File name:

uTorrentPortable_3.5.5.46200_online.paf.exe

Full analysis: https://app.any.run/tasks/d3776ca5-d7f3-4cd4-b5ec-232c582d311f
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: July 06, 2022, 14:37:52
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

7A25565708D3D438D4BD54A8F6C33078

SHA1:

923D288339533303B9AF2660FEC2756E06C5020C

SHA256:

64D64EC72E1A79BCC077176C91E3528EBDC9BCE5E2B6D42A1E0E1B06989B062C

SSDEEP:

49152:rs9KnjygbWX+GsWitoOvS6hRvbTbN304im7Ii6f0EotCPjNpJyUTNSL6Lly:rBFbWX+buuSY9bXNk4imsiErotoNJAMQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • uTorrentPortable_3.5.5.46200_online.paf.exe (PID: 2844)
      • uTorrentPortable.exe (PID: 3724)
      • uTorrent.exe (PID: 4060)

    • Loads dropped or rewritten executable

      • uTorrentPortable_3.5.5.46200_online.paf.exe (PID: 2844)
      • uTorrentPortable.exe (PID: 3724)

    • Application was dropped or rewritten from another process

      • uTorrentPortable.exe (PID: 3724)
      • uTorrent.exe (PID: 4060)
      • utorrentie.exe (PID: 2600)
      • utorrentie.exe (PID: 3916)
      • utorrentie.exe (PID: 2540)

  • SUSPICIOUS

    • Reads the computer name

      • uTorrentPortable_3.5.5.46200_online.paf.exe (PID: 2844)
      • uTorrentPortable.exe (PID: 3724)
      • uTorrent.exe (PID: 4060)
      • utorrentie.exe (PID: 3916)
      • utorrentie.exe (PID: 2600)
      • utorrentie.exe (PID: 2540)

    • Drops a file with a compile date too recent

      • uTorrentPortable_3.5.5.46200_online.paf.exe (PID: 2844)
      • uTorrentPortable.exe (PID: 3724)
      • uTorrent.exe (PID: 4060)

    • Checks supported languages

      • uTorrentPortable.exe (PID: 3724)
      • uTorrentPortable_3.5.5.46200_online.paf.exe (PID: 2844)
      • uTorrent.exe (PID: 4060)
      • utorrentie.exe (PID: 2600)
      • utorrentie.exe (PID: 3916)
      • utorrentie.exe (PID: 2540)

    • Executable content was dropped or overwritten

      • uTorrentPortable.exe (PID: 3724)
      • uTorrentPortable_3.5.5.46200_online.paf.exe (PID: 2844)
      • uTorrent.exe (PID: 4060)

    • Creates a software uninstall entry

      • uTorrent.exe (PID: 4060)

    • Creates files in the user directory

      • uTorrent.exe (PID: 4060)

    • Searches for installed software

      • uTorrent.exe (PID: 4060)

    • Reads Microsoft Outlook installation path

      • utorrentie.exe (PID: 3916)
      • utorrentie.exe (PID: 2600)
      • utorrentie.exe (PID: 2540)

    • Reads CPU info

      • utorrentie.exe (PID: 3916)
      • utorrentie.exe (PID: 2600)

    • Reads internet explorer settings

      • utorrentie.exe (PID: 3916)
      • utorrentie.exe (PID: 2600)
      • utorrentie.exe (PID: 2540)

    • Changes IE settings (feature browser emulation)

      • uTorrent.exe (PID: 4060)

  • INFO

    • Checks Windows Trust Settings

      • uTorrent.exe (PID: 4060)
      • utorrentie.exe (PID: 3916)
      • utorrentie.exe (PID: 2600)

    • Dropped object may contain Bitcoin addresses

      • uTorrentPortable_3.5.5.46200_online.paf.exe (PID: 2844)

    • Reads settings of System Certificates

      • utorrentie.exe (PID: 3916)
      • utorrentie.exe (PID: 2600)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

