Malware analysis utorrent182.exe Malicious activity | ANY.RUN

Add for printing

File name:	utorrent182.exe
Full analysis:	https://app.any.run/tasks/db2c9d22-89b6-4903-bfbe-03563535f20f
Verdict:	Malicious activity
Threats:	A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. Malware Trends Tracker >>>
Analysis date:	May 16, 2025, 20:28:00
OS:	Windows 10 Professional (build: 19044, 64 bit)
Tags:	upx loader bittorrent
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 3 sections
MD5:	3AF137144D244E89ABE9FBF14829D1FA
SHA1:	4B8269442EA27090287DC7D520BF28E586773E21
SHA256:	639E5D2BF7B06CDE7CE729882F8EE41EA592B089067CAC5029E9140FC2427ED8
SSDEEP:	6144:yA2cfIGJVTdhdV8BYepIwdOgw5bY6rqX7L:yBY9rwBfWI6E6rqX7L

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Executing a file with an untrusted certificate
  - utorrent182.exe (PID: 7312)
  - utorrent182.exe (PID: 7948)
  - uTorrent.exe (PID: 8048)
- BITTORRENT has been detected (SURICATA)
  - uTorrent.exe (PID: 8048)
SUSPICIOUS
- Mutex name with non-standard characters
  - utorrent182.exe (PID: 7312)
  - uTorrent.exe (PID: 8048)
- There is functionality for taking screenshot (YARA)
  - utorrent182.exe (PID: 7312)
  - uTorrent.exe (PID: 8048)
- Reads security settings of Internet Explorer
  - utorrent182.exe (PID: 7312)
- Application launched itself
  - utorrent182.exe (PID: 7312)
- Potential Corporate Privacy Violation
  - utorrent182.exe (PID: 7312)
  - uTorrent.exe (PID: 8048)
- Executable content was dropped or overwritten
  - utorrent182.exe (PID: 7948)
- Starts itself from another location
  - utorrent182.exe (PID: 7312)
- Searches for installed software
  - utorrent182.exe (PID: 7948)
- Process requests binary or script from the Internet
  - utorrent182.exe (PID: 7312)
- Creates a software uninstall entry
  - utorrent182.exe (PID: 7948)
INFO
- Checks supported languages
  - utorrent182.exe (PID: 7312)
  - utorrent182.exe (PID: 7948)
  - uTorrent.exe (PID: 8048)
- The sample compiled with english language support
  - utorrent182.exe (PID: 7312)
  - utorrent182.exe (PID: 7948)
- Reads the computer name
  - utorrent182.exe (PID: 7312)
  - utorrent182.exe (PID: 7948)
  - uTorrent.exe (PID: 8048)
- Checks proxy server information
  - utorrent182.exe (PID: 7312)
- Reads the machine GUID from the registry
  - utorrent182.exe (PID: 7312)
  - utorrent182.exe (PID: 7948)
  - uTorrent.exe (PID: 8048)
- UPX packer has been detected
  - utorrent182.exe (PID: 7312)
  - uTorrent.exe (PID: 8048)
- Process checks computer location settings
  - utorrent182.exe (PID: 7312)
- Creates files in the program directory
  - utorrent182.exe (PID: 7948)
- Creates files or folders in the user directory
  - utorrent182.exe (PID: 7948)
  - utorrent182.exe (PID: 7312)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	UPX compressed Win32 Executable (39.3)
.exe	\|	Win32 EXE Yoda's Crypter (38.6)
.dll	\|	Win32 Dynamic Link Library (generic) (9.5)
.exe	\|	Win32 Executable (generic) (6.5)
.exe	\|	Generic Win/DOS Executable (2.9)

EXIF

EXE

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2009:05:05 20:07:52+00:00
ImageFileCharacteristics:	No relocs, Executable, 32-bit
PEType:	PE32
LinkerVersion:	8
CodeSize:	258048
InitializedDataSize:	16384
UninitializedDataSize:	417792
EntryPoint:	0xa4440
OSVersion:	4
ImageVersion:	-
SubsystemVersion:	4
Subsystem:	Windows GUI
FileVersionNumber:	1.8.2.15357
ProductVersionNumber:	1.8.2.15357
FileFlagsMask:	0x0000
FileFlags:	(none)
FileOS:	Unknown (0)
ObjectFileType:	Unknown
FileSubtype:	-
LanguageCode:	English (U.S.)
CharacterSet:	Windows, Latin1
CompanyName:	BitTorrent, Inc.
FileDescription:	µTorrent
FileVersion:	1.8.2.15357
LegalCopyright:	©2009 BitTorrent, Inc. All Rights Reserved.
ProductName:	µTorrent

