URL:

http://ll.download3.utorrent.com/3.5.5/utorrent.45828.installer.exe?au=1&hash=23cf98c5f8782cdecb3c1bdb0c44fa3b49d1a640

Full analysis: https://app.any.run/tasks/c5bbfffa-f9f8-4659-b256-b7d35ecf65d7
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: November 20, 2020, 13:31:26
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
evasion
Indicators:
MD5:

B5A607AA2012C9256D08B85B2490584B

SHA1:

F3F7F19CE3B7E9364D8A3D6CC691321DAF80CC99

SHA256:

33CEB54975AB6E3A27809AAAC67914C3FD55889F1959A1A299A8F443F0CCF3FB

SSDEEP:

3:N1KSJLXJKLLDuRLKNLQLcWuRLM4yBXLNMiXWUZVjdsz6nTRV:CSJLXJhRLwLQLcWuRLMBXL9rjOcTz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Runs PING.EXE for delay simulation

      • mshta.exe (PID: 3044)

    • Application was dropped or rewritten from another process

      • utorrent.45828.installer.exe (PID: 3568)
      • offer-512A413C-0DC4-4606-99F7-36D1B8CD845B.exe (PID: 896)
      • uTorrent.exe (PID: 1004)
      • WebCompanionInstaller.exe (PID: 3948)
      • utorrentie.exe (PID: 2604)
      • utorrentie.exe (PID: 1056)
      • helper.exe (PID: 3976)
      • utorrentie.exe (PID: 3512)
      • WebCompanion.exe (PID: 3204)
      • Lavasoft.WCAssistant.WinService.exe (PID: 2948)
      • Ad-Aware Web Companion.exe (PID: 1856)

    • Changes the autorun value in the registry

      • mshta.exe (PID: 3044)
      • uTorrent.exe (PID: 1004)
      • WebCompanion.exe (PID: 3204)

    • Drops executable file immediately after starts

      • offer-512A413C-0DC4-4606-99F7-36D1B8CD845B.exe (PID: 896)

    • Changes settings of System certificates

      • WebCompanionInstaller.exe (PID: 3948)
      • WebCompanion.exe (PID: 3204)

    • Loads dropped or rewritten executable

      • WebCompanionInstaller.exe (PID: 3948)
      • WebCompanion.exe (PID: 3204)

    • Changes internet zones settings

      • WebCompanionInstaller.exe (PID: 3948)

    • Actions looks like stealing of personal data

      • WebCompanion.exe (PID: 3204)

    • Starts Visual C# compiler

      • WebCompanion.exe (PID: 3204)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 2640)
      • mshta.exe (PID: 3044)
      • cscript.exe (PID: 2608)
      • offer-512A413C-0DC4-4606-99F7-36D1B8CD845B.exe (PID: 896)
      • uTorrent.exe (PID: 1004)
      • WebCompanionInstaller.exe (PID: 3948)

    • Drops a file with a compile date too recent

      • chrome.exe (PID: 2332)
      • chrome.exe (PID: 2640)
      • mshta.exe (PID: 3044)
      • cscript.exe (PID: 2608)
      • offer-512A413C-0DC4-4606-99F7-36D1B8CD845B.exe (PID: 896)
      • uTorrent.exe (PID: 1004)
      • WebCompanionInstaller.exe (PID: 3948)

    • Starts MSHTA.EXE for opening HTA or HTMLS files

      • utorrent.45828.installer.exe (PID: 3568)

    • Creates files in the user directory

      • utorrent.45828.installer.exe (PID: 3568)
      • mshta.exe (PID: 3044)
      • uTorrent.exe (PID: 1004)
      • utorrentie.exe (PID: 2604)
      • WebCompanionInstaller.exe (PID: 3948)
      • WebCompanion.exe (PID: 3204)

    • Modifies the open verb of a shell class

      • mshta.exe (PID: 3044)
      • uTorrent.exe (PID: 1004)

    • Checks for external IP

      • mshta.exe (PID: 3044)

    • Executes scripts

      • mshta.exe (PID: 3044)

    • Creates a software uninstall entry

      • mshta.exe (PID: 3044)
      • WebCompanionInstaller.exe (PID: 3948)

    • Drops a file that was compiled in debug mode

      • offer-512A413C-0DC4-4606-99F7-36D1B8CD845B.exe (PID: 896)
      • uTorrent.exe (PID: 1004)
      • WebCompanionInstaller.exe (PID: 3948)

    • Cleans NTFS data-stream (Zone Identifier)

      • utorrent.45828.installer.exe (PID: 3568)

    • Adds / modifies Windows certificates

      • WebCompanionInstaller.exe (PID: 3948)
      • WebCompanion.exe (PID: 3204)