ProductVersion: 3.5.5.46200
ProductName: uTorrent Portable
PortableAppscomInstallerVersion: 3.5.27.0
PortableAppscomFormatVersion: 3.5.27
PortableAppscomDownloadURL: http://downloads.portableapps.com/portableapps/utorrent/3.5.5.46200/uTorrent.exe
PortableAppscomDownloadName: uTorrent
PortableAppscomDownloadMD5: 7c4f15ea0f16f5bfd2e868d70aded600
PortableAppscomDownloadKnockURL: ${DownloadKnockURL}
PortableAppscomDownloadFileName: uTorrent.exe
PortableAppscomAppID: uTorrentPortable
OriginalFileName: uTorrentPortable_3.5.5.46200_online.paf.exe
LegalTrademarks: uTorrent is a trademark of BitTorrent, Inc.. PortableApps.com is a registered trademark of Rare Ideas, LLC.
LegalCopyright: 2007-2022 PortableApps.com, PortableApps.com Installer 3.5.27.0
InternalName: uTorrent Portable
FileVersion: 3.5.5.46200
FileDescription: uTorrent Portable
CompanyName: PortableApps.com
Comments: For additional details, visit PortableApps.com
CharacterSet: Unicode
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x0000
ProductVersionNumber: 3.5.5.46200
FileVersionNumber: 3.5.5.46200
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: 6
OSVersion: 4
EntryPoint: 0x3640
UninitializedDataSize: 16384
InitializedDataSize: 428544
CodeSize: 26624
LinkerVersion: 6
PEType: PE32
TimeStamp: 2021:09:26 00:04:50+02:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 25-Sep-2021 22:04:50
Detected languages:
  • English - United States
Comments: For additional details, visit PortableApps.com
CompanyName: PortableApps.com
FileDescription: uTorrent Portable
FileVersion: 3.5.5.46200
InternalName: uTorrent Portable
LegalCopyright: 2007-2022 PortableApps.com, PortableApps.com Installer 3.5.27.0
LegalTrademarks: uTorrent is a trademark of BitTorrent, Inc.. PortableApps.com is a registered trademark of Rare Ideas, LLC.
OriginalFilename: uTorrentPortable_3.5.5.46200_online.paf.exe
PortableApps.comAppID: uTorrentPortable
PortableApps.comDownloadFileName: uTorrent.exe
PortableApps.comDownloadKnockURL: ${DownloadKnockURL}
PortableApps.comDownloadMD5: 7c4f15ea0f16f5bfd2e868d70aded600
PortableApps.comDownloadName: uTorrent
PortableApps.comDownloadURL: http://downloads.portableapps.com/portableapps/utorrent/3.5.5.46200/uTorrent.exe
PortableApps.comFormatVersion: 3.5.27
PortableApps.comInstallerVersion: 3.5.27.0
ProductName: uTorrent Portable
ProductVersion: 3.5.5.46200

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000D8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 25-Sep-2021 22:04:50
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00006676
0x00006800
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.41581
.rdata
0x00008000
0x0000139A
0x00001400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.14107
.data
0x0000A000
0x00066378
0x00000600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.10645
.ndata
0x00071000
0x00194000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x00205000
0x0001D1C0
0x0001D200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.18407

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.28666
1249
UNKNOWN
English - United States
RT_MANIFEST
2
5.1717
9640
UNKNOWN
English - United States
RT_ICON
3
5.50995
4264
UNKNOWN
English - United States
RT_ICON
4
5.70014
3752
UNKNOWN
English - United States
RT_ICON
5
5.6488
2440
UNKNOWN
English - United States
RT_ICON
6
6.01856
2216
UNKNOWN
English - United States
RT_ICON
7
5.66656
1384
UNKNOWN
English - United States
RT_ICON
8
5.83657
1128
UNKNOWN
English - United States
RT_ICON
102
2.71813
180
UNKNOWN
English - United States
RT_DIALOG
103
2.80233
118
UNKNOWN
English - United States
RT_GROUP_ICON

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
6
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start utorrentportable_3.5.5.46200_online.paf.exe utorrentportable.exe utorrent.exe utorrentie.exe utorrentie.exe utorrentie.exe

Process information

PID
CMD
Path
Indicators
Parent process
2540"C:\uTorrentPortable\App\uTorrent\updates\3.5.5_46200\utorrentie.exe" uTorrent_4060_002C6338_950030378 µTorrent4823DF041B09 uTorrentC:\uTorrentPortable\App\uTorrent\updates\3.5.5_46200\utorrentie.exe
uTorrent.exe
User:
admin
Company:
BitTorrent Inc.
Integrity Level:
LOW
Description:
WebHelper
Exit code:
0
Version:
1.0.0
Modules
Images
c:\utorrentportable\app\utorrent\updates\3.5.5_46200\utorrentie.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\lpk.dll
2600"C:\uTorrentPortable\App\uTorrent\updates\3.5.5_46200\utorrentie.exe" uTorrent_4060_002C5CB0_1467119514 µTorrent4823DF041B09 uTorrentC:\uTorrentPortable\App\uTorrent\updates\3.5.5_46200\utorrentie.exe
uTorrent.exe
User:
admin
Company:
BitTorrent Inc.
Integrity Level:
LOW
Description:
WebHelper
Exit code:
0
Version:
1.0.0
Modules
Images
c:\utorrentportable\app\utorrent\updates\3.5.5_46200\utorrentie.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
2844"C:\Users\admin\AppData\Local\Temp\uTorrentPortable_3.5.5.46200_online.paf.exe" C:\Users\admin\AppData\Local\Temp\uTorrentPortable_3.5.5.46200_online.paf.exe
Explorer.EXE
User:
admin
Company:
PortableApps.com
Integrity Level:
MEDIUM
Description:
uTorrent Portable
Exit code:
0
Version:
3.5.5.46200
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\temp\utorrentportable_3.5.5.46200_online.paf.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\gdi32.dll
3724"C:\uTorrentPortable\uTorrentPortable.exe"C:\uTorrentPortable\uTorrentPortable.exe
uTorrentPortable_3.5.5.46200_online.paf.exe
User:
admin
Company:
PortableApps.com
Integrity Level:
MEDIUM
Description:
uTorrent Portable (PortableApps.com Launcher)
Exit code:
0
Version:
2.2.2.1
Modules
Images
c:\utorrentportable\utorrentportable.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
3916"C:\uTorrentPortable\App\uTorrent\updates\3.5.5_46200\utorrentie.exe" uTorrent_4060_002C6598_1612192969 µTorrent4823DF041B09 uTorrentC:\uTorrentPortable\App\uTorrent\updates\3.5.5_46200\utorrentie.exe
uTorrent.exe
User:
admin
Company:
BitTorrent Inc.
Integrity Level:
LOW
Description:
WebHelper
Exit code:
0
Version:
1.0.0
Modules
Images
c:\utorrentportable\app\utorrent\updates\3.5.5_46200\utorrentie.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\ole32.dll
c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
4060"C:\uTorrentPortable\App\uTorrent\uTorrent.exe"C:\uTorrentPortable\App\uTorrent\uTorrent.exe
uTorrentPortable.exe
User:
admin
Company:
BitTorrent Inc.
Integrity Level:
MEDIUM
Description:
µTorrent
Exit code:
0
Version:
3.5.5.46200
Modules
Images
c:\windows\system32\ntdll.dll
c:\utorrentportable\app\utorrent\utorrent.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
15 524
Read events
15 466
Write events
57
Delete events
1

Modification events

(PID) Process:(2844) uTorrentPortable_3.5.5.46200_online.paf.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2844) uTorrentPortable_3.5.5.46200_online.paf.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-2
Value:
Access the computers and devices that are on your network.
(PID) Process:(2844) uTorrentPortable_3.5.5.46200_online.paf.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:Browse For Folder Width
Value:
318
(PID) Process:(2844) uTorrentPortable_3.5.5.46200_online.paf.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:Browse For Folder Height
Value:
288
(PID) Process:(2844) uTorrentPortable_3.5.5.46200_online.paf.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2844) uTorrentPortable_3.5.5.46200_online.paf.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000003B010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2844) uTorrentPortable_3.5.5.46200_online.paf.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{362E934C-743B-4588-8259-D2482DB771A8}
Operation:writeName:WpadDecisionReason
Value:
1
(PID) Process:(2844) uTorrentPortable_3.5.5.46200_online.paf.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{362E934C-743B-4588-8259-D2482DB771A8}
Operation:writeName:WpadDecisionTime
Value:
C2E693074691D801
(PID) Process:(2844) uTorrentPortable_3.5.5.46200_online.paf.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{362E934C-743B-4588-8259-D2482DB771A8}
Operation:writeName:WpadDecision
Value:
0
(PID) Process:(2844) uTorrentPortable_3.5.5.46200_online.paf.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{362E934C-743B-4588-8259-D2482DB771A8}
Operation:writeName:WpadNetworkName
Value:
Network 4
Executable files
15
Suspicious files
36
Text files
77
Unknown types
7

Dropped files

PID
Process
Filename
Type
2844uTorrentPortable_3.5.5.46200_online.paf.exeC:\uTorrentPortable\uTorrentPortable.exeexecutable
MD5:—
SHA256:—
2844uTorrentPortable_3.5.5.46200_online.paf.exeC:\uTorrentPortable\App\AppInfo\EULA.txttext
MD5:—
SHA256:—
2844uTorrentPortable_3.5.5.46200_online.paf.exeC:\uTorrentPortable\App\AppInfo\AppInfo.iniini
MD5:—
SHA256:—
2844uTorrentPortable_3.5.5.46200_online.paf.exeC:\Users\admin\AppData\Local\Temp\nsb53D1.tmp\LangDLL.dllexecutable
MD5:68B287F4067BA013E34A1339AFDB1EA8
SHA256:18E8B40BA22C7A1687BD16E8D585380BC2773FFF5002D7D67E9485FCC0C51026
2844uTorrentPortable_3.5.5.46200_online.paf.exeC:\Users\admin\AppData\Local\Temp\nsb53D1.tmp\Downloaded\uTorrentexecutable
MD5:7C4F15EA0F16F5BFD2E868D70ADED600
SHA256:D91E240254EBB233F7F23FA1AFE91C12089EED919E9FF85E4CB7A8AEB04B5A51
2844uTorrentPortable_3.5.5.46200_online.paf.exeC:\uTorrentPortable\App\AppInfo\AppIcon_128.pngimage
MD5:7E88C90D7F3D8D141673B82E3F0C71F8
SHA256:43B1FA25889F80C9D0EDC79AF64BF72BCE10659B09BE776B7E611957DD037341
2844uTorrentPortable_3.5.5.46200_online.paf.exeC:\Users\admin\AppData\Local\Temp\nsb53D1.tmp\w7tbp.dllexecutable
MD5:9A3031CC4CEF0DBA236A28EECDF0AFB5
SHA256:53BB519E3293164947AC7CBD7E612F637D77A7B863E3534BA1A7E39B350D3C00
2844uTorrentPortable_3.5.5.46200_online.paf.exeC:\uTorrentPortable\App\AppInfo\AppIcon_16.pngimage
MD5:D04622250404ACD054392F7A53B693B3
SHA256:8FB87749822812BFDFCA3DEF1C7B9A2DA54531AEFE6BA0BEDB7836648D9C8F31
2844uTorrentPortable_3.5.5.46200_online.paf.exeC:\uTorrentPortable\App\AppInfo\AppIcon_75.pngimage
MD5:4211A1CD374D07F6BF830FED1B25DBCA
SHA256:8A206898A4B4F8B2895ACCF5351ADD4C733AA448D9B570041870295C5CCA1526
2844uTorrentPortable_3.5.5.46200_online.paf.exeC:\Users\admin\AppData\Local\Temp\nsb53D1.tmp\modern-header.bmpimage
MD5:D18DE279257C5530A264D7F2586ABF3D
SHA256:6DB8E54864E405A35FC2742D9A91D7BBBE44004B5FC49AEF27E1377BB957628C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
23
TCP/UDP connections
46
DNS requests
29
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4060
uTorrent.exe
GET
—
178.79.242.16:80
http://apps.bittorrent.com/utorrent-onboarding/welcome-upsell.btapp?h=3IkY0njF4SMH08Q4&v=111916152&ol=en&ul=&tk=stable34&c=uTorrent
DE
—
—
whitelisted
4060
uTorrent.exe
GET
—
178.79.242.16:80
http://apps.bittorrent.com/utorrent-onboarding/plus2.btapp?h=3IkY0njF4SMH08Q4&v=111916152&ol=en&ul=&tk=stable34&c=uTorrent
DE
—
—
whitelisted
2844
uTorrentPortable_3.5.5.46200_online.paf.exe
GET
307
98.129.229.242:80
http://downloads.portableapps.com/portableapps/utorrent/3.5.5.46200/uTorrent.exe
US
html
370 b
suspicious
4060
uTorrent.exe
GET
200
178.79.242.16:80
http://cdn.ap.bittorrent.com/control/tags/ut.json
DE
binary
23.7 Kb
shared
4060
uTorrent.exe
GET
—
178.79.242.16:80
http://apps.bittorrent.com/featuredcontent/featuredcontent.btapp?h=3IkY0njF4SMH08Q4&v=111916152&ol=en&ul=&tk=stable34&c=uTorrent
DE
—
—
whitelisted
2600
utorrentie.exe
GET
200
192.124.249.23:80
http://ocsp.godaddy.com//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D
US
der
1.69 Kb
whitelisted
2600
utorrentie.exe
GET
200
104.18.21.226:80
http://ocsp2.globalsign.com/rootr3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT1nGh%2FJBjWKnkPdZIzB1bqhelHBwQUj%2FBLf6guRSSuTVD6Y5qL3uLdG7wCEHr7M35ZTSPHb9t8TGKb2tY%3D
US
der
1.40 Kb
whitelisted
2600
utorrentie.exe
GET
200
104.18.21.226:80
http://ocsp2.globalsign.com/rootr3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT1nGh%2FJBjWKnkPdZIzB1bqhelHBwQUj%2FBLf6guRSSuTVD6Y5qL3uLdG7wCEHophRq39F1meVBmQbb%2F1x0%3D
US
der
1.40 Kb
whitelisted
2600
utorrentie.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?3664d359de9fdec1
US
compressed
60.2 Kb
whitelisted
2600
utorrentie.exe
GET
200
192.124.249.23:80
http://ocsp.godaddy.com//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D
US
der
1.66 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2844
uTorrentPortable_3.5.5.46200_online.paf.exe
98.129.229.242:80
downloads.portableapps.com
Liquid Web, L.L.C
US
suspicious
2844
uTorrentPortable_3.5.5.46200_online.paf.exe
51.81.32.118:80
download2.portableapps.com
—
GB
suspicious
4060
uTorrent.exe
54.225.179.233:80
i-21.b-46200.ut.bench.utorrent.com
Amazon.com, Inc.
US
suspicious
—
—
178.79.242.16:80
apps.bittorrent.com
Limelight Networks, Inc.
DE
suspicious
—
—
188.166.49.116:80
www.mininova.org
Digital Ocean, Inc.
NL
suspicious
3916
utorrentie.exe
178.79.242.16:80
apps.bittorrent.com
Limelight Networks, Inc.
DE
suspicious
2600
utorrentie.exe
178.79.242.181:443
video.trontv.com
Limelight Networks, Inc.
DE
suspicious
4060
uTorrent.exe
178.79.242.16:80
apps.bittorrent.com
Limelight Networks, Inc.
DE
suspicious
3916
utorrentie.exe
54.243.93.109:443
i-21.b-46200.ut.bench.utorrent.com
Amazon.com, Inc.
US
suspicious
2540
utorrentie.exe
178.79.242.181:80
video.trontv.com
Limelight Networks, Inc.
DE
suspicious

DNS requests

Domain
IP
Reputation
downloads.portableapps.com
  • 98.129.229.242
suspicious
download2.portableapps.com
  • 51.81.32.118
malicious
router.bittorrent.com
  • 67.215.246.10
shared
router.utorrent.com
  • 82.221.103.244
whitelisted
i-21.b-46200.ut.bench.utorrent.com
  • 54.225.179.233
  • 107.22.240.60
  • 50.19.114.184
  • 54.197.251.114
  • 54.225.194.96
  • 50.16.231.192
  • 54.243.93.109
  • 107.20.202.70
suspicious
apps.bittorrent.com
  • 178.79.242.16
whitelisted
www.mininova.org
  • 188.166.49.116
malicious
cdn.bitmedianetwork.com
  • 178.79.242.16
suspicious
cdn.ap.bittorrent.com
  • 178.79.242.16
shared
video.trontv.com
  • 178.79.242.181
suspicious

Threats

PID
Process
Class
Message
2844
uTorrentPortable_3.5.5.46200_online.paf.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
2844
uTorrentPortable_3.5.5.46200_online.paf.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
2844
uTorrentPortable_3.5.5.46200_online.paf.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
4060
uTorrent.exe
Potential Corporate Privacy Violation
ET P2P BTWebClient UA uTorrent in use
4060
uTorrent.exe
Potential Corporate Privacy Violation
ET P2P BTWebClient UA uTorrent in use
4060
uTorrent.exe
Potential Corporate Privacy Violation
ET P2P BTWebClient UA uTorrent in use
4060
uTorrent.exe
Potential Corporate Privacy Violation
ET P2P BitTorrent DHT ping request
4060
uTorrent.exe
Potential Corporate Privacy Violation
ET P2P BTWebClient UA uTorrent in use
4060
uTorrent.exe
Potential Corporate Privacy Violation
ET P2P BTWebClient UA uTorrent in use
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
uTorrentPortable_3.5.5.46200_online.paf.exe