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

137

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

7312

"C:\Users\admin\AppData\Local\Temp\utorrent182.exe"

C:\Users\admin\AppData\Local\Temp\utorrent182.exe

explorer.exe

User:

admin

Company:

BitTorrent, Inc.

Integrity Level:

MEDIUM

Description:

µTorrent

Exit code:

Version:

1.8.2.15357

Modules

Images
c:\users\admin\appdata\local\temp\utorrent182.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll

7396

C:\WINDOWS\system32\SppExtComObj.exe -Embedding

C:\Windows\System32\SppExtComObj.Exe

—

svchost.exe

User:

NETWORK SERVICE

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

KMS Connection Broker

Version:

10.0.19041.3996 (WinBuild.160101.0800)

7428

"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent

C:\Windows\System32\slui.exe

—

SppExtComObj.Exe

User:

NETWORK SERVICE

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Windows Activation Client

Version:

10.0.19041.1 (WinBuild.160101.0800)

7948

"C:\Users\admin\AppData\Local\Temp\utorrent182.exe" /PERFORMINSTALL 12751 "C:\Program Files (x86)\uTorrent"

C:\Users\admin\AppData\Local\Temp\utorrent182.exe

utorrent182.exe

User:

admin

Company:

BitTorrent, Inc.

Integrity Level:

HIGH

Description:

µTorrent

Exit code:

Version:

1.8.2.15357

Modules

Images
c:\users\admin\appdata\local\temp\utorrent182.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll

8004

C:\WINDOWS\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}

C:\Windows\SysWOW64\dllhost.exe

—

svchost.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

COM Surrogate

Exit code:

Version:

10.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ucrtbase.dll
c:\windows\syswow64\combase.dll

8048

uTorrent.exe /NOINSTALL /BRINGTOFRONT

C:\Program Files (x86)\uTorrent\uTorrent.exe

utorrent182.exe

User:

admin

Company:

BitTorrent, Inc.

Integrity Level:

MEDIUM

Description:

µTorrent

Version:

1.8.2.15357

Modules

Images
c:\program files (x86)\utorrent\utorrent.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll

Add for printing

Total events

1 602

Read events

1 590

Write events

Delete events

Modification events


(PID) Process:	(7948) utorrent182.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\BitTorrent\uTorrent
Operation:	write	Name:	Revision
Value: 15357
(PID) Process:	(7948) utorrent182.exe	Key:	HKEY_CLASSES_ROOT\.torrent\OpenWithProgids
Operation:	write	Name:	uTorrent
Value:
(PID) Process:	(7948) utorrent182.exe	Key:	HKEY_CLASSES_ROOT\.btsearch\OpenWithProgids
Operation:	write	Name:	uTorrent
Value:
(PID) Process:	(7948) utorrent182.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent
Operation:	write	Name:	DisplayIcon
Value: C:\Program Files (x86)\uTorrent\uTorrent.exe,0
(PID) Process:	(7948) utorrent182.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent
Operation:	write	Name:	DisplayName
Value: µTorrent
(PID) Process:	(7948) utorrent182.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent
Operation:	write	Name:	DisplayVersion
Value: 1.8.2
(PID) Process:	(7948) utorrent182.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent
Operation:	write	Name:	UninstallString
Value: "C:\Program Files (x86)\uTorrent\uTorrent.exe" /UNINSTALL
(PID) Process:	(7948) utorrent182.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent
Operation:	write	Name:	InstallLocation
Value: C:\Program Files (x86)\uTorrent
(PID) Process:	(7948) utorrent182.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent
Operation:	write	Name:	NoModify
Value: 1
(PID) Process:	(7948) utorrent182.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent
Operation:	write	Name:	NoRepair
Value: 1