    • Creates files in the program directory

      • WebCompanionInstaller.exe (PID: 3948)
      • WebCompanion.exe (PID: 3204)
      • Lavasoft.WCAssistant.WinService.exe (PID: 2948)

    • Changes IE settings (feature browser emulation)

      • uTorrent.exe (PID: 1004)

    • Starts Internet Explorer

      • uTorrent.exe (PID: 1004)

    • Reads internet explorer settings

      • utorrentie.exe (PID: 2604)
      • utorrentie.exe (PID: 3512)
      • utorrentie.exe (PID: 1056)

    • Creates a directory in Program Files

      • WebCompanionInstaller.exe (PID: 3948)

    • Starts CMD.EXE for commands execution

      • WebCompanionInstaller.exe (PID: 3948)
      • Lavasoft.WCAssistant.WinService.exe (PID: 2948)

    • Starts SC.EXE for service management

      • WebCompanionInstaller.exe (PID: 3948)

    • Executed as Windows Service

      • Lavasoft.WCAssistant.WinService.exe (PID: 2948)

    • Creates files in the Windows directory

      • Lavasoft.WCAssistant.WinService.exe (PID: 2948)

    • Uses NETSH.EXE for network configuration

      • cmd.exe (PID: 3248)
      • cmd.exe (PID: 3616)

    • Removes files from Windows directory

      • Lavasoft.WCAssistant.WinService.exe (PID: 2948)

  • INFO

    • Reads the hosts file

      • chrome.exe (PID: 2640)
      • chrome.exe (PID: 2332)

    • Application launched itself

      • chrome.exe (PID: 2640)
      • iexplore.exe (PID: 1788)

    • Manual execution by user

      • utorrent.45828.installer.exe (PID: 3568)
      • explorer.exe (PID: 2696)
      • uTorrent.exe (PID: 1004)

    • Reads internet explorer settings

      • mshta.exe (PID: 3044)
      • iexplore.exe (PID: 2808)

    • Creates files in the user directory

      • iexplore.exe (PID: 2808)

    • Changes internet zones settings

      • iexplore.exe (PID: 1788)

    • Dropped object may contain Bitcoin addresses

      • WebCompanionInstaller.exe (PID: 3948)

    • Reads settings of System Certificates

      • WebCompanion.exe (PID: 3204)
      • iexplore.exe (PID: 2808)
      • iexplore.exe (PID: 1788)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
95
Monitored processes
42
Malicious processes
8
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs explorer.exe no specs chrome.exe no specs utorrent.45828.installer.exe mshta.exe cscript.exe no specs ping.exe no specs cscript.exe cscript.exe cscript.exe cscript.exe offer-512a413c-0dc4-4606-99f7-36d1b8cd845b.exe webcompanioninstaller.exe chrome.exe no specs utorrent.exe utorrentie.exe utorrentie.exe iexplore.exe utorrentie.exe iexplore.exe helper.exe sc.exe no specs sc.exe no specs sc.exe no specs cmd.exe no specs netsh.exe no specs webcompanion.exe lavasoft.wcassistant.winservice.exe cmd.exe no specs csc.exe no specs netsh.exe no specs cvtres.exe no specs csc.exe no specs cvtres.exe no specs ad-aware web companion.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
272"sc.exe" description "WCAssistantService" "Ad-Aware Web Companion Internet security service"C:\Windows\system32\sc.exe—WebCompanionInstaller.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\apphelp.dll
332netsh http add urlacl url=http://+:9007/ user=EveryoneC:\Windows\system32\netsh.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
896"C:\Users\admin\AppData\Local\Temp\offer-512A413C-0DC4-4606-99F7-36D1B8CD845B.exe" --silent --partner=BT170902 --homepage=1 --search=1C:\Users\admin\AppData\Local\Temp\offer-512A413C-0DC4-4606-99F7-36D1B8CD845B.exe
cscript.exe
User:
admin
Company:
Lavasoft
Integrity Level:
HIGH
Description:
Web Companion Installer
Exit code:
0
Version:
6.0.2270.4122
Modules
Images
c:\users\admin\appdata\local\temp\offer-512a413c-0dc4-4606-99f7-36d1b8cd845b.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1004"C:\Users\admin\AppData\Roaming\uTorrent\uTorrent.exe" C:\Users\admin\AppData\Roaming\uTorrent\uTorrent.exe
explorer.exe
User:
admin
Company:
BitTorrent Inc.
Integrity Level:
MEDIUM
Description:
µTorrent
Exit code:
0
Version:
3.5.5.45828
Modules
Images
c:\users\admin\appdata\roaming\utorrent\utorrent.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
1020C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RESD4E9.tmp" "c:\Users\admin\AppData\Local\Temp\CSCD4E8.tmp"C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
8.00.50727.4940 (Win7SP1.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\cvtres.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\apphelp.dll
1056"C:\Users\admin\AppData\Roaming\uTorrent\updates\3.5.5_45828\utorrentie.exe" uTorrent_1004_02D08158_1735694577 µTorrent4823DF041B09 uTorrentC:\Users\admin\AppData\Roaming\uTorrent\updates\3.5.5_45828\utorrentie.exe
uTorrent.exe
User:
admin
Company:
BitTorrent Inc.
Integrity Level:
LOW
Description:
WebHelper
Exit code:
0
Version:
1.0.0
Modules
Images
c:\users\admin\appdata\roaming\utorrent\updates\3.5.5_45828\utorrentie.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1144C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RESD845.tmp" "c:\Users\admin\AppData\Local\Temp\CSCD844.tmp"C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
8.00.50727.4940 (Win7SP1.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\cvtres.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\apphelp.dll
1344"C:\Windows\System32\PING.EXE" 8.8.8.8 -n 2 -w 500C:\Windows\System32\PING.EXE—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
1404"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\t-kgghql.cmdline"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe—WebCompanion.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
8.0.50727.4927 (NetFXspW7.050727-4900)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\csc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1600"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1056,6672242245797468733,4914989847777328450,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgACAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=8621446483389026778 --mojo-platform-channel-handle=1076 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
Total events
3 974
Read events
3 455
Write events
515
Delete events
4

