File name:

SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.exe

Full analysis: https://app.any.run/tasks/fb4986e3-3930-4d6a-9ad0-d61233e7ec0e
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Analysis date: April 28, 2025, 14:41:02
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto
privateloader
loader
stealer
adware
innosetup
delphi
inno
installer
arch-exec
bittorrent
arch-scr
arch-html
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 10 sections
MD5:

21C7202E3985AD7DEFE13C840AEADF79

SHA1:

04333D7E2BE8684472D57E34AA31FDAB09D7B288

SHA256:

5A9038021945615156EFCB3E0E4F1905C774659A0647E009B2A582FA05E30B20

SSDEEP:

98304:P+QqZ8fQJ1CfEW6v7SoSLerx5uO4QBAOOVm2Jah5nn+ojEOyoqcCvPrEMv0T9WQL:fydlko3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • LOADER has been found (auto)

      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.exe (PID: 4244)
    • Actions looks like stealing of personal data

      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp (PID: 1052)
    • BITTORRENT has been detected (SURICATA)

      • BitComet.exe (PID: 3332)
  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp (PID: 3096)
      • BitComet_2.12_setup.exe (PID: 6272)
      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp (PID: 1052)
      • Yandex.exe (PID: 5056)
      • saBSI.exe (PID: 7052)
      • BitComet.exe (PID: 3332)
      • saBSI.exe (PID: 2800)
      • installer.exe (PID: 2896)
    • Executable content was dropped or overwritten

      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.exe (PID: 4244)
      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.exe (PID: 2108)
      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp (PID: 1052)
      • BitComet_2.12_setup.exe (PID: 6272)
      • saBSI.exe (PID: 7052)
      • saBSI.exe (PID: 2800)
      • installer.exe (PID: 4572)
      • installer.exe (PID: 2896)
      • saBSI.exe (PID: 6372)
    • Reads the Windows owner or organization settings

      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp (PID: 1052)
    • There is functionality for taking screenshot (YARA)

      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp (PID: 1052)
      • BitComet_2.12_setup.exe (PID: 6272)
    • The process creates files with name similar to system file names

      • BitComet_2.12_setup.exe (PID: 6272)
    • Malware-specific behavior (creating "System.dll" in Temp)

      • BitComet_2.12_setup.exe (PID: 6272)
    • Process drops legitimate windows executable

      • BitComet_2.12_setup.exe (PID: 6272)
      • installer.exe (PID: 2896)
    • Creates/Modifies COM task schedule object

      • BitComet_2.12_setup.exe (PID: 6272)
    • Creates or modifies Windows services

      • BitCometService.exe (PID: 4488)
    • Executes as Windows Service

      • BitCometService.exe (PID: 5360)
      • servicehost.exe (PID: 1004)
    • The process executes via Task Scheduler

      • BitComet.exe (PID: 3332)
    • Adds/modifies Windows certificates

      • saBSI.exe (PID: 7052)
    • Reads the date of Windows installation

      • BitComet.exe (PID: 3332)
    • Reads Internet Explorer settings

      • BitComet.exe (PID: 3332)
    • Reads Microsoft Outlook installation path

      • BitComet.exe (PID: 3332)
    • Executes application which crashes

      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp (PID: 1052)
    • The process verifies whether the antivirus software is installed

      • saBSI.exe (PID: 2800)
      • installer.exe (PID: 4572)
      • installer.exe (PID: 2896)
    • Changes default file association

      • BitComet.exe (PID: 3332)
    • Starts CMD.EXE for commands execution

      • updater.exe (PID: 8004)
  • INFO

    • Create files in a temporary directory

      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.exe (PID: 4244)
      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.exe (PID: 2108)
      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp (PID: 1052)
      • BitComet_2.12_setup.exe (PID: 6272)
      • Yandex.exe (PID: 5056)
      • saBSI.exe (PID: 2800)
      • installer.exe (PID: 2896)
    • Checks supported languages

