File name:

comet_installer_latest.exe

Full analysis: https://app.any.run/tasks/47112c24-6f9e-42e4-bc77-8284340e4254
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: July 17, 2025, 17:23:58
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

F85561F3E0F52CD1FC71757FCE6B1BA0

SHA1:

42343E47A3B23C2B9D7DEDB52E8F1C46FAD8C2AB

SHA256:

4F3061B39B6BAC255D19B3B3C8FAED3F58852B147AF0E76CC1DD004FC473E736

SSDEEP:

98304:Ev9DcqaBg7Pn9D/dAi7buBMJIoDB1M5bwDphFkIEaswTQ4iYAQnKXDwBbWcKE5/G:6B+FHuH8F+V9f+WLUZ83UCiVP99Frp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • comet.exe (PID: 4084)

    • Steals credentials from Web Browsers

      • comet.exe (PID: 4084)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • comet_installer_latest.exe (PID: 3788)
      • comet_installer.exe (PID: 4748)
      • mini_installer.exe (PID: 6016)
      • setup.exe (PID: 1244)

    • The process drops C-runtime libraries

      • comet_installer_latest.exe (PID: 3788)

    • Process drops legitimate windows executable

      • comet_installer_latest.exe (PID: 3788)

    • Starts POWERSHELL.EXE for commands execution

      • comet_installer.exe (PID: 4748)

    • There is functionality for taking screenshot (YARA)

      • crashpad_handler.exe (PID: 7124)

    • Application launched itself

      • setup.exe (PID: 1244)
      • setup.exe (PID: 5644)
      • comet.exe (PID: 4084)
      • comet.exe (PID: 5744)

    • Creates a software uninstall entry

      • setup.exe (PID: 1244)

    • Searches for installed software

      • setup.exe (PID: 1244)

    • The executable file from the user directory is run by the CMD process

      • comet.exe (PID: 4084)

    • Reads the date of Windows installation

      • setup.exe (PID: 5644)

    • Reads security settings of Internet Explorer

      • setup.exe (PID: 5644)
      • comet.exe (PID: 4084)

    • Starts CMD.EXE for commands execution

      • comet_installer.exe (PID: 4748)

    • Reads Mozilla Firefox installation path

      • comet.exe (PID: 4084)

    • The process checks if it is being run in the virtual environment

      • comet.exe (PID: 4084)

  • INFO

    • Checks supported languages

      • comet_installer_latest.exe (PID: 3788)
      • comet_installer.exe (PID: 4748)
      • crashpad_handler.exe (PID: 7124)
      • mini_installer.exe (PID: 6016)
      • setup.exe (PID: 1244)
      • setup.exe (PID: 1964)
      • setup.exe (PID: 5644)
      • setup.exe (PID: 4580)
      • comet.exe (PID: 4024)
      • comet.exe (PID: 5744)
      • comet.exe (PID: 4476)
      • comet.exe (PID: 6412)
      • comet.exe (PID: 1800)
      • comet.exe (PID: 1612)
      • comet.exe (PID: 4084)
      • comet.exe (PID: 6840)
      • comet.exe (PID: 7008)
      • comet.exe (PID: 6940)
      • comet.exe (PID: 4080)
      • comet.exe (PID: 1336)
      • comet.exe (PID: 4124)
      • comet.exe (PID: 5620)
      • comet.exe (PID: 4724)
      • comet.exe (PID: 3480)
      • comet.exe (PID: 7140)
      • comet.exe (PID: 1136)
      • comet.exe (PID: 2216)
      • comet.exe (PID: 2388)
      • comet.exe (PID: 3108)
      • comet.exe (PID: 1508)
      • comet.exe (PID: 1156)
      • comet.exe (PID: 3960)

    • Create files in a temporary directory

      • comet_installer_latest.exe (PID: 3788)
      • comet_installer.exe (PID: 4748)
      • crashpad_handler.exe (PID: 7124)
      • comet.exe (PID: 4084)

    • The sample compiled with english language support

      • comet_installer_latest.exe (PID: 3788)
      • mini_installer.exe (PID: 6016)
      • setup.exe (PID: 1244)

    • Reads the computer name

      • comet_installer.exe (PID: 4748)
      • mini_installer.exe (PID: 6016)
      • setup.exe (PID: 5644)
      • setup.exe (PID: 1244)
      • comet.exe (PID: 4084)
      • comet.exe (PID: 5744)
      • comet.exe (PID: 4024)
      • comet.exe (PID: 4476)
      • comet.exe (PID: 4080)
      • comet.exe (PID: 4124)

    • Checks proxy server information

      • comet_installer.exe (PID: 4748)
      • comet.exe (PID: 4084)

