File name:

comet_installer_latest.exe

Full analysis: https://app.any.run/tasks/47112c24-6f9e-42e4-bc77-8284340e4254
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: July 17, 2025, 17:23:58
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

F85561F3E0F52CD1FC71757FCE6B1BA0

SHA1:

42343E47A3B23C2B9D7DEDB52E8F1C46FAD8C2AB

SHA256:

4F3061B39B6BAC255D19B3B3C8FAED3F58852B147AF0E76CC1DD004FC473E736

SSDEEP:

98304:Ev9DcqaBg7Pn9D/dAi7buBMJIoDB1M5bwDphFkIEaswTQ4iYAQnKXDwBbWcKE5/G:6B+FHuH8F+V9f+WLUZ83UCiVP99Frp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • comet.exe (PID: 4084)

    • Steals credentials from Web Browsers

      • comet.exe (PID: 4084)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • comet_installer_latest.exe (PID: 3788)
      • comet_installer.exe (PID: 4748)
      • mini_installer.exe (PID: 6016)
      • setup.exe (PID: 1244)

    • The process drops C-runtime libraries

      • comet_installer_latest.exe (PID: 3788)

    • Process drops legitimate windows executable

      • comet_installer_latest.exe (PID: 3788)

    • Starts POWERSHELL.EXE for commands execution

      • comet_installer.exe (PID: 4748)

    • There is functionality for taking screenshot (YARA)

      • crashpad_handler.exe (PID: 7124)

    • Application launched itself

      • setup.exe (PID: 1244)
      • setup.exe (PID: 5644)
      • comet.exe (PID: 4084)
      • comet.exe (PID: 5744)

    • Searches for installed software

      • setup.exe (PID: 1244)

    • Reads security settings of Internet Explorer

      • setup.exe (PID: 5644)
      • comet.exe (PID: 4084)

    • Reads the date of Windows installation

      • setup.exe (PID: 5644)

    • Creates a software uninstall entry

      • setup.exe (PID: 1244)

    • Starts CMD.EXE for commands execution

      • comet_installer.exe (PID: 4748)

    • The executable file from the user directory is run by the CMD process

      • comet.exe (PID: 4084)

    • Reads Mozilla Firefox installation path

      • comet.exe (PID: 4084)

    • The process checks if it is being run in the virtual environment

      • comet.exe (PID: 4084)

  • INFO

    • Create files in a temporary directory

      • comet_installer_latest.exe (PID: 3788)
      • comet_installer.exe (PID: 4748)
      • crashpad_handler.exe (PID: 7124)
      • comet.exe (PID: 4084)

    • Checks supported languages

      • comet_installer_latest.exe (PID: 3788)
      • comet_installer.exe (PID: 4748)
      • crashpad_handler.exe (PID: 7124)
      • mini_installer.exe (PID: 6016)
      • setup.exe (PID: 1964)
      • setup.exe (PID: 4580)
      • setup.exe (PID: 1244)
      • setup.exe (PID: 5644)
      • comet.exe (PID: 4084)
      • comet.exe (PID: 4024)
      • comet.exe (PID: 5744)
      • comet.exe (PID: 6840)
      • comet.exe (PID: 4476)
      • comet.exe (PID: 6412)
      • comet.exe (PID: 1612)
      • comet.exe (PID: 4080)
      • comet.exe (PID: 7008)
      • comet.exe (PID: 4124)
      • comet.exe (PID: 1800)
      • comet.exe (PID: 6940)
      • comet.exe (PID: 1336)
      • comet.exe (PID: 5620)
      • comet.exe (PID: 1136)
      • comet.exe (PID: 4724)
      • comet.exe (PID: 3480)
      • comet.exe (PID: 7140)
      • comet.exe (PID: 3960)
      • comet.exe (PID: 2216)
      • comet.exe (PID: 2388)
      • comet.exe (PID: 3108)
      • comet.exe (PID: 1508)
      • comet.exe (PID: 1156)

    • Reads the computer name

      • comet_installer.exe (PID: 4748)
      • mini_installer.exe (PID: 6016)
      • setup.exe (PID: 1244)
      • setup.exe (PID: 5644)
      • comet.exe (PID: 4084)
      • comet.exe (PID: 4476)
      • comet.exe (PID: 4024)
      • comet.exe (PID: 5744)
      • comet.exe (PID: 4080)
      • comet.exe (PID: 4124)

    • The sample compiled with english language support

      • comet_installer_latest.exe (PID: 3788)
      • mini_installer.exe (PID: 6016)
      • setup.exe (PID: 1244)

    • Checks proxy server information

      • comet_installer.exe (PID: 4748)
      • comet.exe (PID: 4084)