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
7948	utorrent182.exe	C:\Program Files (x86)\uTorrent\uTorrent.exe		executable
		MD5:3AF137144D244E89ABE9FBF14829D1FA	SHA256:639E5D2BF7B06CDE7CE729882F8EE41EA592B089067CAC5029E9140FC2427ED8
7948	utorrent182.exe	C:\Users\admin\AppData\Roaming\uTorrent\settings.dat		binary
		MD5:5D15184C6CC3F67CD0B3479CC0E9E7F2	SHA256:4F835076AAA24F3DF958C49E03E04913CAA8E88F1DB1F63805F8C3A9029A55CF
7312	utorrent182.exe	C:\Users\admin\AppData\Roaming\uTorrent\settings.dat.old		binary
		MD5:5D15184C6CC3F67CD0B3479CC0E9E7F2	SHA256:4F835076AAA24F3DF958C49E03E04913CAA8E88F1DB1F63805F8C3A9029A55CF
7948	utorrent182.exe	C:\Users\admin\Desktop\µTorrent.lnk		binary
		MD5:974863D15090CD10E8CCA2ED72435320	SHA256:8B9E5FA766A0DA48416C4BE9D95EBFE940C114DCE33097DB1D858096872B9EC2
7948	utorrent182.exe	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\µTorrent.lnk		binary
		MD5:49EDA0F6728DB785431B40327200B0BE	SHA256:AF68A336199AF038ED39F06BC5DCB213B33E9C58709A0F5A3B43C24412D38213
7948	utorrent182.exe	C:\Users\admin\AppData\Roaming\uTorrent\settings.dat.new		binary
		MD5:5D15184C6CC3F67CD0B3479CC0E9E7F2	SHA256:4F835076AAA24F3DF958C49E03E04913CAA8E88F1DB1F63805F8C3A9029A55CF
7312	utorrent182.exe	C:\Users\admin\AppData\Roaming\uTorrent\settings.dat.new		binary
		MD5:21F056EAE869D41DBF173FC3664C3B3B	SHA256:FCB7765EC5FC631A7B7EABFBED7EF427C244A0F7D0D18D3011AE98573072D0AA
7948	utorrent182.exe	C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk		binary
		MD5:92EBD13C916491FD58D3E7D7BFA5F4DC	SHA256:628B704514BFFFD208136D99C2A6FF83089B3317194CB94B107E65C0F5692AC1
7312	utorrent182.exe	C:\Users\admin\AppData\Roaming\uTorrent\settings.dat		binary
		MD5:21F056EAE869D41DBF173FC3664C3B3B	SHA256:FCB7765EC5FC631A7B7EABFBED7EF427C244A0F7D0D18D3011AE98573072D0AA

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	200	2.16.168.124:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5496	MoUsoCoreWorker.exe	GET	200	2.23.246.101:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	GET	200	2.23.246.101:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
6544	svchost.exe	GET	200	2.23.77.188:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
7312	utorrent182.exe	GET	200	82.221.103.245:80	http://update.utorrent.com/installstats.php?v=50674685&h=mJCCmxBNzAZ8M3m8&w=23F00206&showwarning	unknown	—	—	whitelisted
7312	utorrent182.exe	GET	200	82.221.103.245:80	http://update.utorrent.com/installstats.php?v=50674685&h=mJCCmxBNzAZ8M3m8&w=23F00206&warningresult=1&exit=1	unknown	—	—	whitelisted
7312	utorrent182.exe	GET	200	82.221.103.245:80	http://update.utorrent.com/installstats.php?v=50674685&h=mJCCmxBNzAZ8M3m8&w=23F00206&showinstall	unknown	—	—	whitelisted
7312	utorrent182.exe	GET	200	82.221.103.245:80	http://update.utorrent.com/installstats.php?v=50674685&h=mJCCmxBNzAZ8M3m8&w=23F00206&installresult=12623&exit=6	unknown	—	—	whitelisted
7312	utorrent182.exe	GET	522	43.175.236.102:80	http://ll.download3.utorrent.com/offers/tb_ask-4.1.0.5.bmp	unknown	—	—	whitelisted
7312	utorrent182.exe	GET	200	82.221.103.245:80	http://update.utorrent.com/installstats.php?v=50674685&h=mJCCmxBNzAZ8M3m8&w=23F00206&tboffer&tb=1	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
—	—	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
—	—	2.16.168.124:80	crl.microsoft.com	Akamai International B.V.	RU	whitelisted
5496	MoUsoCoreWorker.exe	2.23.246.101:80	www.microsoft.com	Ooredoo Q.S.C.	QA	whitelisted
—	—	2.23.246.101:80	www.microsoft.com	Ooredoo Q.S.C.	QA	whitelisted
7312	utorrent182.exe	82.221.103.245:80	update.utorrent.com	Advania Island ehf	IS	whitelisted
3216	svchost.exe	172.211.123.250:443	client.wns.windows.com	MICROSOFT-CORP-MSN-AS-BLOCK	FR	whitelisted
6544	svchost.exe	20.190.159.129:443	login.live.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
6544	svchost.exe	2.23.77.188:80	ocsp.digicert.com	AKAMAI-AS	DE	whitelisted