Modification events

(PID) Process:(2640) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(2640) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(2640) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(2640) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(2180) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:writeName:2640-13250352701543375
Value:
259
(PID) Process:(2640) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(2640) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(2640) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(2640) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:3252-13245750958665039
Value:
0
(PID) Process:(2640) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
Executable files
90
Suspicious files
113
Text files
364
Unknown types
55

Dropped files

PID
Process
Filename
Type
2640chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-5FB7C53E-A50.pma —
MD5:—
SHA256:—
2640chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\0b96cd3d-4570-42af-950c-3b2c9dc2e06c.tmp —
MD5:—
SHA256:—
2640chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000048.dbtmp —
MD5:—
SHA256:—
2640chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.oldtext
MD5:—
SHA256:—
2640chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.oldtext
MD5:—
SHA256:—
2640chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RF1541d5.TMPtext
MD5:—
SHA256:—
2640chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.oldtext
MD5:—
SHA256:—
2640chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old~RF1541f4.TMPtext
MD5:—
SHA256:—
2640chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old —
MD5:—
SHA256:—
2640chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old~RF1543aa.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
144
TCP/UDP connections
311
DNS requests
88
Threats
45

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3568
utorrent.45828.installer.exe
GET
—
98.143.146.7:80
http://utorrent.com/download/langpacks/dl.php?build=45828&ref=client&client=utorrent&sys_l=en&sel_l=-1&tk=stable34
US
—
—
whitelisted
1004
uTorrent.exe
GET
—
178.79.242.19:80
http://apps.bittorrent.com/utorrent-onboarding/player.btapp
DE
—
—
whitelisted
2332
chrome.exe
GET
200
178.79.242.19:80
http://ll.download3.utorrent.com/3.5.5/utorrent.45828.installer.exe?au=1&hash=23cf98c5f8782cdecb3c1bdb0c44fa3b49d1a640
DE
executable
2.04 Mb
whitelisted
2608
cscript.exe
GET
200
104.17.178.102:80
http://webcompanion.com/nano_download.php?partner=BT170902
US
executable
500 Kb
malicious
3568
utorrent.45828.installer.exe
POST
200
23.21.43.186:80
http://i-50.b-000.xyz.bench.utorrent.com/e?i=50
US
text
21 b
whitelisted
3568
utorrent.45828.installer.exe
POST
200
54.225.194.96:80
http://i-50.b-000.xyz.bench.utorrent.com/e?i=50
US
text
21 b
whitelisted
1004
uTorrent.exe
POST
200
54.225.194.96:80
http://i-21.b-45828.ut.bench.utorrent.com/e?i=21
US
text
21 b
suspicious
3568
utorrent.45828.installer.exe
GET
301
178.79.242.16:80
http://www.utorrent.com/download/langpacks/dl.php?build=45828&ref=client&client=utorrent&sys_l=en&sel_l=-1&tk=stable34
DE
html
184 b
whitelisted
3568
utorrent.45828.installer.exe
POST
200
54.243.113.215:80
http://i-50.b-000.xyz.bench.utorrent.com/e?i=50
US
text
21 b
whitelisted
3568
utorrent.45828.installer.exe
POST
200
54.243.113.215:80
http://i-50.b-000.xyz.bench.utorrent.com/e?i=50
US
text
21 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2332
chrome.exe
172.217.23.163:443
ssl.gstatic.com
Google Inc.
US
whitelisted
—
—
23.21.43.186:80
i-50.b-000.xyz.bench.utorrent.com
Amazon.com, Inc.
US
malicious
—
—
54.243.113.215:80
i-50.b-000.xyz.bench.utorrent.com
Amazon.com, Inc.
US
suspicious
3568
utorrent.45828.installer.exe
67.215.238.66:80
download-lb.utorrent.com
QuadraNet, Inc
US
suspicious
3568
utorrent.45828.installer.exe
23.23.85.1:80
i-50.b-000.xyz.bench.utorrent.com
Amazon.com, Inc.
US
whitelisted
2332
chrome.exe
178.79.242.147:80
ll.download3.utorrent.com
Limelight Networks, Inc.
DE
suspicious
3568
utorrent.45828.installer.exe
54.243.113.215:80
i-50.b-000.xyz.bench.utorrent.com
Amazon.com, Inc.
US
suspicious
2800
cscript.exe
54.243.113.215:80
i-50.b-000.xyz.bench.utorrent.com
Amazon.com, Inc.
US
suspicious
3044
mshta.exe
208.95.112.1:80
ip-api.com
IBURST
—
malicious
2568
cscript.exe
54.243.113.215:80
i-50.b-000.xyz.bench.utorrent.com
Amazon.com, Inc.
US
suspicious

DNS requests

Domain
IP
Reputation
ll.download3.utorrent.com
  • 178.79.242.147
  • 178.79.242.19
whitelisted
accounts.google.com
  • 216.58.205.237
shared
sb-ssl.google.com
  • 216.58.207.78
whitelisted
ssl.gstatic.com
  • 172.217.23.163
whitelisted
router.bittorrent.com
  • 67.215.246.10
shared
router.utorrent.com
  • 82.221.103.244
whitelisted
i-50.b-000.xyz.bench.utorrent.com
  • 54.243.113.215
  • 23.23.85.1
  • 23.23.215.82
  • 107.22.221.32
  • 54.235.208.27
  • 23.21.43.186
  • 50.17.220.153
  • 174.129.255.167
  • 54.197.251.114
  • 54.225.194.96
  • 107.20.217.71
  • 23.21.139.158
whitelisted
download-lb.utorrent.com
  • 67.215.238.66
whitelisted
ip-api.com
  • 208.95.112.1
malicious
utorrent.com
  • 98.143.146.7
whitelisted

Threats

PID
Process
Class
Message
2332
chrome.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3568
utorrent.45828.installer.exe
Misc activity
APP [PTsecurity] uTorrent Hydra Client
3568
utorrent.45828.installer.exe
Misc activity
APP [PTsecurity] P2P uTorrent Hydra Client
3568
utorrent.45828.installer.exe
Misc activity
APP [PTsecurity] uTorrent Hydra Client
3568
utorrent.45828.installer.exe
Misc activity
APP [PTsecurity] uTorrent Hydra Client
3568
utorrent.45828.installer.exe
Misc activity
APP [PTsecurity] P2P uTorrent Hydra Client
3568
utorrent.45828.installer.exe
Misc activity
APP [PTsecurity] uTorrent Hydra Client
3568
utorrent.45828.installer.exe
Misc activity
APP [PTsecurity] uTorrent Hydra Client
3568
utorrent.45828.installer.exe
Misc activity
APP [PTsecurity] P2P uTorrent Hydra Client
3568
utorrent.45828.installer.exe
Misc activity
APP [PTsecurity] uTorrent Hydra Client
11 ETPRO signatures available at the full report
Process
Message
WebCompanionInstaller.exe
Detecting windows culture
WebCompanionInstaller.exe
11/20/2020 1:32:29 PM :-> Starting installer 6.0.2270.4122 with: .\WebCompanionInstaller.exe --partner=BT170902 --version=6.0.2270.4122 --prod --silent --partner=BT170902 --homepage=1 --search=1, Run as admin: True
WebCompanionInstaller.exe
Preparing for installing Web Companion
WebCompanionInstaller.exe
11/20/2020 1:32:30 PM :-> Generating Machine and Install Id ...
WebCompanionInstaller.exe
11/20/2020 1:32:30 PM :-> Machine Id and Install Id has been generated
WebCompanionInstaller.exe
11/20/2020 1:32:31 PM :-> Checking prerequisites ...
WebCompanionInstaller.exe
11/20/2020 1:32:35 PM :-> Antivirus not detected
WebCompanionInstaller.exe
11/20/2020 1:32:40 PM :-> vm_check False
WebCompanionInstaller.exe
11/20/2020 1:32:41 PM :-> reg_check :False
WebCompanionInstaller.exe
11/20/2020 1:32:46 PM :-> Installed .Net framework is V40
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://ll.download3.utorrent.com/3.5.5/utorrent.45828.installer.exe?au=1&hash=23cf98c5f8782cdecb3c1bdb0c44fa3b49d1a640