    • Reads Environment values

      • comet_installer.exe (PID: 4748)

    • Creates files or folders in the user directory

      • setup.exe (PID: 1244)
      • setup.exe (PID: 1964)
      • setup.exe (PID: 5644)
      • comet_installer.exe (PID: 4748)
      • comet.exe (PID: 4084)
      • comet.exe (PID: 4024)

    • Process checks computer location settings

      • comet.exe (PID: 4084)
      • comet.exe (PID: 1612)
      • comet.exe (PID: 6940)
      • comet.exe (PID: 1800)
      • comet.exe (PID: 2388)
      • comet.exe (PID: 1156)
      • comet.exe (PID: 3108)
      • comet.exe (PID: 1508)

    • Reads the machine GUID from the registry

      • comet.exe (PID: 4084)

    • Reads CPU info

      • comet.exe (PID: 4084)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:03:08 23:05:20+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 27136
InitializedDataSize: 184832
UninitializedDataSize: 2048
EntryPoint: 0x358d
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
177
Monitored processes
40
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start comet_installer_latest.exe comet_installer.exe crashpad_handler.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs mini_installer.exe setup.exe setup.exe no specs setup.exe no specs setup.exe no specs cmd.exe no specs conhost.exe no specs comet.exe comet.exe no specs comet.exe no specs slui.exe no specs comet.exe no specs comet.exe comet.exe no specs comet.exe no specs comet.exe no specs comet.exe no specs comet.exe no specs comet.exe no specs comet.exe no specs comet.exe no specs comet.exe no specs comet.exe no specs comet.exe no specs comet.exe no specs comet.exe no specs comet.exe no specs comet.exe no specs comet.exe no specs comet.exe no specs comet.exe no specs comet.exe no specs comet.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1136"C:\Users\admin\AppData\Local\Perplexity\Comet\Application\comet.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --field-trial-handle=2036,i,3880769497176697771,13055885081075587920,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8C:\Users\admin\AppData\Local\Perplexity\Comet\Application\comet.exe—comet.exe
User:
admin
Company:
The Perplexity Authors
Integrity Level:
LOW
Description:
Comet
Exit code:
0
Version:
137.2.7151.8097
Modules
Images
c:\users\admin\appdata\local\perplexity\comet\application\comet.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\perplexity\comet\application\137.2.7151.8097\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1156"C:\Users\admin\AppData\Local\Perplexity\Comet\Application\comet.exe" --type=renderer --perplexity-backend-url=https://www.perplexity.ai/ --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=2036,i,3880769497176697771,13055885081075587920,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:1C:\Users\admin\AppData\Local\Perplexity\Comet\Application\comet.exe—comet.exe
User:
admin
Company:
The Perplexity Authors
Integrity Level:
LOW
Description:
Comet
Version:
137.2.7151.8097
Modules
Images
c:\users\admin\appdata\local\perplexity\comet\application\comet.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\perplexity\comet\application\137.2.7151.8097\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1244"C:\Users\admin\Downloads\CR_764D8.tmp\setup.exe" --install-archive="C:\Users\admin\Downloads\CR_764D8.tmp\CHROME.PACKED.7Z" --do-not-launch-chromeC:\Users\admin\Downloads\CR_764D8.tmp\setup.exe
mini_installer.exe
User:
admin
Company:
The Perplexity Authors
Integrity Level:
MEDIUM
Description:
Comet Installer
Exit code:
0
Version:
137.2.7151.8097
Modules
Images
c:\users\admin\downloads\cr_764d8.tmp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1336"C:\Users\admin\AppData\Local\Perplexity\Comet\Application\comet.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --field-trial-handle=2036,i,3880769497176697771,13055885081075587920,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8C:\Users\admin\AppData\Local\Perplexity\Comet\Application\comet.exe—comet.exe
User:
admin
Company:
The Perplexity Authors
Integrity Level:
LOW
Description:
Comet
Exit code:
0
Version:
137.2.7151.8097
Modules
Images
c:\users\admin\appdata\local\perplexity\comet\application\comet.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\perplexity\comet\application\137.2.7151.8097\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1508"C:\Users\admin\AppData\Local\Perplexity\Comet\Application\comet.exe" --type=renderer --perplexity-backend-url=https://www.perplexity.ai/ --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=2036,i,3880769497176697771,13055885081075587920,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:1C:\Users\admin\AppData\Local\Perplexity\Comet\Application\comet.exe—comet.exe
User:
admin
Company:
The Perplexity Authors
Integrity Level:
LOW
Description:
Comet
Exit code:
0
Version:
137.2.7151.8097
Modules
Images
c:\users\admin\appdata\local\perplexity\comet\application\comet.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\perplexity\comet\application\137.2.7151.8097\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1612"C:\Users\admin\AppData\Local\Perplexity\Comet\Application\comet.exe" --type=renderer --extension-process --perplexity-backend-url=https://www.perplexity.ai/ --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=2036,i,3880769497176697771,13055885081075587920,262144 --variations-seed-version --mojo-platform-channel-handle=3920 /prefetch:2C:\Users\admin\AppData\Local\Perplexity\Comet\Application\comet.exe—comet.exe
User:
admin
Company:
The Perplexity Authors
Integrity Level:
LOW
Description:
Comet
Version:
137.2.7151.8097
Modules
Images
c:\users\admin\appdata\local\perplexity\comet\application\comet.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\perplexity\comet\application\137.2.7151.8097\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1660\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1800"C:\Users\admin\AppData\Local\Perplexity\Comet\Application\comet.exe" --type=renderer --perplexity-backend-url=https://www.perplexity.ai/ --force-high-res-timeticks=disabled --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2036,i,3880769497176697771,13055885081075587920,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:1C:\Users\admin\AppData\Local\Perplexity\Comet\Application\comet.exe—comet.exe
User:
admin
Company:
The Perplexity Authors
Integrity Level:
LOW
Description:
Comet
Version:
137.2.7151.8097
Modules
Images
c:\users\admin\appdata\local\perplexity\comet\application\comet.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\perplexity\comet\application\137.2.7151.8097\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1828\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1964C:\Users\admin\Downloads\CR_764D8.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Perplexity\Comet\User Data\Crashpad" --url=https://o4504136533147648.ingest.us.sentry.io/api/4508489400123392/minidump/?sentry_key=6862c0f9ce7db97a4682a9a4f269e0bd --annotation=plat=Win64 --annotation=prod=Comet --annotation=ver=137.2.7151.8097 --initial-client-data=0x29c,0x2a0,0x2a4,0x278,0x2a8,0x7ff77e751db8,0x7ff77e751dc4,0x7ff77e751dd0C:\Users\admin\Downloads\CR_764D8.tmp\setup.exe—setup.exe
User:
admin
Company:
The Perplexity Authors
Integrity Level:
MEDIUM
Description:
Comet Installer
Exit code:
0
Version:
137.2.7151.8097
Modules
Images
c:\users\admin\downloads\cr_764d8.tmp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
17 010
Read events
16 883
Write events
127
Delete events
0