    • Reads Environment values

      • comet_installer.exe (PID: 4748)

    • Creates files or folders in the user directory

      • setup.exe (PID: 1964)
      • setup.exe (PID: 1244)
      • setup.exe (PID: 5644)
      • comet.exe (PID: 4084)
      • comet_installer.exe (PID: 4748)
      • comet.exe (PID: 4024)

    • Process checks computer location settings

      • comet.exe (PID: 4084)
      • comet.exe (PID: 1800)
      • comet.exe (PID: 1612)
      • comet.exe (PID: 6940)
      • comet.exe (PID: 2388)
      • comet.exe (PID: 3108)
      • comet.exe (PID: 1508)
      • comet.exe (PID: 1156)

    • Reads CPU info

      • comet.exe (PID: 4084)

    • Reads the machine GUID from the registry

      • comet.exe (PID: 4084)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:03:08 23:05:20+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 27136
InitializedDataSize: 184832
UninitializedDataSize: 2048
EntryPoint: 0x358d
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
177
Monitored processes
40
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start comet_installer_latest.exe comet_installer.exe crashpad_handler.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs mini_installer.exe setup.exe setup.exe no specs setup.exe no specs setup.exe no specs cmd.exe no specs conhost.exe no specs comet.exe comet.exe no specs comet.exe no specs slui.exe no specs comet.exe no specs comet.exe comet.exe no specs comet.exe no specs comet.exe no specs comet.exe no specs comet.exe no specs comet.exe no specs comet.exe no specs comet.exe no specs comet.exe no specs comet.exe no specs comet.exe no specs comet.exe no specs comet.exe no specs comet.exe no specs comet.exe no specs comet.exe no specs comet.exe no specs comet.exe no specs comet.exe no specs comet.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1136"C:\Users\admin\AppData\Local\Perplexity\Comet\Application\comet.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --field-trial-handle=2036,i,3880769497176697771,13055885081075587920,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8C:\Users\admin\AppData\Local\Perplexity\Comet\Application\comet.exe—comet.exe
User:
admin
Company:
The Perplexity Authors
Integrity Level:
LOW
Description:
Comet
Exit code:
0
Version:
137.2.7151.8097
Modules
Images
c:\users\admin\appdata\local\perplexity\comet\application\comet.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\perplexity\comet\application\137.2.7151.8097\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1156"C:\Users\admin\AppData\Local\Perplexity\Comet\Application\comet.exe" --type=renderer --perplexity-backend-url=https://www.perplexity.ai/ --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=2036,i,3880769497176697771,13055885081075587920,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:1C:\Users\admin\AppData\Local\Perplexity\Comet\Application\comet.exe—comet.exe
User:
admin
Company:
The Perplexity Authors
Integrity Level:
LOW
Description:
Comet
Version:
137.2.7151.8097
Modules
Images
c:\users\admin\appdata\local\perplexity\comet\application\comet.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\perplexity\comet\application\137.2.7151.8097\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1244"C:\Users\admin\Downloads\CR_764D8.tmp\setup.exe" --install-archive="C:\Users\admin\Downloads\CR_764D8.tmp\CHROME.PACKED.7Z" --do-not-launch-chromeC:\Users\admin\Downloads\CR_764D8.tmp\setup.exe
mini_installer.exe
User:
admin
Company:
The Perplexity Authors
Integrity Level:
MEDIUM
Description:
Comet Installer
Exit code:
0
Version:
137.2.7151.8097
Modules
Images
c:\users\admin\downloads\cr_764d8.tmp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1336"C:\Users\admin\AppData\Local\Perplexity\Comet\Application\comet.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --field-trial-handle=2036,i,3880769497176697771,13055885081075587920,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8C:\Users\admin\AppData\Local\Perplexity\Comet\Application\comet.exe—comet.exe
User:
admin
Company:
The Perplexity Authors
Integrity Level:
LOW
Description:
Comet
Exit code:
0
Version:
137.2.7151.8097
Modules
Images
c:\users\admin\appdata\local\perplexity\comet\application\comet.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\perplexity\comet\application\137.2.7151.8097\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1508"C:\Users\admin\AppData\Local\Perplexity\Comet\Application\comet.exe" --type=renderer --perplexity-backend-url=https://www.perplexity.ai/ --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=2036,i,3880769497176697771,13055885081075587920,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:1C:\Users\admin\AppData\Local\Perplexity\Comet\Application\comet.exe—comet.exe
User:
admin
Company:
The Perplexity Authors
Integrity Level:
LOW
Description:
Comet
Exit code:
0
Version:
137.2.7151.8097
Modules
Images
c:\users\admin\appdata\local\perplexity\comet\application\comet.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\perplexity\comet\application\137.2.7151.8097\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1612"C:\Users\admin\AppData\Local\Perplexity\Comet\Application\comet.exe" --type=renderer --extension-process --perplexity-backend-url=https://www.perplexity.ai/ --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=2036,i,3880769497176697771,13055885081075587920,262144 --variations-seed-version --mojo-platform-channel-handle=3920 /prefetch:2C:\Users\admin\AppData\Local\Perplexity\Comet\Application\comet.exe—comet.exe
User:
admin
Company:
The Perplexity Authors
Integrity Level:
LOW
Description:
Comet
Version:
137.2.7151.8097
Modules
Images
c:\users\admin\appdata\local\perplexity\comet\application\comet.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\perplexity\comet\application\137.2.7151.8097\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1660\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1800"C:\Users\admin\AppData\Local\Perplexity\Comet\Application\comet.exe" --type=renderer --perplexity-backend-url=https://www.perplexity.ai/ --force-high-res-timeticks=disabled --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2036,i,3880769497176697771,13055885081075587920,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:1C:\Users\admin\AppData\Local\Perplexity\Comet\Application\comet.exe—comet.exe
User:
admin
Company:
The Perplexity Authors
Integrity Level:
LOW
Description:
Comet
Version:
137.2.7151.8097
Modules
Images
c:\users\admin\appdata\local\perplexity\comet\application\comet.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\perplexity\comet\application\137.2.7151.8097\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1828\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1964C:\Users\admin\Downloads\CR_764D8.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Perplexity\Comet\User Data\Crashpad" --url=https://o4504136533147648.ingest.us.sentry.io/api/4508489400123392/minidump/?sentry_key=6862c0f9ce7db97a4682a9a4f269e0bd --annotation=plat=Win64 --annotation=prod=Comet --annotation=ver=137.2.7151.8097 --initial-client-data=0x29c,0x2a0,0x2a4,0x278,0x2a8,0x7ff77e751db8,0x7ff77e751dc4,0x7ff77e751dd0C:\Users\admin\Downloads\CR_764D8.tmp\setup.exe—setup.exe
User:
admin
Company:
The Perplexity Authors
Integrity Level:
MEDIUM
Description:
Comet Installer
Exit code:
0
Version:
137.2.7151.8097
Modules
Images
c:\users\admin\downloads\cr_764d8.tmp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
17 010
Read events
16 883
Write events
127
Delete events
0

Modification events

(PID) Process:(4748) comet_installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Windows Error Reporting\RuntimeExceptionHelperModules
Operation:writeName:C:\Users\admin\AppData\Local\Temp\CometInstaller\crashpad_wer.dll
Value:
1
(PID) Process:(1244) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Comet
Operation:writeName:InstallerProgress
Value:
19
(PID) Process:(1244) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Comet
Operation:writeName:InstallerProgress
Value:
25
(PID) Process:(1244) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Comet
Operation:writeName:InstallerProgress
Value:
39
(PID) Process:(1244) setup.exeKey:HKEY_CLASSES_ROOT\CLSID\{7ADFC10A-CB1B-4D95-A6D2-143E62F40889}\LocalServer32
Operation:writeName:ServerExecutable
Value:
C:\Users\admin\AppData\Local\Perplexity\Comet\Application\137.2.7151.8097\notification_helper.exe
(PID) Process:(1244) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Windows Error Reporting\RuntimeExceptionHelperModules
Operation:writeName:C:\Users\admin\AppData\Local\Perplexity\Comet\Application\137.2.7151.8097\chrome_wer.dll
Value:
0
(PID) Process:(1244) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Comet
Operation:writeName:DowngradeCleanupCommand
Value:
"C:\Users\admin\AppData\Local\Perplexity\Comet\Application\137.2.7151.8097\Installer\setup.exe" --cleanup-for-downgrade-version=$1 --cleanup-for-downgrade-operation=$2
(PID) Process:(1244) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Comet
Operation:writeName:CleanInstallRequiredForVersionBelow
Value:
85.0.4169.0
(PID) Process:(1244) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Comet
Operation:writeName:InstallerProgress
Value:
66
(PID) Process:(1244) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Comet
Operation:writeName:InstallerProgress
Value:
73
Executable files
18
Suspicious files
96
Text files
73
Unknown types
49