DNS requests

Domain	IP	Reputation
google.com	172.217.16.142	whitelisted
settings-win.data.microsoft.com	40.127.240.158	whitelisted
crl.microsoft.com	2.16.168.124 2.16.168.114	whitelisted
www.microsoft.com	2.23.246.101 184.30.21.171	whitelisted
update.utorrent.com	82.221.103.245 82.221.103.246	whitelisted
client.wns.windows.com	172.211.123.250	whitelisted
login.live.com	20.190.159.129 20.190.159.71 40.126.31.2 40.126.31.69 40.126.31.1 40.126.31.131 40.126.31.0 40.126.31.67	whitelisted
ocsp.digicert.com	2.23.77.188	whitelisted
ll.download3.utorrent.com	43.175.236.102	whitelisted
router.bittorrent.com	67.215.246.10	whitelisted

Threats

PID	Process	Class	Message
7312	utorrent182.exe	Potential Corporate Privacy Violation	ET P2P Bittorrent P2P Client User-Agent (uTorrent)
7312	utorrent182.exe	Potential Corporate Privacy Violation	ET P2P Bittorrent P2P Client User-Agent (uTorrent)
7312	utorrent182.exe	Potential Corporate Privacy Violation	ET P2P Bittorrent P2P Client User-Agent (uTorrent)
7312	utorrent182.exe	Potential Corporate Privacy Violation	ET P2P Bittorrent P2P Client User-Agent (uTorrent)
7312	utorrent182.exe	Potential Corporate Privacy Violation	ET P2P Bittorrent P2P Client User-Agent (uTorrent)
7312	utorrent182.exe	Potential Corporate Privacy Violation	ET P2P Bittorrent P2P Client User-Agent (uTorrent)
8048	uTorrent.exe	Potential Corporate Privacy Violation	ET P2P BTWebClient UA uTorrent in use
8048	uTorrent.exe	Misc activity	INFO [ANY.RUN] P2P BitTorrent Protocol
7312	utorrent182.exe	Potential Corporate Privacy Violation	ET P2P Bittorrent P2P Client User-Agent (uTorrent)
7312	utorrent182.exe	Potential Corporate Privacy Violation	ET P2P Bittorrent P2P Client User-Agent (uTorrent)

Add for printing

No debug info

General Info

utorrent182.exe

3AF137144D244E89ABE9FBF14829D1FA

4B8269442EA27090287DC7D520BF28E586773E21

639E5D2BF7B06CDE7CE729882F8EE41EA592B089067CAC5029E9140FC2427ED8

6144:yA2cfIGJVTdhdV8BYepIwdOgw5bY6rqX7L:yBY9rwBfWI6E6rqX7L

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Executing a file with an untrusted certificate

BITTORRENT has been detected (SURICATA)

SUSPICIOUS

Mutex name with non-standard characters

There is functionality for taking screenshot (YARA)

Reads security settings of Internet Explorer

Application launched itself

Potential Corporate Privacy Violation

Executable content was dropped or overwritten

Starts itself from another location

Searches for installed software

Process requests binary or script from the Internet

Creates a software uninstall entry

INFO

Checks supported languages

The sample compiled with english language support

Reads the computer name

Checks proxy server information

Reads the machine GUID from the registry

UPX packer has been detected

Process checks computer location settings

Creates files in the program directory

Creates files or folders in the user directory

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Information

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings