes":[{"pid":1320,"ppid":0,"name":"64d7da86d5fee292b2186c3f6ce59c88ed42725427c48a7d3384e4e5679b20b3","command_line":"","normalized_path":"","uid":"00988359-00001320","icon":"$25"},{"pid":3892,"ppid":0,"name":"mshta.exe","command_line":"\"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\HYD4790.tmp.1443258662\\HTA\\index.hta?utorrent\" \"Z:\\64d7da86d5fee292b2186c3f6ce59c88ed42725427c48a7d3384e4e5679b20b3\" /LOG \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\HYD4790.tmp.1443258662\\index.hta.log\" /PID \"1320\" /CID \"-t0oY68VwpIzqzen\" /VERSION \"109813873\" /OS \"6.1\" /BROWSERS \"\\\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\\\",C:\\Program Files\\Internet Explorer\\iexplore.exe\" /ARCHITECTURE \"32\" /LANG \"en\" /USERNAME \"PSPUBWS\" /SID \"S-1-5-21-4162757579-3804539371-4239455898-1000\" /CLIENT \"utorrent\"","normalized_path":"","uid":"01008390-00003892"}],"all_imported_dlls":["USP10.dll","profapi.dll","ntdll.dll","USER32.dll","PROPSYS.dll","GDI32.dll","rsaenh.dll","msvcrt.dll","WINNSI.DLL","wship6.dll","rasadhlp.dll","bcryptprimitives.dll","SXS.DLL","msimtf.dll","CFGMGR32.dll","IMM32.DLL","LPK.dll","KERNELBASE.dll","urlmon.dll","PSAPI.DLL","CRYPT32.dll","sfc.dll","cryptbase.dll","NSI.dll","comctl32.dll","CRYPTBASE.dll","SHLWAPI.dll","uxtheme.dll","SspiCli.dll","MSIMG32.dll","USERENV.dll","IPHLPAPI.DLL","CLBCatQ.DLL","CRYPTSP.dll","OLEACC.DLL","gdiplus.dll","DNSAPI.dll","dhcpcsvc6.DLL","ncrypt.dll","dwmapi.dll","MSCTF.dll","RPCRT4.dll","ole32.dll","ieframe.dll","COMDLG32.dll","Secur32.dll","wshtcpip.dll","SHELL32.dll","iertutil.dll","WININET.dll","kernel32.dll","mshtml.dll","sechost.dll","OLEAUT32.dll","DEVOBJ.dll","WS2_32.dll","netprofm.dll","wintrust.dll","mswsock.dll","apphelp.dll","WINSTA.dll","SETUPAPI.dll","RpcRtRemote.dll","MSASN1.dll","VERSION.dll","WTSAPI32.dll","COMCTL32.dll","ADVAPI32.dll","jscript.dll","dhcpcsvc.DLL","ntmarta.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"index.hta","sha256":"61acd6e7405fad348433f8de4b12ed97b42caccbcf28fe0e4ba4b4a5d2ea707e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"name":"install.1443258662.zip","sha256":"15dcd9de5ac6314f4f0b7a798a1c2d20c5e49f9f4d87c1a88e6ef06b9c568468","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"name":"uninstall.hta","sha256":"e5a870dda2bca2b632f9aa3eee7768b5dd1498046d53af5fb6b5d5920debe27a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"name":"index.hta.log","sha256":"2b1d8f74b6b7ef3811b62e9320953577a736ed64ab9dd5c3e2390d994a10d234","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"name":"1f91d2d17ea675d4c2c3192e241743f9_e47c61d2-1dae-480e-827a-ae8d797649df","sha256":"3a31fd6db05b1778512363ae70a9baf954fde222952d5b790804ab8114c38b51","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"name":"pspubws@localhost[1].txt","sha256":"67e3b44a99f510f56665bb8261fbe2d841bfb45daf5914f83b315d2f75a14629","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"name":"pspubws@localhost[2].txt","sha256":"8fb56e8709a37ce8bfee268e8e07f647a347869e5d9b7f860df15213c16830e2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"name":"settings.dat.new","sha256":"d890df159dd880884eca2cf825940e9820a139df22ab324deedcfe14c2d6ed6f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"name":"64d7da86d5fee292b2186c3f6ce59c88ed42725427c48a7d3384e4e5679b20b3.crt","sha256":"02b74747c40b76f9b290d6ef4ed1daedd9d815c7522764a20e6053a75ac95e6f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"path":"%APPDATA%\\uTorrent\\webui.zip","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"path":"%WINDIR%\\system32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"path":"%APPDATA%\\uTorrent\\utorrent.lng","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