PUA.Win32.OpenCandy.PAN

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Potentially Unwanted Application adds the following processes:

• %System%\mshta.exe "%User Temp%\HYDDF95.tmp.1566915823\HTA\index.hta?utorrent" "{malware file path and name}" /LOG "%User Temp%\HYDDF95.tmp.1566915823\index.hta.log" /PID "2960" /CID "uyAyx9Kz_FDLzqk7" /VERSION "110340173" /BUCKET "0" /SSB "1" /COUNTRY "US" /OS "6.1" /BROWSERS "\"%System Root%\Program Files\Mozilla Firefox\firefox.exe\",\"%Program Files%\Google\Chrome\Application\chrome.exe\",%System Root%\Program Files\Internet Explorer\iexplore.exe,\"%System Root%\Program Files\VMware\VMware Tools\VMwareHostOpen.exe\" --default http" /ARCHITECTURE "64" /LANG "en" /USERNAME "{username}" /SID "S-1-5-21-2407829820-1079796033-203259571-500" /CLIENT "utorrent"
• uTorrent.exe /NOINSTALL /BRINGTOFRONT
• "%System%\cscript.exe" "shell_scripts/check_if_cscript_is_working.js"
• cscript "shell_scripts/check_if_cscript_is_working.js"
• "%System%\PING.EXE" 8.8.8.8 -n 2 -w 500
• ping 8.8.8.8 -n 2 -w 500
• "%System%\cscript.exe" shell_scripts/shell_ping_after_close.js "http://i-50.{BLOCKED}0.XYZ.bench.utorrent.com/e?{random characters}"
• cscript shell_scripts/shell_ping_after_close.js "http://i-50.{BLOCKED}0.XYZ.bench.utorrent.com/e?{random characters}"
• "%Application Data%\uTorrent\updates\3.4.9_43085\utorrentie.exe" uTorrent_1916_00A90900_2053009238 \xc2\xb5Torrent4823DF041B09 uTorrent
• "%Application Data%\uTorrent\updates\3.4.9_43085\utorrentie.exe" uTorrent_1916_00A90900_111517766 \xc2\xb5Torrent4823DF041B09 uTorrent
• "%Application Data%\uTorrent\updates\3.4.9_43085\utorrentie.exe" uTorrent_1916_00A90608_1899840276 \xc2\xb5Torrent4823DF041B09 uTorrent

It creates the following folders:

• %User Temp%\HYDDF95.tmp.1566915823\HTA\styles
• %Application Data%\uTorrent\share
• %Application Data%\uTorrent\updates
• %User Temp%\HYDDF95.tmp.1566915823\HTA\i18n
• %Application Data%\uTorrent\apps
• %System Root%\Users
• %User Temp%\HYDDF95.tmp.1566915823\HTA\shell_scripts
• %Application Data%\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B
• %Application Data%\uTorrent\apps\72F0D3E2141065DACF6134D07A06A2DF20590748
• %User Temp%\HYDDF95.tmp.1566915823\HTA\scripts
• %User Temp%\HYDDF95.tmp.1566915823
• %Application Data%\uTorrent
• %Application Data%\uTorrent\updates\3.4.9_43085
• %User Profile%\AppData
• %Application Data%\uTorrent\dlimagecache
• %User Temp%\HYDDF95.tmp.1566915823\HTA
• %User Temp%\HYDDF95.tmp.1566915823\HTA\images

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name} on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Autostart Technique

This Potentially Unwanted Application adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
uTorrent = "%Application Data%\uTorrent\uTorrent.exe /MINIMIZED"

Other System Modifications

This Potentially Unwanted Application deletes the following files:

• %Application Data%\uTorrent\apps\plus.btapp.908.tmp
• %Application Data%\uTorrent\apps\featuredContent.btapp.908.tmp

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following registry entries:

HKEY_CURRENT_USER\Software\Classes\
FalconBetaAccount
remote_access_client_id = "7566089478"

HKEY_CURRENT_USER\Software\BitTorrent\
uTorrent
OfferProvider = ""

HKEY_CURRENT_USER\Software\BitTorrent\
uTorrent
OfferName = ""

HKEY_CURRENT_USER\Software\BitTorrent\
uTorrent
OfferAccepted = "0"

HKEY_CURRENT_USER\Software\BitTorrent\
uTorrent
OfferViaCAU = "0"

HKEY_CURRENT_USER\Software\BitTorrent
computerID = "3~-+\xbb 2\xc7\xd2\xb3\xfcP\xcb\xce\xa9;.g%\x8f\xe4\xf6\xc0^"

HKEY_CURRENT_USER\Software\Classes\
.torrent
(Default) = "uTorrent"

HKEY_CURRENT_USER\Software\Classes\
uTorrent\DefaultIcon
(Default) = "%Application Data%\uTorrent\maindoc.ico"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
explorer
GlobalAssocChangedCounter = "12"

HKEY_CURRENT_USER\Software\Classes\
.torrent
Content Type = "application/x-bittorrent"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
MIME\Database\Content Type\
application/x-bittorrent
Extension = ".torrent"

HKEY_CURRENT_USER\Software\Classes\
MIME\Database\Content Type\
application/x-bittorrent
Extension = ".torrent"

HKEY_CURRENT_USER\Software\Classes\
uTorrent\shell\open\
command
(Default) = "%Application Data%\uTorrent\uTorrent.exe %1 /SHELLASSOC"

HKEY_CURRENT_USER\Software\Classes\
uTorrent\shell
(Default) = "open"

HKEY_CURRENT_USER\Software\Classes\
uTorrent\Content Type
(Default) = "application/x-bittorrent"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
explorer
GlobalAssocChangedCounter = "13"

HKEY_CURRENT_USER\Software\Classes\
.torrent\OpenWithProgids
uTorrent = ""

HKEY_CURRENT_USER\Software\Classes\
Magnet
(Default) = "Magnet URI"

HKEY_CURRENT_USER\Software\Classes\
Magnet
URL Protocol = ""

HKEY_CURRENT_USER\Software\Classes\
Magnet
Content Type = "application/x-magnet"

HKEY_CURRENT_USER\Software\Classes\
Magnet\shell\open\
command
(Default) = "%Application Data%\uTorrent\uTorrent.exe %1 /SHELLASSOC"

HKEY_CURRENT_USER\Software\Classes\
Magnet\shell
(Default) = "open"

HKEY_CURRENT_USER\Software\Classes\
Magnet\DefaultIcon
(Default) = "%Application Data%\uTorrent\maindoc.ico"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
explorer
GlobalAssocChangedCounter = "16"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
explorer
GlobalAssocChangedCounter = "17"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
explorer
GlobalAssocChangedCounter = "18"

HKEY_CURRENT_USER\Software\Classes\
bittorrent
(Default) = "bittorrent URI"

HKEY_CURRENT_USER\Software\Classes\
bittorrent
URL Protocol = ""

HKEY_CURRENT_USER\Software\Classes\
bittorrent
Content Type = "application/x-bittorrent-protocol"

HKEY_CURRENT_USER\Software\Classes\
bittorrent\shell\open\
command
(Default) = "%Application Data%\uTorrent\uTorrent.exe %1 /SHELLASSOC"

HKEY_CURRENT_USER\Software\Classes\
bittorrent\shell
(Default) = "open"

HKEY_CURRENT_USER\Software\Classes\
bittorrent\DefaultIcon
(Default) = "%Application Data%\uTorrent\maindoc.ico"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
explorer
GlobalAssocChangedCounter = "19"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
explorer
GlobalAssocChangedCounter = "20"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
explorer
GlobalAssocChangedCounter = "21"

HKEY_CURRENT_USER\Software\Classes\
.btapp
(Default) = "uTorrent"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
explorer
GlobalAssocChangedCounter = "22"

HKEY_CURRENT_USER\Software\Classes\
.btapp
Content Type = "application/x-bittorrent-app"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
MIME\Database\Content Type\
application/x-bittorrent-app
Extension = ".btapp"

HKEY_CURRENT_USER\Software\Classes\
MIME\Database\Content Type\
application/x-bittorrent-app
Extension = ".btapp"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
explorer
GlobalAssocChangedCounter = "23"

HKEY_CURRENT_USER\Software\Classes\
.btskin
(Default) = "uTorrent"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
explorer
GlobalAssocChangedCounter = "24"

HKEY_CURRENT_USER\Software\Classes\
.btskin
Content Type = "application/x-bittorrent-skin"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
MIME\Database\Content Type\
application/x-bittorrent-skin
Extension = ".btskin"

HKEY_CURRENT_USER\Software\Classes\
MIME\Database\Content Type\
application/x-bittorrent-skin
Extension = ".btskin"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
explorer
GlobalAssocChangedCounter = "25"

HKEY_CURRENT_USER\Software\Classes\
.btinstall
(Default) = "uTorrent"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
explorer
GlobalAssocChangedCounter = "26"

HKEY_CURRENT_USER\Software\Classes\
.btinstall
Content Type = "application/x-bittorrent-appinst"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
MIME\Database\Content Type\
application/x-bittorrent-appinst
Extension = ".btinstall"

HKEY_CURRENT_USER\Software\Classes\
MIME\Database\Content Type\
application/x-bittorrent-appinst
Extension = ".btinstall"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
explorer
GlobalAssocChangedCounter = "27"

HKEY_CURRENT_USER\Software\Classes\
.btkey
(Default) = "uTorrent"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
explorer
GlobalAssocChangedCounter = "28"

HKEY_CURRENT_USER\Software\Classes\
.btkey
Content Type = "application/x-bittorrent-key"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
MIME\Database\Content Type\
application/x-bittorrent-key
Extension = ".btkey"

HKEY_CURRENT_USER\Software\Classes\
MIME\Database\Content Type\
application/x-bittorrent-key
Extension = ".btkey"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
explorer
GlobalAssocChangedCounter = "29"

HKEY_CURRENT_USER\Software\Classes\
.btsearch\OpenWithProgids
uTorrent = ""

HKEY_CURRENT_USER\Software\Classes\
Applications\uTorrent.exe\shell
(Default) = "open"

HKEY_CURRENT_USER\Software\Classes\
Applications\uTorrent.exe\shell\
open\command
(Default) = "%Application Data%\uTorrent\uTorrent.exe %1 /SHELLASSOC"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
uTorrent
DisplayIcon = "%Application Data%\uTorrent\uTorrent.exe,0"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
uTorrent
DisplayName = "\xc2\xb5Torrent"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
uTorrent
DisplayVersion = "3.4.9.43085"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
uTorrent
UninstallString = "%Application Data%\uTorrent\uTorrent.exe /UNINSTALL"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
uTorrent
InstallLocation = "%Application Data%\uTorrent"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
uTorrent
VersionMajor = "3"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
uTorrent
MajorVersion = "3"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
uTorrent
VersionMinor = "4"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
uTorrent
MinorVersion = "4"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
uTorrent
NoModify = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
uTorrent
NoRepair = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
uTorrent
URLInfoAbout = "http://www.{BLOCKED}nt.com"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
uTorrent
Publisher = "BitTorrent Inc."

HKEY_CURRENT_USER\Software\BitTorrent\
uTorrent
Revision = "43085"

Dropping Routine

This Potentially Unwanted Application drops the following files:

• %User Temp%\HYDDF95.tmp.1566915823\HTA\uninstall.hta
• %User Temp%\HYDDF95.tmp.1566915823\HTA\shell_scripts\shell_install_offer.js
• %User Temp%\HYDDF95.tmp.1566915823\HTA\styles\common.css
• %Desktop%\xc2\xb5Torrent.lnk
• %User Temp%\utt5FCD.tmp.new
• %Application Data%\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\x.png
• %Application Data%\uTorrent\toolbar.benc
• %User Temp%\HYDDF95.tmp.1566915823\HTA\scripts\common.js
• %Application Data%\uTorrent\updates\3.4.9_43085\utorrentie.exe
• %User Temp%\HYDDF95.tmp.1566915823\index.hta.log
• %User Temp%\HYDDF95.tmp.1566915823\HTA\i18n\fr.json
• %AppDataLocal%\GDIPFONTCACHEV1.DAT
• %Application Data%\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\main.css
• %Application Data%\uTorrent\apps\plus.btapp
• %Application Data%\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\info_icon.png
• %Application Data%\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\btapp
• %Application Data%\uTorrent\apps\featuredContent.btapp.new
• %Application Data%\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\remote\main.js
• %Application Data%\uTorrent\apps\welcome-upsell.btapp
• %Application Data%\Microsoft\Internet Explorer\Quick Launch\xc2\xb5Torrent.lnk
• %User Temp%\HYDDF95.tmp.1566915823\HTA\i18n\de.json
• %AppDataLocal%\Microsoft\Internet Explorer\MSIMGSIZ.DAT
• %User Temp%\HYDDF95.tmp.1566915823\HTA\scripts\install.js
• %Application Data%\uTorrent\settings.dat
• %User Temp%\HYDDF95.tmp.1566915823\HTA\i18n\br.json
• %User Temp%\HYDDF95.tmp.1566915823\HTA\i18n\en.json
• %Application Data%\uTorrent\toolbar_offer.benc
• %User Temp%\HYDDF95.tmp.1566915823\HTA\i18n\it.json
• %User Temp%\HYDDF95.tmp.1566915823\HTA\i18n\es.json
• %User Temp%\utt5FCD.tmp.old
• %User Temp%\HYDDF95.tmp.1566915823\HTA\images\loading.gif
• %Application Data%\uTorrent\apps\72F0D3E2141065DACF6134D07A06A2DF20590748\icon.bmp
• %User Temp%\HYDDF95.tmp.1566915823\HTA\images\bt_icon_48px.png
• %User Temp%\HYDDF95.tmp.1566915823\HTA\index.hta
• %Application Data%\uTorrent\apps\plus.btapp.new
• %User Temp%\HYDDF95.tmp.1566915823\HTA\shell_scripts\check_if_cscript_is_working.js
• %Start Menu%\xc2\xb5Torrent.lnk
• %Application Data%\uTorrent\utorrent.lng
• %Application Data%\uTorrent\uTorrent.exe
• %User Temp%\HYDDF95.tmp.1566915823\HTA\styles\installer.css
• %Application Data%\uTorrent\updates\3.4.9_43085.exe
• %Application Data%\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\vid_thumb.jpg
• %User Temp%\HYDDF95.tmp.1566915823\HTA\images\main_icon.png
• %Application Data%\uTorrent\settings.dat.new
• %Application Data%\uTorrent\apps\72F0D3E2141065DACF6134D07A06A2DF20590748\index.html
• %User Temp%\HYDDF95.tmp.1566915823\HTA\scripts\uninstall.js
• %Application Data%\uTorrent\apps\72F0D3E2141065DACF6134D07A06A2DF20590748\index.js
• %User Temp%\HYDDF95.tmp.1566915823\HTA\i18n\pt.json
• %Application Data%\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\index.html
• %User Temp%\HYDDF95.tmp.1566915823\HTA\i18n\ru.json
• %Application Data%\uTorrent\toolbar.benc.new
• %Application Data%\uTorrent\apps\featuredContent.btapp
• %Application Data%\uTorrent\settings.dat.old
• %User Temp%\HYDDF95.tmp.1566915823\HTA\images\main_bittorrent.ico
• %User Temp%\HYDDF95.tmp.1566915823\HTA\images\main_utorrent.ico
• %User Temp%\HYDDF95.tmp.1566915823\HTA\i18n\ko.json
• %User Temp%\HYDDF95.tmp.1566915823\HTA\shell_scripts\shell_ping_after_close.js
• %User Temp%\HYDDF95.tmp.1566915823\HTA\scripts\initialize.js
• %Application Data%\uTorrent\apps\72F0D3E2141065DACF6134D07A06A2DF20590748\main.css
• %User Temp%\HYDDF95.tmp.1566915823\HTA\scripts\es5-shim.js
• %User Temp%\HYDDF95.tmp.1566915823\HTA\install.1566915823.zip
• %Application Data%\uTorrent\toolbar.benc.old
• %Application Data%\uTorrent\maindoc.ico
• %Application Data%\uTorrent\apps\player.btapp
• %Application Data%\uTorrent\apps\72F0D3E2141065DACF6134D07A06A2DF20590748\btapp
• %Application Data%\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\empty_movie.gif
• %Application Data%\uTorrent\updates.dat

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\Desktop on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Start Menu% is the current user's Start Menu folder, which is usually C:\Windows\Start Menu or C:\Documents and Settings\{User name}\Start Menu on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Other Details

This Potentially Unwanted Application connects to the following possibly malicious URL:

• http://download-lb.{BLOCKED}nt.com/{random path}
• http://i-50.{BLOCKED}0.xyz.bench.utorrent.com/e?i=50
• http://i-21.{BLOCKED}5.ut.bench.utorrent.com/e?i=21
• http://update.{BLOCKED}nt.com/installstats.php?{random characters}
• http://update.{BLOCKED}nt.com/installoffer.php?{random characters}
• http://apps.{BLOCKED}rent.com/utorrent-onboarding/welcome-upsell.btapp
• http://utclient.{BLOCKED}nt.com/pro/{BLOCKED}nt/index.html
• http://apps.{BLOCKED}rent.com/utorrent-onboarding/player.btapp
• http://now.{BLOCKED}t.co/inclient
• http://{BLOCKED}nt.com/download/langpacks/dl.php?{random characters}
• http://apps.{BLOCKED}rent.com/utorrent-onboarding/player.btapp?{random characters}
• http://apps.{BLOCKED}rent.com/utorrent-onboarding/welcome-upsell.btapp?{random characters}
• http://www.{BLOCKED}nt.com/download/langpacks/dl.php?{random characters}
• http://www.{BLOCKED}nt.com/scripts/dl.php?{random characters}
• http://i-44.{BLOCKED}5.ut.bench.utorrent.com/e?i=44
• http://cdn.{BLOCKED}p.bittorrent.com/control/tags/ut.json
• http://i-29.{BLOCKED}5.ut.bench.utorrent.com/e?i=29
• http://i-32.{BLOCKED}5.ut.bench.utorrent.com/e?i=32
• http://i-49.{BLOCKED}5.ut.bench.utorrent.com/e?i=49
• http://i-38.{BLOCKED}5.ut.bench.utorrent.com/e?i=38
• http://cdn.{BLOCKED}ianetwork.com/network/start.html?langs=en
• http://cdn.{BLOCKED}p.bittorrent.com/control/feature/tags/ut.json
• http://i-43.{BLOCKED}5.ut.bench.utorrent.com/e?i=43
• http://cdn.{BLOCKED}ianetwork.com/assets/js/bench.js
• http://cdn.{BLOCKED}ianetwork.com/video/dist/util.js
• http://static.{BLOCKED}p.bittorrent.com/ados.js
• http://cdn.{BLOCKED}ianetwork.com/assets/js/base64.js
• http://ajax.{BLOCKED}apis.com/ajax/libs/jquery/1.11.2/jquery.min.js
• http://engine.{BLOCKED}ianetwork.com/ados?{random characters}
• http://engine.{BLOCKED}ianetwork.com/i.gif?{random characters}
• http://cdn.{BLOCKED}ianetwork.com/network/r.html?{random characters}
• http://cdn.{BLOCKED}ianetwork.com/network/5682.js
• http://rbbat.{BLOCKED}hers.tremorhub.com/pubsync?{random characters}
• http://ads.{BLOCKED}ic.com/AdServer/js/user_sync.html?{random characters}
• http://ssum.{BLOCKED}media.com/usermatchredir?{random characters}
• http://engine.{BLOCKED}ianetwork.com/udb/5682/sync/i.gif?{random characters}
• http://ads.{BLOCKED}ic.com/AdServer/js/showad.js
• http://{BLOCKED}nt.com/prodnews?{random characters}
• http://www.{BLOCKED}nt.com/prodnews?{random characters}
• http://router.{BLOCKED}rent.com
• http://router.{BLOCKED}nt.com
• http://update.{BLOCKED}rent.com
• http://video.{BLOCKED}v.com
• http://code.{BLOCKED}y.com
• http://i-1006.{BLOCKED}0.ad.bench.utorrent.com
• http://go.{BLOCKED}oft.com
• http://rbbat-7ozv6.{BLOCKED}s.tremorhub.com
• http://rbbat-1d10j.{BLOCKED}s.tremorhub.com
• http://rbbat-ptpi7.{BLOCKED}s.tremorhub.com
• http://vid.{BLOCKED}ic.com
• http://tag.{BLOCKED}x.io
• http://rbbat-u6nuf.{BLOCKED}s.tremorhub.com
• http://vast.{BLOCKED}t.com
• http://rbbat-exec5.{BLOCKED}s.tremorhub.com
• http://rbbat-3siic.{BLOCKED}s.tremorhub.com
• http://rbbat-qnqys.{BLOCKED}s.tremorhub.com
• http://rbbat-azc9n.{BLOCKED}s.tremorhub.com
• http://search.{BLOCKED}hange.com
• http://www9.{BLOCKED}dserver.com
• http://secure.{BLOCKED}s.com
• http://ads.{BLOCKED}adstv.com
• http://sshowads.{BLOCKED}ic.com
• http://image6.{BLOCKED}ic.com
• http://cdn.{BLOCKED}u.st
• http://i-666.{BLOCKED}0.ad.bench.utorrent.com
• http://aktrack.{BLOCKED}ic.com
• http://cm.{BLOCKED}g.doubleclick.net
• http://p.{BLOCKED}totic.com
• http://idsync.{BLOCKED}n.com
• http://sync.{BLOCKED}g.com
• http://ad.{BLOCKED}n.com
• http://match.{BLOCKED}r.org
• http://sync-tm.{BLOCKED}ttech.net
• http://ads.{BLOCKED}o.com
• http://pr-bh.{BLOCKED}p.yahoo.com
• http://ib.{BLOCKED}s.com
• http://pmp.{BLOCKED}t.net
• http://pixel-sync.{BLOCKED}out.com
• http://pixel.{BLOCKED}erve.com
• http://um.{BLOCKED}i.fi
• http://simage2.{BLOCKED}ic.com
• http://image2.{BLOCKED}ic.com
• http://vast.{BLOCKED}verify.com
• http://image4.{BLOCKED}ic.com
• http://{BLOCKED}o.com
• http://sdk.{BLOCKED}y-center.org
• http://cdn.{BLOCKED}zely.com
• http://fonts.{BLOCKED}apis.com
• http://www.{BLOCKED}t.co
• http://secure.{BLOCKED}erve.com
• http://sdk-gcp.{BLOCKED}y-center.org
• http://usermatch.{BLOCKED}d.net
• http://vpaid.{BLOCKED}verify.com
• http://www.{BLOCKED}-analytics.com
• http://fonts.{BLOCKED}c.com
• http://beacon.{BLOCKED}d.net
• http://svastx.{BLOCKED}s.com
• http://cdn.{BLOCKED}verify.com
• http://presentation-atl1.{BLOCKED}n.com
• http://s.{BLOCKED}n.net
• http://cdn-assets.{BLOCKED}rent.com
• http://stats.{BLOCKED}g.doubleclick.net
• http://www.{BLOCKED}tagmanager.com
• http://vast.{BLOCKED}protected.com
• http://cdn3.{BLOCKED}zely.com
• http://50136351.{BLOCKED}g.optimizely.com
• http://cdn3.{BLOCKED}verify.com
• http://tps.{BLOCKED}verify.com
• http://a-nj.{BLOCKED}x.io
• http://simage4.{BLOCKED}ic.com
• http://vpaid3.{BLOCKED}protected.com
• http://z.{BLOCKED}s.com
• http://vastpixel2.{BLOCKED}protected.com
• http://pixel.{BLOCKED}s.com
• http://a8230037.{BLOCKED}n.optimizely.com
• http://rules.{BLOCKED}ount.com
• http://ade.{BLOCKED}syndication.com
• http://static.{BLOCKED}itter.com
• http://connect.{BLOCKED}ok.net
• http://geo.{BLOCKED}s.com
• http://px.{BLOCKED}s.com
• http://analytics.{BLOCKED}r.com
• h{BLOCKED}t{BLOCKED}tp://{BLOCKED}t.co
• http://api.{BLOCKED}g.com
• http://www.{BLOCKED}g.com
• http://e.{BLOCKED}x.addthis.com
• http://www.{BLOCKED}ok.com
• http://stags.{BLOCKED}i.com
• http://logx.{BLOCKED}zely.com
• http://x.{BLOCKED}x.addthis.com
• http://tps11021.{BLOCKED}verify.com
• http://events.{BLOCKED}hub.com
• http://vtrk.{BLOCKED}verify.com
• {BLOCKED}.111.53
• {BLOCKED}14.107
• {BLOCKED}194.240
• {BLOCKED}238.160
• {BLOCKED}.191.76
• {BLOCKED}58.95
• {BLOCKED}.226.127
• {BLOCKED}179.99
• {BLOCKED}.211.106
• {BLOCKED}.73.91
• {BLOCKED}.7.209
• {BLOCKED}.108.255
• {BLOCKED}.138.48
• {BLOCKED}253.25
• {BLOCKED}.115.144
• {BLOCKED}225.192
• {BLOCKED}.53.82
• {BLOCKED}110.34
• {BLOCKED}.139.157
• {BLOCKED}91.55
• {BLOCKED}.5.227
• {BLOCKED}.170.45
• {BLOCKED}23.188
• {BLOCKED}13.157
• {BLOCKED}.45.97
• {BLOCKED}.53.63
• {BLOCKED}179.69
• {BLOCKED}.104.38
• {BLOCKED}.65.6
• {BLOCKED}.76.29
• {BLOCKED}30.68
• {BLOCKED}.168.130
• {BLOCKED}.240.198
• {BLOCKED}.46.121
• {BLOCKED}.215.85
• {BLOCKED}142.32
• {BLOCKED}.231.87
• {BLOCKED}250.124
• {BLOCKED}.125.26
• {BLOCKED}147.79
• {BLOCKED}.106.43
• {BLOCKED}.216.10
• {BLOCKED}193.177
• {BLOCKED}152.97
• {BLOCKED}.252.175
• {BLOCKED}174.84
• {BLOCKED}.62.55
• {BLOCKED}.124.68
• {BLOCKED}97.152
• {BLOCKED}125.26
• {BLOCKED}74.121
• {BLOCKED}68.145
• {BLOCKED}66.141
• {BLOCKED}8.212
• {BLOCKED}162.114
• {BLOCKED}.55.239
• {BLOCKED}124.237
• {BLOCKED}249.92
• {BLOCKED}.25.204
• {BLOCKED}.63.223
• {BLOCKED}.61.26
• {BLOCKED}.23.99
• {BLOCKED}.53.234
• {BLOCKED}.10.24
• {BLOCKED}1.6
• {BLOCKED}.48.52
• {BLOCKED}.105.29
• {BLOCKED}.104.49
• {BLOCKED}.93.79
• {BLOCKED}.63.91
• {BLOCKED}8.157.6
• {BLOCKED}3.104.250
• {BLOCKED}.94.165
• {BLOCKED}.201.91
• {BLOCKED}.34.141
• {BLOCKED}.201.80
• {BLOCKED}4.42.106
• {BLOCKED}7.78.30
• {BLOCKED}6.62.238
• {BLOCKED}7.102.226
• {BLOCKED}7.100.74
• {BLOCKED}7.40.151
• {BLOCKED}5.211.6
• {BLOCKED}.200.106
• {BLOCKED}.66.82
• {BLOCKED}.195.185
• {BLOCKED}5.163.200
• {BLOCKED}.50.123
• {BLOCKED}.222.81
• {BLOCKED}110.185
• {BLOCKED}2.22.144
• {BLOCKED}.116.213
• {BLOCKED}.235.86
• {BLOCKED}4.200.175
• {BLOCKED}2.204.10
• {BLOCKED}9.70.134
• {BLOCKED}.218.47
• {BLOCKED}2.214.164
• {BLOCKED}2.103.92
• {BLOCKED}8.31.237
• {BLOCKED}0.247.78
• {BLOCKED}9.58.95
• {BLOCKED}7.51.158
• {BLOCKED}.12.187
• {BLOCKED}47.156
• {BLOCKED}172.164
• {BLOCKED}181.138
• {BLOCKED}2.123.45
• {BLOCKED}1.139.158
• {BLOCKED}6.125.137
• {BLOCKED}6.124.145
• {BLOCKED}2.202.114
• {BLOCKED}.124.161
• {BLOCKED}.92.128
• {BLOCKED}.96.40
• {BLOCKED}3.39.162
• {BLOCKED}49.111
• {BLOCKED}126.212
• {BLOCKED}6.175.111
• {BLOCKED}3.180.105
• {BLOCKED}5.69.238
• {BLOCKED}.139.180
• {BLOCKED}.168.224
• {BLOCKED}7.149.26
• {BLOCKED}.234.161
• {BLOCKED}.192.148
• {BLOCKED}108.94

This report is generated via an automated analysis system.