      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.exe (PID: 4244)
      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp (PID: 3096)
      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.exe (PID: 2108)
      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp (PID: 1052)
      • BitComet_2.12_setup.exe (PID: 6272)
      • BitCometService.exe (PID: 4488)
      • saBSI.exe (PID: 7052)
      • Yandex.exe (PID: 5056)
      • saBSI.exe (PID: 6372)
      • BitComet.exe (PID: 3332)
      • BitComet.exe (PID: 1760)
      • BitCometService.exe (PID: 5360)
      • saBSI.exe (PID: 2800)
      • UPNP.exe (PID: 5216)
      • UPNP.exe (PID: 5304)
      • installer.exe (PID: 4572)
      • installer.exe (PID: 2896)
    • Reads the computer name

      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp (PID: 3096)
      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp (PID: 1052)
      • BitCometService.exe (PID: 4488)
      • saBSI.exe (PID: 7052)
      • BitComet_2.12_setup.exe (PID: 6272)
      • Yandex.exe (PID: 5056)
      • saBSI.exe (PID: 6372)
      • BitComet.exe (PID: 1760)
      • BitCometService.exe (PID: 5360)
      • BitComet.exe (PID: 3332)
      • saBSI.exe (PID: 2800)
      • UPNP.exe (PID: 5304)
      • installer.exe (PID: 2896)
    • Process checks computer location settings

      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp (PID: 3096)
      • BitComet_2.12_setup.exe (PID: 6272)
      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp (PID: 1052)
      • BitComet.exe (PID: 3332)
    • Reads the machine GUID from the registry

      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp (PID: 1052)
      • saBSI.exe (PID: 7052)
      • Yandex.exe (PID: 5056)
      • saBSI.exe (PID: 2800)
      • BitComet.exe (PID: 3332)
      • installer.exe (PID: 2896)
    • Reads the software policy settings

      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp (PID: 1052)
      • saBSI.exe (PID: 7052)
      • Yandex.exe (PID: 5056)
      • saBSI.exe (PID: 2800)
      • BitComet.exe (PID: 3332)
      • slui.exe (PID: 2600)
      • installer.exe (PID: 2896)
    • The sample compiled with english language support

      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp (PID: 1052)
      • BitComet_2.12_setup.exe (PID: 6272)
      • saBSI.exe (PID: 7052)
      • saBSI.exe (PID: 2800)
      • installer.exe (PID: 4572)
      • saBSI.exe (PID: 6372)
      • installer.exe (PID: 2896)
    • Checks proxy server information

      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp (PID: 1052)
      • saBSI.exe (PID: 7052)
      • Yandex.exe (PID: 5056)
      • BitComet.exe (PID: 3332)
      • saBSI.exe (PID: 2800)
      • slui.exe (PID: 2600)
    • Detects InnoSetup installer (YARA)

      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp (PID: 1052)
      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp (PID: 3096)
      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.exe (PID: 4244)
      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.exe (PID: 2108)
    • Compiled with Borland Delphi (YARA)

      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.exe (PID: 4244)
      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.exe (PID: 2108)
      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp (PID: 3096)
      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp (PID: 1052)
    • The sample compiled with chinese language support

      • BitComet_2.12_setup.exe (PID: 6272)
    • Creates files in the program directory

      • BitComet_2.12_setup.exe (PID: 6272)
      • saBSI.exe (PID: 7052)
      • saBSI.exe (PID: 2800)
      • installer.exe (PID: 4572)
    • Creates files or folders in the user directory

      • BitComet_2.12_setup.exe (PID: 6272)
      • Yandex.exe (PID: 5056)
      • BitComet.exe (PID: 3332)
      • WerFault.exe (PID: 6244)
      • WerFault.exe (PID: 232)
    • Manual execution by a user

      • saBSI.exe (PID: 2644)
      • saBSI.exe (PID: 7052)
    • Creates a software uninstall entry

      • BitComet_2.12_setup.exe (PID: 6272)
    • Yandex updater related mutex has been found

      • Yandex.exe (PID: 5056)
    • Reads CPU info

      • BitComet.exe (PID: 3332)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (67.7)
.exe | Win32 EXE PECompact compressed (generic) (25.6)
.exe | Win32 Executable (generic) (2.7)
.exe | Win16/32 Executable Delphi generic (1.2)
.exe | Generic Win/DOS Executable (1.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:11:15 09:48:30+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 741376
InitializedDataSize: 135680
UninitializedDataSize: -
EntryPoint: 0xb5eec
OSVersion: 6.1
ImageVersion: 6
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 2.12.1.8
ProductVersionNumber: 2.12.1.8
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName:
FileDescription: BitComet Installer
FileVersion: 2.12.1.8
LegalCopyright: © BitComet
OriginalFileName:
ProductName: BitComet
ProductVersion: 2.12.1.8
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
167
Monitored processes
29
Malicious processes
7
Suspicious processes
3

Behavior graph

Click at the process to see the details
start securiteinfo.com.trojan.installcore.4099.24415.17034.exe securiteinfo.com.trojan.installcore.4099.24415.17034.tmp no specs securiteinfo.com.trojan.installcore.4099.24415.17034.exe securiteinfo.com.trojan.installcore.4099.24415.17034.tmp slui.exe bitcomet_2.12_setup.exe bitcometservice.exe no specs sabsi.exe no specs sabsi.exe yandex.exe sabsi.exe bitcomet.exe no specs #BITTORRENT bitcomet.exe bitcometservice.exe sabsi.exe upnp.exe no specs werfault.exe no specs werfault.exe no specs upnp.exe installer.exe installer.exe servicehost.exe uihost.exe no specs updater.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs sabsi.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
232C:\WINDOWS\SysWOW64\WerFault.exe -u -p 1052 -s 3028C:\Windows\SysWOW64\WerFault.exeSecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1004"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"C:\Program Files\McAfee\WebAdvisor\servicehost.exe
services.exe
User:
SYSTEM
Company:
McAfee, LLC
Integrity Level:
SYSTEM
Description:
McAfee WebAdvisor(service)
Version:
4,1,1,1020
Modules
Images
c:\program files\mcafee\webadvisor\servicehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1052"C:\Users\admin\AppData\Local\Temp\is-QURTC.tmp\SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp" /SL5="$7027C,1635601,878080,C:\Users\admin\Desktop\SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.exe" /SPAWNWND=$1A02DC /NOTIFYWND=$9014C C:\Users\admin\AppData\Local\Temp\is-QURTC.tmp\SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp
SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.exe
User:
admin
Company:
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
3221226525
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-qurtc.tmp\securiteinfo.com.trojan.installcore.4099.24415.17034.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\mpr.dll
1760"C:\Program Files\BitComet\BitComet.exe" --no_elevatedC:\Program Files\BitComet\BitComet.exeSecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp
User:
admin
Company:
www.BitComet.com
Integrity Level:
HIGH
Description:
BitComet - a BitTorrent Client
Exit code:
4294967295
Version:
2.12
Modules
Images
c:\program files\bitcomet\bitcomet.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2108"C:\Users\admin\Desktop\SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.exe" /SPAWNWND=$1A02DC /NOTIFYWND=$9014C C:\Users\admin\Desktop\SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.exe
SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
BitComet Installer
Exit code:
3221226525
Version:
2.12.1.8
Modules
Images
c:\users\admin\desktop\securiteinfo.com.trojan.installcore.4099.24415.17034.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2600C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2644"C:\Users\admin\Desktop\saBSI.exe" C:\Users\admin\Desktop\saBSI.exeexplorer.exe
User:
admin
Company:
McAfee, LLC
Integrity Level:
MEDIUM
Description:
McAfee WebAdvisor(bootstrap installer)
Exit code:
3221226540
Version:
4,1,1,865
Modules
Images
c:\users\admin\desktop\sabsi.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
2800"C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe" /install /affid !UNKNOWN saBsiVersion=4.1.1.865 /no_self_updateC:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe
saBSI.exe
User:
admin
Company:
McAfee, LLC
Integrity Level:
HIGH
Description:
McAfee WebAdvisor(bootstrap installer)
Exit code:
0
Version:
4,1,1,1006
Modules
Images
c:\programdata\mcafee\webadvisor\sabsi\sabsi.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
2896"C:\Program Files\McAfee\Temp1326325341\installer.exe" /s /upgradeC:\Program Files\McAfee\Temp1326325341\installer.exe
installer.exe
User:
admin
Company:
McAfee, LLC
Integrity Level:
HIGH
Description:
McAfee WebAdvisor(installer)
Exit code:
0
Version:
4,1,1,1020
Modules
Images
c:\program files\mcafee\temp1326325341\installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\rpcrt4.dll
3096"C:\Users\admin\AppData\Local\Temp\is-2VQ2N.tmp\SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp" /SL5="$9014C,1635601,878080,C:\Users\admin\Desktop\SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.exe" C:\Users\admin\AppData\Local\Temp\is-2VQ2N.tmp\SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmpSecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
3221226525
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-2vq2n.tmp\securiteinfo.com.trojan.installcore.4099.24415.17034.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
Total events
52 590
Read events
52 299
Write events
270
Delete events
21