"path":"%APPDATA%\\Microsoft\\Crypto","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000\\1f91d2d17ea675d4c2c3192e241743f9_e47c61d2-1dae-480e-827a-ae8d797649df","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"path":"%APPDATA%\\uTorrent","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"path":"%TEMP%\\HYD4790.tmp.1443258662","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"path":"%TEMP%\\HYD4790.tmp.1443258662\\index.hta.log","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"path":"%TEMP%\\HYD4790.tmp.1443258662\\HTA\\","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"path":"\\Device\\RasAcd","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"path":"%TEMP%\\HYD4790.tmp.1443258662\\HTA\\uninstall.hta","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"path":"%TEMP%\\HYD4790.tmp.1443258662\\HTA\\3rdparty","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"path":"%TEMP%\\HYD4790.tmp.1443258662\\HTA\\install.1443258662.zip","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"path":"%TEMP%\\HYD4790.tmp.1443258662\\HTA\\3rdparty\\OCComSDK.dll","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"path":"%TEMP%\\HYD4790.tmp.1443258662\\HTA\\index.hta","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"path":"MountPointManager","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"path":"%WINDIR%\\System32\\en-US\\mshta.exe.mui","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"path":"%WINDIR%\\System32\\mshta.exe","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"path":"%WINDIR%\\System32\\en\\mshta.exe.mui","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"path":"%TEMP%\\HYD4790.tmp.1443258662\\HTA\\styles\\common.css","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"key":"HKCU\\SOFTWARE\\CLASSES\\FALCONBETAACCOUNT\\","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"key":"HKCU\\SOFTWARE\\BITTORRENT\\UTORRENT\\","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"key":"HKCU\\SOFTWARE\\BITTORRENT\\","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]}]},"mutex_activity":{"mutex_created":[{"name":"Local\\64d7da86d5fee292b2186c3f6ce59c88ed42725427c48a7d3384e4e5679b20b3","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"name":"Local\\","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"560660700e316d3f114bb3b9"}]}]}},"report_ids":{"sandbox_job_ids":["560660700e316d3f114bb3b9"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious UTorrent.C potentially unwanted application Sample 64d7da86d5fe… — Score 90/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 64d7da86d5fe…. Malware family: UTorrent.C potentially unwanted application. Threat score 90/100. 4/27 AV engines flagged this file. 7 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/64d7da86d5fee292b2186c3f6ce59c88ed42725427c48a7d3384e4e5679b20b3"}],["$","meta","4",{"property":"og:title","content":"Malicious UTorrent.C potentially unwanted application Sample 64d7da86d5fe… — Score 90/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 64d7da86d5fe…. Malware family: UTorrent.C potentially unwanted application. Threat score 90/100. 4/27 AV engines flagged this file. 7 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/64d7da86d5fee292b2186c3f6ce59c88ed42725427c48a7d3384e4e5679b20b3"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious UTorrent.C potentially unwanted application Sample 64d7da86d5fe… — Score 90/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 64d7da86d5fe…. Malware family: UTorrent.C potentially unwanted application. Threat score 90/100. 4/27 AV engines flagged this file. 7 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L26","11",{}]]