File name:

SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.exe

Full analysis: https://app.any.run/tasks/fb4986e3-3930-4d6a-9ad0-d61233e7ec0e
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Analysis date: April 28, 2025, 14:41:02
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto
privateloader
loader
stealer
adware
innosetup
delphi
inno
installer
arch-exec
bittorrent
arch-scr
arch-html
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 10 sections
MD5:

21C7202E3985AD7DEFE13C840AEADF79

SHA1:

04333D7E2BE8684472D57E34AA31FDAB09D7B288

SHA256:

5A9038021945615156EFCB3E0E4F1905C774659A0647E009B2A582FA05E30B20

SSDEEP:

98304:P+QqZ8fQJ1CfEW6v7SoSLerx5uO4QBAOOVm2Jah5nn+ojEOyoqcCvPrEMv0T9WQL:fydlko3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • LOADER has been found (auto)

      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.exe (PID: 4244)
    • Actions looks like stealing of personal data

      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp (PID: 1052)
    • BITTORRENT has been detected (SURICATA)

      • BitComet.exe (PID: 3332)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.exe (PID: 4244)
      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.exe (PID: 2108)
      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp (PID: 1052)
      • BitComet_2.12_setup.exe (PID: 6272)
      • saBSI.exe (PID: 7052)
      • saBSI.exe (PID: 2800)
      • installer.exe (PID: 4572)
      • installer.exe (PID: 2896)
      • saBSI.exe (PID: 6372)
    • Reads security settings of Internet Explorer

      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp (PID: 3096)
      • BitComet_2.12_setup.exe (PID: 6272)
      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp (PID: 1052)
      • Yandex.exe (PID: 5056)
      • saBSI.exe (PID: 7052)
      • BitComet.exe (PID: 3332)
      • saBSI.exe (PID: 2800)
      • installer.exe (PID: 2896)
    • Reads the Windows owner or organization settings

      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp (PID: 1052)
    • There is functionality for taking screenshot (YARA)

      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp (PID: 1052)
      • BitComet_2.12_setup.exe (PID: 6272)
    • The process creates files with name similar to system file names

      • BitComet_2.12_setup.exe (PID: 6272)
    • Malware-specific behavior (creating "System.dll" in Temp)

      • BitComet_2.12_setup.exe (PID: 6272)
    • Creates/Modifies COM task schedule object

      • BitComet_2.12_setup.exe (PID: 6272)
    • Creates or modifies Windows services

      • BitCometService.exe (PID: 4488)
    • Process drops legitimate windows executable

      • BitComet_2.12_setup.exe (PID: 6272)
      • installer.exe (PID: 2896)
    • The process executes via Task Scheduler

      • BitComet.exe (PID: 3332)
    • Reads the date of Windows installation

      • BitComet.exe (PID: 3332)
    • Adds/modifies Windows certificates

      • saBSI.exe (PID: 7052)
    • Reads Microsoft Outlook installation path

      • BitComet.exe (PID: 3332)
    • Reads Internet Explorer settings

      • BitComet.exe (PID: 3332)
    • Executes as Windows Service

      • BitCometService.exe (PID: 5360)
      • servicehost.exe (PID: 1004)
    • Executes application which crashes

      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp (PID: 1052)
    • The process verifies whether the antivirus software is installed

      • saBSI.exe (PID: 2800)
      • installer.exe (PID: 2896)
      • installer.exe (PID: 4572)
    • Changes default file association

      • BitComet.exe (PID: 3332)
    • Starts CMD.EXE for commands execution

      • updater.exe (PID: 8004)
  • INFO

    • Create files in a temporary directory

      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.exe (PID: 4244)
      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.exe (PID: 2108)
      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp (PID: 1052)
      • BitComet_2.12_setup.exe (PID: 6272)
      • Yandex.exe (PID: 5056)
      • saBSI.exe (PID: 2800)
      • installer.exe (PID: 2896)
    • Reads the computer name

      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp (PID: 3096)
      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp (PID: 1052)
      • BitComet_2.12_setup.exe (PID: 6272)
      • BitCometService.exe (PID: 4488)
      • saBSI.exe (PID: 7052)
      • Yandex.exe (PID: 5056)
      • saBSI.exe (PID: 6372)
      • BitComet.exe (PID: 1760)
      • saBSI.exe (PID: 2800)
      • BitComet.exe (PID: 3332)
      • BitCometService.exe (PID: 5360)
      • UPNP.exe (PID: 5304)
      • installer.exe (PID: 2896)
    • Checks supported languages

      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.exe (PID: 4244)
      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp (PID: 3096)
      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.exe (PID: 2108)
      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp (PID: 1052)
      • BitComet_2.12_setup.exe (PID: 6272)
      • BitCometService.exe (PID: 4488)
      • saBSI.exe (PID: 7052)
      • saBSI.exe (PID: 6372)
      • BitComet.exe (PID: 1760)
      • BitComet.exe (PID: 3332)
      • Yandex.exe (PID: 5056)
      • BitCometService.exe (PID: 5360)
      • saBSI.exe (PID: 2800)
      • UPNP.exe (PID: 5216)
      • UPNP.exe (PID: 5304)
      • installer.exe (PID: 4572)
      • installer.exe (PID: 2896)
    • Process checks computer location settings

      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp (PID: 3096)
      • BitComet_2.12_setup.exe (PID: 6272)
      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp (PID: 1052)
      • BitComet.exe (PID: 3332)
    • Reads the machine GUID from the registry

      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp (PID: 1052)
      • saBSI.exe (PID: 7052)
      • Yandex.exe (PID: 5056)
      • saBSI.exe (PID: 2800)
      • BitComet.exe (PID: 3332)
      • installer.exe (PID: 2896)
    • Checks proxy server information

      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp (PID: 1052)
      • saBSI.exe (PID: 7052)
      • Yandex.exe (PID: 5056)
      • BitComet.exe (PID: 3332)
      • saBSI.exe (PID: 2800)
      • slui.exe (PID: 2600)
    • The sample compiled with english language support

      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp (PID: 1052)
      • BitComet_2.12_setup.exe (PID: 6272)
      • saBSI.exe (PID: 7052)
      • saBSI.exe (PID: 2800)
      • installer.exe (PID: 4572)
      • installer.exe (PID: 2896)
      • saBSI.exe (PID: 6372)
    • Reads the software policy settings

      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp (PID: 1052)
      • saBSI.exe (PID: 7052)
      • Yandex.exe (PID: 5056)
      • saBSI.exe (PID: 2800)
      • BitComet.exe (PID: 3332)
      • slui.exe (PID: 2600)
      • installer.exe (PID: 2896)
    • Detects InnoSetup installer (YARA)

      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.exe (PID: 4244)
      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp (PID: 3096)
      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.exe (PID: 2108)
      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp (PID: 1052)
    • Compiled with Borland Delphi (YARA)

      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.exe (PID: 4244)
      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp (PID: 3096)
      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp (PID: 1052)
      • SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.exe (PID: 2108)
    • The sample compiled with chinese language support

      • BitComet_2.12_setup.exe (PID: 6272)
    • Manual execution by a user

      • saBSI.exe (PID: 7052)
      • saBSI.exe (PID: 2644)
    • Creates a software uninstall entry

      • BitComet_2.12_setup.exe (PID: 6272)
    • Creates files in the program directory

      • saBSI.exe (PID: 7052)
      • BitComet_2.12_setup.exe (PID: 6272)
      • saBSI.exe (PID: 2800)
      • installer.exe (PID: 4572)
    • Creates files or folders in the user directory

      • BitComet_2.12_setup.exe (PID: 6272)
      • Yandex.exe (PID: 5056)
      • BitComet.exe (PID: 3332)
      • WerFault.exe (PID: 6244)
      • WerFault.exe (PID: 232)
    • Yandex updater related mutex has been found

      • Yandex.exe (PID: 5056)
    • Reads CPU info

      • BitComet.exe (PID: 3332)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (67.7)
.exe | Win32 EXE PECompact compressed (generic) (25.6)
.exe | Win32 Executable (generic) (2.7)
.exe | Win16/32 Executable Delphi generic (1.2)
.exe | Generic Win/DOS Executable (1.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:11:15 09:48:30+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 741376
InitializedDataSize: 135680
UninitializedDataSize: -
EntryPoint: 0xb5eec
OSVersion: 6.1
ImageVersion: 6
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 2.12.1.8
ProductVersionNumber: 2.12.1.8
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName:
FileDescription: BitComet Installer
FileVersion: 2.12.1.8
LegalCopyright: © BitComet
OriginalFileName:
ProductName: BitComet
ProductVersion: 2.12.1.8
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
167
Monitored processes
29
Malicious processes
7
Suspicious processes
3

Behavior graph

Click at the process to see the details
start securiteinfo.com.trojan.installcore.4099.24415.17034.exe securiteinfo.com.trojan.installcore.4099.24415.17034.tmp no specs securiteinfo.com.trojan.installcore.4099.24415.17034.exe securiteinfo.com.trojan.installcore.4099.24415.17034.tmp slui.exe bitcomet_2.12_setup.exe bitcometservice.exe no specs sabsi.exe no specs sabsi.exe yandex.exe sabsi.exe bitcomet.exe no specs #BITTORRENT bitcomet.exe bitcometservice.exe sabsi.exe upnp.exe no specs werfault.exe no specs werfault.exe no specs upnp.exe installer.exe installer.exe servicehost.exe uihost.exe no specs updater.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs sabsi.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
232C:\WINDOWS\SysWOW64\WerFault.exe -u -p 1052 -s 3028C:\Windows\SysWOW64\WerFault.exeSecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1004"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"C:\Program Files\McAfee\WebAdvisor\servicehost.exe
services.exe
User:
SYSTEM
Company:
McAfee, LLC
Integrity Level:
SYSTEM
Description:
McAfee WebAdvisor(service)
Version:
4,1,1,1020
Modules
Images
c:\program files\mcafee\webadvisor\servicehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1052"C:\Users\admin\AppData\Local\Temp\is-QURTC.tmp\SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp" /SL5="$7027C,1635601,878080,C:\Users\admin\Desktop\SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.exe" /SPAWNWND=$1A02DC /NOTIFYWND=$9014C C:\Users\admin\AppData\Local\Temp\is-QURTC.tmp\SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp
SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.exe
User:
admin
Company:
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
3221226525
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-qurtc.tmp\securiteinfo.com.trojan.installcore.4099.24415.17034.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\mpr.dll
1760"C:\Program Files\BitComet\BitComet.exe" --no_elevatedC:\Program Files\BitComet\BitComet.exeSecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp
User:
admin
Company:
www.BitComet.com
Integrity Level:
HIGH
Description:
BitComet - a BitTorrent Client
Exit code:
4294967295
Version:
2.12
Modules
Images
c:\program files\bitcomet\bitcomet.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2108"C:\Users\admin\Desktop\SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.exe" /SPAWNWND=$1A02DC /NOTIFYWND=$9014C C:\Users\admin\Desktop\SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.exe
SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
BitComet Installer
Exit code:
3221226525
Version:
2.12.1.8
Modules
Images
c:\users\admin\desktop\securiteinfo.com.trojan.installcore.4099.24415.17034.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2600C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2644"C:\Users\admin\Desktop\saBSI.exe" C:\Users\admin\Desktop\saBSI.exeexplorer.exe
User:
admin
Company:
McAfee, LLC
Integrity Level:
MEDIUM
Description:
McAfee WebAdvisor(bootstrap installer)
Exit code:
3221226540
Version:
4,1,1,865
Modules
Images
c:\users\admin\desktop\sabsi.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
2800"C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe" /install /affid !UNKNOWN saBsiVersion=4.1.1.865 /no_self_updateC:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe
saBSI.exe
User:
admin
Company:
McAfee, LLC
Integrity Level:
HIGH
Description:
McAfee WebAdvisor(bootstrap installer)
Exit code:
0
Version:
4,1,1,1006
Modules
Images
c:\programdata\mcafee\webadvisor\sabsi\sabsi.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
2896"C:\Program Files\McAfee\Temp1326325341\installer.exe" /s /upgradeC:\Program Files\McAfee\Temp1326325341\installer.exe
installer.exe
User:
admin
Company:
McAfee, LLC
Integrity Level:
HIGH
Description:
McAfee WebAdvisor(installer)
Exit code:
0
Version:
4,1,1,1020
Modules
Images
c:\program files\mcafee\temp1326325341\installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\rpcrt4.dll
3096"C:\Users\admin\AppData\Local\Temp\is-2VQ2N.tmp\SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp" /SL5="$9014C,1635601,878080,C:\Users\admin\Desktop\SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.exe" C:\Users\admin\AppData\Local\Temp\is-2VQ2N.tmp\SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmpSecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
3221226525
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-2vq2n.tmp\securiteinfo.com.trojan.installcore.4099.24415.17034.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
Total events
52 590
Read events
52 299
Write events
270
Delete events
21

Modification events

(PID) Process:(6272) BitComet_2.12_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E8A058D1-C830-437F-A029-10D777A8DD40}\TypeLib
Operation:writeName:Version
Value:
1.0
(PID) Process:(6272) BitComet_2.12_setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\BitComet
Operation:writeName:InstallSettingCaptureIEDownload
Value:
0
(PID) Process:(6272) BitComet_2.12_setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\BitComet\BitComet
Operation:writeName:CaptureIEDownload
Value:
0
(PID) Process:(6272) BitComet_2.12_setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\BitComet
Operation:writeName:Install Date
Value:
20250428
(PID) Process:(6272) BitComet_2.12_setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\BitComet
Operation:writeName:NewInstall
Value:
1
(PID) Process:(6272) BitComet_2.12_setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\BitComet
Operation:writeName:PackageName
Value:
BitComet_2.12_setup.exe
(PID) Process:(6272) BitComet_2.12_setup.exeKey:HKEY_CLASSES_ROOT\.torrent
Operation:writeName:Content Type
Value:
application/x-bittorrent
(PID) Process:(6272) BitComet_2.12_setup.exeKey:HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/x-bittorrent
Operation:writeName:Extension
Value:
.torrent
(PID) Process:(6272) BitComet_2.12_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\bc
Operation:writeName:URL Protocol
Value:
(PID) Process:(6272) BitComet_2.12_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\BitCometAgent.DLL
Operation:writeName:AppID
Value:
{B99B5DF3-3AD2-463F-8F8C-86787623E1D5}
Executable files
45
Suspicious files
294
Text files
744
Unknown types
6

Dropped files

PID
Process
Filename
Type
1052SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmpC:\Users\admin\AppData\Local\Temp\is-N069K.tmp\is-EN4R8.tmp
MD5:
SHA256:
1052SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmpC:\Users\admin\AppData\Local\Temp\is-N069K.tmp\BitComet_2.12_setup.exe
MD5:
SHA256:
4244SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.exeC:\Users\admin\AppData\Local\Temp\is-2VQ2N.tmp\SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmpexecutable
MD5:B09C06DF6B37FFD9F39765F3C2DAF15E
SHA256:57DF8D5253F5C9FE6AC94359D9943AD40B2DED400B705BAF1FFB3FE5E5AAE8C7
6272BitComet_2.12_setup.exeC:\Users\admin\AppData\Local\Temp\nsrEABD.tmp\System.dllexecutable
MD5:E405C971FA29E1FD177E9A821A6369EF
SHA256:42C54657B37CF6363421052C4673514860E33BD08CFACA42DF00A4437821491B
1052SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmpC:\Users\admin\AppData\Local\Temp\is-N069K.tmp\WebAdvisor.pngimage
MD5:4CFFF8DC30D353CD3D215FD3A5DBAC24
SHA256:0C430E56D69435D8AB31CBB5916A73A47D11EF65B37D289EE7D11130ADF25856
1052SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmpC:\Users\admin\AppData\Local\Temp\is-N069K.tmp\is-ML9EI.tmpimage
MD5:CD3771BFEC21E8D8F1DB6588C5645515
SHA256:6DCA28F08A5198BF74C38B956963E6E4652D2649D87DF5ECF7BBE01A3C4645A7
1052SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmpC:\Users\admin\AppData\Local\Temp\is-N069K.tmp\error.pngimage
MD5:D034069F2920B2CAACC6C188A25FB333
SHA256:E52C2E9AA527E9A2F88E2D5BC2BC16590AC5998E622C338E6CE8E0039CA99F06
2108SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.exeC:\Users\admin\AppData\Local\Temp\is-QURTC.tmp\SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmpexecutable
MD5:B09C06DF6B37FFD9F39765F3C2DAF15E
SHA256:57DF8D5253F5C9FE6AC94359D9943AD40B2DED400B705BAF1FFB3FE5E5AAE8C7
1052SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmpC:\Users\admin\AppData\Local\Temp\is-N069K.tmp\zbShieldUtils.dllexecutable
MD5:CBDBBFBBCA6093D9DC462A59CCEA2713
SHA256:8AA3ECA63350A70CA97F39867F842DDCBB153254F58C0E97FADBDB528E2CAB79
1052SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmpC:\Users\admin\AppData\Local\Temp\is-N069K.tmp\prod0compressed
MD5:1C0964C9D7556CC5FC7D578A5EDAA5D7
SHA256:FE9727282D40EA088852575FD609FF533C25E157D1B30F5BC51A3C370F2AEC38
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
89
TCP/UDP connections
93
DNS requests
46
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
23.48.23.160:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
2104
svchost.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
GET
304
4.245.163.56:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
900
SIHClient.exe
GET
200
23.48.23.168:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
whitelisted
900
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
whitelisted
900
SIHClient.exe
GET
200
23.48.23.168:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
whitelisted
900
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
GET
200
20.3.187.198:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
unknown
900
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
whitelisted
GET
200
18.245.45.206:443
https://d1hboxy79wgmk4.cloudfront.net/f/BitComet/1695/BitComet_2.12_setup.exe
unknown
executable
35.3 Mb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
51.124.78.146:443
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
51.124.78.146:443
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
whitelisted
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2104
svchost.exe
23.48.23.160:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
1052
SecuriteInfo.com.Trojan.InstallCore.4099.24415.17034.tmp
18.245.45.231:443
d1hboxy79wgmk4.cloudfront.net
US
whitelisted
6544
svchost.exe
40.126.32.136:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
whitelisted
google.com
  • 216.58.206.78
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
crl.microsoft.com
  • 23.48.23.160
  • 23.48.23.155
  • 23.48.23.171
  • 23.48.23.162
  • 23.48.23.170
  • 23.48.23.157
  • 23.48.23.161
  • 23.48.23.153
  • 23.48.23.158
  • 23.48.23.168
  • 23.48.23.176
  • 23.48.23.174
  • 23.48.23.173
  • 23.48.23.193
  • 23.48.23.159
  • 23.48.23.192
  • 23.48.23.179
  • 23.48.23.183
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 23.35.229.160
whitelisted
d1hboxy79wgmk4.cloudfront.net
  • 18.245.45.231
  • 18.245.45.10
  • 18.245.45.206
  • 18.245.45.110
whitelisted
login.live.com
  • 40.126.32.136
  • 20.190.160.128
  • 40.126.32.140
  • 40.126.32.68
  • 20.190.160.5
  • 20.190.160.64
  • 20.190.160.14
  • 40.126.32.134
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
A Network Trojan was detected
ET ADWARE_PUP Win32/OfferCore Checkin M1
Generic Protocol Command Decode
SURICATA HTTP Request unrecognized authorization method
A Network Trojan was detected
ET ADWARE_PUP Win32/OfferCore Checkin M2
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] InnoSetup Installer
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] InnoSetup Installer
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
Potentially Bad Traffic
ET INFO Executable served from Amazon S3
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] InnoSetup Installer
3332
BitComet.exe
Misc activity
INFO [ANY.RUN] P2P BitTorrent Protocol
Process
Message
BitCometService.exe
BITCOMET_HELPER_SERVICE
BitCometService.exe
ServiceProcess lunched.