Modification events

(PID) Process:(6272) BitComet_2.12_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E8A058D1-C830-437F-A029-10D777A8DD40}\TypeLib
Operation:writeName:Version
Value:
1.0
(PID) Process:(6272) BitComet_2.12_setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\BitComet
Operation:writeName:InstallSettingCaptureIEDownload
Value:
0
(PID) Process:(6272) BitComet_2.12_setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\BitComet\BitComet
Operation:writeName:CaptureIEDownload
Value:
0
(PID) Process:(6272) BitComet_2.12_setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\BitComet
Operation:writeName:Install Date
Value:
20250428
(PID) Process:(6272) BitComet_2.12_setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\BitComet
Operation:writeName:NewInstall
Value:
1
(PID) Process:(6272) BitComet_2.12_setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\BitComet
Operation:writeName:PackageName
Value:
BitComet_2.12_setup.exe
(PID) Process:(6272) BitComet_2.12_setup.exeKey:HKEY_CLASSES_ROOT\.torrent
Operation:writeName:Content Type
Value:
application/x-bittorrent
(PID) Process:(6272) BitComet_2.12_setup.exeKey:HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/x-bittorrent
Operation:writeName:Extension
Value:
.torrent
(PID) Process:(6272) BitComet_2.12_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\bc
Operation:writeName:URL Protocol
Value:
(PID) Process:(6272) BitComet_2.12_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\BitCometAgent.DLL
Operation:writeName:AppID
Value:
{B99B5DF3-3AD2-463F-8F8C-86787623E1D5}
Executable files
45
Suspicious files
294
Text files
744
Unknown types
6

Dropped files

PID
Process
Filename
Type
1052SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmpC:\Users\admin\AppData\Local\Temp\is-N069K.tmp\is-EN4R8.tmp
MD5:
SHA256:
1052SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmpC:\Users\admin\AppData\Local\Temp\is-N069K.tmp\BitComet_2.12_setup.exe
MD5:
SHA256:
1052SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmpC:\Users\admin\AppData\Local\Temp\is-N069K.tmp\is-ML9EI.tmpimage
MD5:CD3771BFEC21E8D8F1DB6588C5645515
SHA256:6DCA28F08A5198BF74C38B956963E6E4652D2649D87DF5ECF7BBE01A3C4645A7
4244SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.exeC:\Users\admin\AppData\Local\Temp\is-2VQ2N.tmp\SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmpexecutable
MD5:B09C06DF6B37FFD9F39765F3C2DAF15E
SHA256:57DF8D5253F5C9FE6AC94359D9943AD40B2DED400B705BAF1FFB3FE5E5AAE8C7
2108SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.exeC:\Users\admin\AppData\Local\Temp\is-QURTC.tmp\SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmpexecutable
MD5:B09C06DF6B37FFD9F39765F3C2DAF15E
SHA256:57DF8D5253F5C9FE6AC94359D9943AD40B2DED400B705BAF1FFB3FE5E5AAE8C7
1052SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmpC:\Users\admin\AppData\Local\Temp\is-N069K.tmp\is-KUL9F.tmpimage
MD5:4CFFF8DC30D353CD3D215FD3A5DBAC24
SHA256:0C430E56D69435D8AB31CBB5916A73A47D11EF65B37D289EE7D11130ADF25856
1052SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmpC:\Users\admin\AppData\Local\Temp\is-N069K.tmp\Yandex.pngimage
MD5:CD3771BFEC21E8D8F1DB6588C5645515
SHA256:6DCA28F08A5198BF74C38B956963E6E4652D2649D87DF5ECF7BBE01A3C4645A7
1052SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmpC:\Users\admin\AppData\Local\Temp\is-N069K.tmp\finish.pngimage
MD5:28F542C1010BF7FE29A3E8B4C0230E83
SHA256:B39B81D3F9E8F50585AD506CDB0C5FF4896517E798B840D635581C268FD13DD2
1052SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmpC:\Users\admin\AppData\Local\Temp\is-N069K.tmp\WebAdvisor.pngimage
MD5:4CFFF8DC30D353CD3D215FD3A5DBAC24
SHA256:0C430E56D69435D8AB31CBB5916A73A47D11EF65B37D289EE7D11130ADF25856
1052SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmpC:\Users\admin\AppData\Local\Temp\is-N069K.tmp\is-JRMRU.tmpcompressed
MD5:F68008B70822BD28C82D13A289DEB418
SHA256:CC6F4FAF4E8A9F4D2269D1D69A69EA326F789620FB98078CC98597F3CB998589
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
89
TCP/UDP connections
93
DNS requests
46
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
GET
304
4.245.163.56:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
unknown
2104
svchost.exe
GET
200
23.48.23.160:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
900
SIHClient.exe
GET
200
23.48.23.168:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
whitelisted
900
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
whitelisted
900
SIHClient.exe
GET
200
23.48.23.168:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
whitelisted
900
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
GET
200
20.3.187.198:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
unknown
unknown
900
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
whitelisted
900
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
51.124.78.146:443
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
51.124.78.146:443
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
whitelisted
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2104
svchost.exe
23.48.23.160:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
1052
SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp
18.245.45.231:443
d1hboxy79wgmk4.cloudfront.net
US
whitelisted
6544
svchost.exe
40.126.32.136:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
whitelisted
google.com
  • 216.58.206.78
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
crl.microsoft.com
  • 23.48.23.160
  • 23.48.23.155
  • 23.48.23.171
  • 23.48.23.162
  • 23.48.23.170
  • 23.48.23.157
  • 23.48.23.161
  • 23.48.23.153
  • 23.48.23.158
  • 23.48.23.168
  • 23.48.23.176
  • 23.48.23.174
  • 23.48.23.173
  • 23.48.23.193
  • 23.48.23.159
  • 23.48.23.192
  • 23.48.23.179
  • 23.48.23.183
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 23.35.229.160
whitelisted
d1hboxy79wgmk4.cloudfront.net
  • 18.245.45.231
  • 18.245.45.10
  • 18.245.45.206
  • 18.245.45.110
whitelisted
login.live.com
  • 40.126.32.136
  • 20.190.160.128
  • 40.126.32.140
  • 40.126.32.68
  • 20.190.160.5
  • 20.190.160.64
  • 20.190.160.14
  • 40.126.32.134
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
A Network Trojan was detected
ET ADWARE_PUP Win32/OfferCore Checkin M1
Generic Protocol Command Decode
SURICATA HTTP Request unrecognized authorization method
A Network Trojan was detected
ET ADWARE_PUP Win32/OfferCore Checkin M2
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] InnoSetup Installer
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] InnoSetup Installer
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
Potentially Bad Traffic
ET INFO Executable served from Amazon S3
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] InnoSetup Installer
3332
BitComet.exe
Misc activity
INFO [ANY.RUN] P2P BitTorrent Protocol
Process
Message
BitCometService.exe
BITCOMET_HELPER_SERVICE
BitCometService.exe
ServiceProcess lunched.