Modification events

(PID) Process:(4748) comet_installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Windows Error Reporting\RuntimeExceptionHelperModules
Operation:writeName:C:\Users\admin\AppData\Local\Temp\CometInstaller\crashpad_wer.dll
Value:
1
(PID) Process:(1244) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Comet
Operation:writeName:InstallerProgress
Value:
19
(PID) Process:(1244) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Comet
Operation:writeName:InstallerProgress
Value:
25
(PID) Process:(1244) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Comet
Operation:writeName:InstallerProgress
Value:
39
(PID) Process:(1244) setup.exeKey:HKEY_CLASSES_ROOT\CLSID\{7ADFC10A-CB1B-4D95-A6D2-143E62F40889}\LocalServer32
Operation:writeName:ServerExecutable
Value:
C:\Users\admin\AppData\Local\Perplexity\Comet\Application\137.2.7151.8097\notification_helper.exe
(PID) Process:(1244) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Windows Error Reporting\RuntimeExceptionHelperModules
Operation:writeName:C:\Users\admin\AppData\Local\Perplexity\Comet\Application\137.2.7151.8097\chrome_wer.dll
Value:
0
(PID) Process:(1244) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Comet
Operation:writeName:DowngradeCleanupCommand
Value:
"C:\Users\admin\AppData\Local\Perplexity\Comet\Application\137.2.7151.8097\Installer\setup.exe" --cleanup-for-downgrade-version=$1 --cleanup-for-downgrade-operation=$2
(PID) Process:(1244) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Comet
Operation:writeName:CleanInstallRequiredForVersionBelow
Value:
85.0.4169.0
(PID) Process:(1244) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Comet
Operation:writeName:InstallerProgress
Value:
66
(PID) Process:(1244) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Comet
Operation:writeName:InstallerProgress
Value:
73
Executable files
18
Suspicious files
96
Text files
73
Unknown types
49