Dropped files

PID
Process
Filename
Type
3788comet_installer_latest.exeC:\Users\admin\AppData\Local\Temp\CometInstaller\data\app.so —
MD5:—
SHA256:—
3788comet_installer_latest.exeC:\Users\admin\AppData\Local\Temp\CometInstaller\crashpad_wer.dllexecutable
MD5:A1F57DFCE2E07965F8FCC150E145FED9
SHA256:BA7578F74FE92B447DEEA3A25719EAE16D261029E8186BE4F5D0FE9E371476CF
3788comet_installer_latest.exeC:\Users\admin\AppData\Local\Temp\CometInstaller\flutter_localization_plugin.dllexecutable
MD5:ADFED6F25D2997F79225DE1150DE645A
SHA256:F481D72B4F858F3F29F92335580B2C892EEF6EAE6C3A3FC7F2094E479B45218F
3788comet_installer_latest.exeC:\Users\admin\AppData\Local\Temp\CometInstaller\msvcp140.dllexecutable
MD5:F3FF13F1E83AFEC41BCA6140030032C8
SHA256:92B315040C9CDB42492C8BF19339F95B758DABBA6E492263CC00231A4C161F29
3788comet_installer_latest.exeC:\Users\admin\AppData\Local\Temp\CometInstaller\flutter_windows.dllexecutable
MD5:9ADDDC66C11CA7D771AFEF7E33DB314C
SHA256:BA9B8434BF8DEACE3EACD41138C86587823439F3EBE495229F42B4BD6E1A209C
3788comet_installer_latest.exeC:\Users\admin\AppData\Local\Temp\CometInstaller\sentry.dllexecutable
MD5:9E7E428224F80831531D23E5FD610B59
SHA256:46BDA2266B104406802BB4991BB2411D8A895D0D06760F42AB0235E11D213015
3788comet_installer_latest.exeC:\Users\admin\AppData\Local\Temp\CometInstaller\window_manager_plugin.dllexecutable
MD5:58105457FB2E2CBD02FF2EB7D6A0C315
SHA256:2BC6BB00599C4CAC15D908DB644CA179E5F77A54B1DC715D081587CD6BD25283
3788comet_installer_latest.exeC:\Users\admin\AppData\Local\Temp\CometInstaller\data\flutter_assets\AssetManifest.binbinary
MD5:FF160984C7870BACFACC60D5F04D32D6
SHA256:F5F212282B564BCB48DFAD27444BB4BA1FF441A8F11B110DE5D1846652273958
3788comet_installer_latest.exeC:\Users\admin\AppData\Local\Temp\CometInstaller\url_launcher_windows_plugin.dllexecutable
MD5:BE30F1D00BD1A1A94F33E6C7069D73A6
SHA256:C46D13F53A2AEE9D87E5397E9C7509A1ED1828E68FB5BE1ADBBBA4A3F52D8051
3788comet_installer_latest.exeC:\Users\admin\AppData\Local\Temp\CometInstaller\vcruntime140_1.dllexecutable
MD5:0A5A6000D04C290978E0A3B00FB89DF0
SHA256:67A4A07EE9FA855C7A505D78569F403430D9DC4A06F04AD8DCF55AFBA4224009
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
36
DNS requests
35
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
3460
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4024
comet.exe
GET
200
142.250.186.78:80
http://clients2.google.com/time/1/current?cup2key=9:_2dCcnBdDo3jXjiG4eNJldstyf9t4SoGC9b5BaG-k1k&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
unknown
—
—
whitelisted
1896
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1896
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5944
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7064
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4748
comet_installer.exe
104.18.27.48:443
www.perplexity.ai
CLOUDFLARENET
—
unknown
4748
comet_installer.exe
104.18.26.48:443
www.perplexity.ai
CLOUDFLARENET
—
unknown
4748
comet_installer.exe
162.159.141.50:443
pplx-browser-binaries.a0adf9b772aecba4fa8883581f3c9180.r2.cloudflarestorage.com
CLOUDFLARENET
—
unknown
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
  • 40.127.240.158
whitelisted
google.com
  • 142.250.185.78
whitelisted
www.perplexity.ai
  • 104.18.27.48
  • 104.18.26.48
  • 2606:4700::6812:1b30
  • 2606:4700::6812:1a30
unknown
pplx-browser-binaries.a0adf9b772aecba4fa8883581f3c9180.r2.cloudflarestorage.com
  • 162.159.141.50
  • 172.66.1.46
  • 2606:4700:7::12e
  • 2a06:98c1:58::12e
unknown
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.14
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 23.35.229.160
whitelisted
login.live.com
  • 40.126.31.0
  • 20.190.159.129
  • 40.126.31.1
  • 20.190.159.23
  • 40.126.31.69
  • 40.126.31.131
  • 40.126.31.3
  • 20.190.159.64
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
slscr.update.microsoft.com
  • 74.178.76.128
whitelisted

Threats

PID
Process
Class
Message
2200
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare R2 Storage (r2 .cloudflarestorage .com)
2200
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare R2 Storage (r2 .cloudflarestorage .com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
comet_installer_latest.exe