Dropped files

PID
Process
Filename
Type
3788comet_installer_latest.exeC:\Users\admin\AppData\Local\Temp\CometInstaller\data\app.so —
MD5:—
SHA256:—
3788comet_installer_latest.exeC:\Users\admin\AppData\Local\Temp\CometInstaller\screen_retriever_plugin.dllexecutable
MD5:34EA86BBE4DD194E3A540A73D6A032FB
SHA256:026933810F05CC08FA8242CCCBAB764D7D0062652B1DBCB9B9729A587E2C15A9
3788comet_installer_latest.exeC:\Users\admin\AppData\Local\Temp\CometInstaller\crashpad_wer.dllexecutable
MD5:A1F57DFCE2E07965F8FCC150E145FED9
SHA256:BA7578F74FE92B447DEEA3A25719EAE16D261029E8186BE4F5D0FE9E371476CF
3788comet_installer_latest.exeC:\Users\admin\AppData\Local\Temp\CometInstaller\data\flutter_assets\AssetManifest.jsonbinary
MD5:D4E32A5468BD982CF633073536BDC4E1
SHA256:7D9CCB5FD3E4D960BD4EA55F40C2922023880D4CF7C32BC4ABE9220E2ED68EBD
3788comet_installer_latest.exeC:\Users\admin\AppData\Local\Temp\CometInstaller\dartjni.dllexecutable
MD5:DA0AB78DFF364F21B0620CE1BEC40627
SHA256:DFA6FE25AD68503B58C9B12297D4F75EFBC10BCAE37271E7166608DF6965ACF7
3788comet_installer_latest.exeC:\Users\admin\AppData\Local\Temp\CometInstaller\flutter_windows.dllexecutable
MD5:9ADDDC66C11CA7D771AFEF7E33DB314C
SHA256:BA9B8434BF8DEACE3EACD41138C86587823439F3EBE495229F42B4BD6E1A209C
3788comet_installer_latest.exeC:\Users\admin\AppData\Local\Temp\CometInstaller\data\flutter_assets\AssetManifest.binbinary
MD5:FF160984C7870BACFACC60D5F04D32D6
SHA256:F5F212282B564BCB48DFAD27444BB4BA1FF441A8F11B110DE5D1846652273958
3788comet_installer_latest.exeC:\Users\admin\AppData\Local\Temp\CometInstaller\comet_installer.exeexecutable
MD5:41C86730C76DC2B925135C0180AAE685
SHA256:4A36562BEB4B6C7EFDCF63DAB239417EA861C9C2B95ABD939EDCC5EBC53EFA6B
3788comet_installer_latest.exeC:\Users\admin\AppData\Local\Temp\CometInstaller\sentry.dllexecutable
MD5:9E7E428224F80831531D23E5FD610B59
SHA256:46BDA2266B104406802BB4991BB2411D8A895D0D06760F42AB0235E11D213015
3788comet_installer_latest.exeC:\Users\admin\AppData\Local\Temp\CometInstaller\url_launcher_windows_plugin.dllexecutable
MD5:BE30F1D00BD1A1A94F33E6C7069D73A6
SHA256:C46D13F53A2AEE9D87E5397E9C7509A1ED1828E68FB5BE1ADBBBA4A3F52D8051
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
36
DNS requests
35
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
3460
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4024
comet.exe
GET
200
142.250.186.78:80
http://clients2.google.com/time/1/current?cup2key=9:_2dCcnBdDo3jXjiG4eNJldstyf9t4SoGC9b5BaG-k1k&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
unknown
—
—
whitelisted
1896
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1896
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5944
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7064
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4748
comet_installer.exe
104.18.27.48:443
www.perplexity.ai
CLOUDFLARENET
—
unknown
4748
comet_installer.exe
104.18.26.48:443
www.perplexity.ai
CLOUDFLARENET
—
unknown
4748
comet_installer.exe
162.159.141.50:443
pplx-browser-binaries.a0adf9b772aecba4fa8883581f3c9180.r2.cloudflarestorage.com
CLOUDFLARENET
—
unknown
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
  • 40.127.240.158
whitelisted
google.com
  • 142.250.185.78
whitelisted
www.perplexity.ai
  • 104.18.27.48
  • 104.18.26.48
  • 2606:4700::6812:1b30
  • 2606:4700::6812:1a30
unknown
pplx-browser-binaries.a0adf9b772aecba4fa8883581f3c9180.r2.cloudflarestorage.com
  • 162.159.141.50
  • 172.66.1.46
  • 2606:4700:7::12e
  • 2a06:98c1:58::12e
unknown
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.14
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 23.35.229.160
whitelisted
login.live.com
  • 40.126.31.0
  • 20.190.159.129
  • 40.126.31.1
  • 20.190.159.23
  • 40.126.31.69
  • 40.126.31.131
  • 40.126.31.3
  • 20.190.159.64
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
slscr.update.microsoft.com
  • 74.178.76.128
whitelisted

Threats

PID
Process
Class
Message
2200
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare R2 Storage (r2 .cloudflarestorage .com)
2200
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare R2 Storage (r2 .cloudflarestorage .com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
comet_installer_latest.exe