File name:

uTorrent.exe

Full analysis: https://app.any.run/tasks/875dc5a2-32ab-4de2-b885-d72661317d51
Verdict: Malicious activity
Analysis date: June 25, 2022, 12:49:47
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
installer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

A1DD2F1AE9790D39852D8216CC0764A1

SHA1:

AF3C126B46B8C33C01304C621F0FF9A13D3DA4AF

SHA256:

AA6A9387BDAF3C1ECC34E51404A49D5D97FB9ACE4F08B7AC3B3558A41EAC87F4

SSDEEP:

24576:V4nXubIQGyxbPV0db26sd5r9n2Zymuz7lnAjEHLcfVLKswfsk:Vqe3f6+92yh71SaLcfxOfsk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • uTorrent.exe (PID: 328)
      • uTorrent.tmp (PID: 3304)
      • uTorrent.exe (PID: 2944)
      • uTorrent.exe (PID: 1932)
      • uTorrent.exe (PID: 448)

    • Changes the autorun value in the registry

      • uTorrent.exe (PID: 1932)
      • uTorrent.exe (PID: 448)

    • Application was dropped or rewritten from another process

      • saBSI.exe (PID: 3524)
      • uTorrent.exe (PID: 448)
      • utorrentie.exe (PID: 3232)
      • utorrentie.exe (PID: 3436)

    • Changes settings of System certificates

      • saBSI.exe (PID: 3524)

  • SUSPICIOUS

    • Drops a file with a compile date too recent

      • uTorrent.exe (PID: 2944)
      • uTorrent.exe (PID: 328)
      • uTorrent.tmp (PID: 3304)
      • uTorrent.exe (PID: 1932)
      • uTorrent.exe (PID: 448)

    • Executable content was dropped or overwritten

      • uTorrent.exe (PID: 2944)
      • uTorrent.exe (PID: 328)
      • uTorrent.tmp (PID: 3304)
      • uTorrent.exe (PID: 448)
      • uTorrent.exe (PID: 1932)

    • Reads the computer name

      • uTorrent.tmp (PID: 3304)
      • uTorrent.tmp (PID: 3320)
      • saBSI.exe (PID: 3524)
      • uTorrent.exe (PID: 1932)
      • uTorrent.exe (PID: 448)
      • utorrentie.exe (PID: 3232)
      • utorrentie.exe (PID: 3436)

    • Checks supported languages

      • uTorrent.exe (PID: 328)
      • uTorrent.tmp (PID: 3304)
      • uTorrent.exe (PID: 2944)
      • uTorrent.tmp (PID: 3320)
      • uTorrent.exe (PID: 1932)
      • saBSI.exe (PID: 3524)
      • uTorrent.exe (PID: 448)
      • utorrentie.exe (PID: 3232)
      • utorrentie.exe (PID: 3436)

    • Reads Windows owner or organization settings

      • uTorrent.tmp (PID: 3304)

    • Reads the Windows organization settings

      • uTorrent.tmp (PID: 3304)

    • Creates files in the user directory

      • uTorrent.exe (PID: 1932)
      • uTorrent.exe (PID: 448)
      • utorrentie.exe (PID: 3232)

    • Creates files in the program directory

      • saBSI.exe (PID: 3524)

    • Changes default file association

      • uTorrent.exe (PID: 1932)

    • Adds / modifies Windows certificates

      • saBSI.exe (PID: 3524)

    • Searches for installed software

      • uTorrent.exe (PID: 448)

    • Changes IE settings (feature browser emulation)

      • uTorrent.exe (PID: 448)

    • Starts Internet Explorer

      • uTorrent.exe (PID: 448)

    • Reads internet explorer settings

      • utorrentie.exe (PID: 3436)
      • utorrentie.exe (PID: 3232)

    • Reads Microsoft Outlook installation path

      • utorrentie.exe (PID: 3436)
      • iexplore.exe (PID: 3380)
      • utorrentie.exe (PID: 3232)

    • Reads CPU info

      • utorrentie.exe (PID: 3436)

  • INFO

    • Reads settings of System Certificates

      • uTorrent.tmp (PID: 3304)
      • saBSI.exe (PID: 3524)
      • utorrentie.exe (PID: 3232)
      • utorrentie.exe (PID: 3436)
      • iexplore.exe (PID: 3004)

    • Application was dropped or rewritten from another process

      • uTorrent.tmp (PID: 3320)
      • uTorrent.tmp (PID: 3304)
      • uTorrent.exe (PID: 1932)

    • Creates a software uninstall entry

      • uTorrent.exe (PID: 1932)

    • Checks Windows Trust Settings

      • uTorrent.exe (PID: 1932)
      • saBSI.exe (PID: 3524)
      • uTorrent.exe (PID: 448)
      • utorrentie.exe (PID: 3232)
      • utorrentie.exe (PID: 3436)
      • iexplore.exe (PID: 3004)

    • Loads dropped or rewritten executable

      • uTorrent.tmp (PID: 3304)

    • Checks supported languages

      • iexplore.exe (PID: 3004)
      • iexplore.exe (PID: 3380)

    • Changes internet zones settings

      • iexplore.exe (PID: 3004)

    • Reads the computer name

      • iexplore.exe (PID: 3004)
      • iexplore.exe (PID: 3380)

    • Application launched itself

      • iexplore.exe (PID: 3004)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3380)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (65.1)
.exe | Win32 EXE PECompact compressed (generic) (24.6)
.dll | Win32 Dynamic Link Library (generic) (3.9)
.exe | Win32 Executable (generic) (2.6)
.exe | Win16/32 Executable Delphi generic (1.2)

EXIF

EXE

ProductVersion: 3.5
ProductName: µTorrent® Classic
OriginalFileName:
LegalCopyright: ©2020 BitTorrent, Inc. All Rights Reserved
FileVersion: 3.5
FileDescription: µTorrent® Classic
CompanyName:
Comments: This installation was built with Inno Setup.
CharacterSet: Unicode
LanguageCode: Neutral
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 3.5.0.0
FileVersionNumber: 3.5.0.0
Subsystem: Windows GUI
SubsystemVersion: 6.1
ImageVersion: 6
OSVersion: 6.1
EntryPoint: 0xb5eec
UninitializedDataSize: -
InitializedDataSize: 72704
CodeSize: 741376
LinkerVersion: 2.25
PEType: PE32
TimeStamp: 2021:06:03 10:09:11+02:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 03-Jun-2021 08:09:11
Detected languages:
  • English - United States
Comments: This installation was built with Inno Setup.
CompanyName: -
FileDescription: µTorrent® Classic
FileVersion: 3.5
LegalCopyright: ©2020 BitTorrent, Inc. All Rights Reserved
OriginalFileName: -
ProductName: µTorrent® Classic
ProductVersion: 3.5

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0050
Pages in file: 0x0002
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x000F
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x001A
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000100

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 10
Time date stamp: 03-Jun-2021 08:09:11
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_BYTES_REVERSED_HI
  • IMAGE_FILE_BYTES_REVERSED_LO
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x000B361C
0x000B3800
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.35606
.itext
0x000B5000
0x00001688
0x00001800
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
5.97275
.data
0x000B7000
0x000037A4
0x00003800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.0444
.bss
0x000BB000
0x00006DE8
0x00000000
IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.idata
0x000C2000
0x00000F36
0x00001000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.8987
.didata
0x000C3000
0x000001A4
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
2.75636
.edata
0x000C4000
0x0000009A
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
1.87222
.tls
0x000C5000
0x00000018
0x00000000
IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rdata
0x000C6000
0x0000005D
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
1.38389
.rsrc
0x000C7000
0x0000CCE8
0x0000CE00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.70558

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.18295
1830
Latin 1 / Western European
English - United States
RT_MANIFEST
2
5.46918
2440
Latin 1 / Western European
English - United States
RT_ICON
3
5.0586
4264
Latin 1 / Western European
English - United States
RT_ICON
4
4.54687
9640
Latin 1 / Western European
English - United States
RT_ICON
5
7.96969
21583
Latin 1 / Western European
English - United States
RT_ICON
4086
3.16547
864
Latin 1 / Western European
UNKNOWN
RT_STRING
4087
3.40938
608
Latin 1 / Western European
UNKNOWN
RT_STRING
4088
3.31153
1116
Latin 1 / Western European
UNKNOWN
RT_STRING
4089
3.33977
1036
Latin 1 / Western European
UNKNOWN
RT_STRING
4090
3.36723
724
Latin 1 / Western European
UNKNOWN
RT_STRING

Imports

advapi32.dll
comctl32.dll
kernel32.dll
kernel32.dll (delay-loaded)
netapi32.dll
oleaut32.dll
user32.dll
version.dll

Exports

Title
Ordinal
Address
dbkFCallWrapperAddr
1
0x000BE63C
__dbk_fcall_wrapper
2
0x0000D0A0
TMethodImplementationIntercept
3
0x00054060
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
50
Monitored processes
11
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start drop and start drop and start drop and start utorrent.exe utorrent.tmp no specs utorrent.exe utorrent.tmp utorrent.exe sabsi.exe utorrent.exe utorrentie.exe utorrentie.exe iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
328"C:\Users\admin\AppData\Local\Temp\uTorrent.exe" /SPAWNWND=$20130 /NOTIFYWND=$20138 C:\Users\admin\AppData\Local\Temp\uTorrent.exe
uTorrent.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
µTorrent® Classic
Exit code:
0
Version:
3.5
Modules
Images
c:\users\admin\appdata\local\temp\utorrent.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\shlwapi.dll
448"C:\Users\admin\AppData\Roaming\uTorrent\uTorrent.exe"C:\Users\admin\AppData\Roaming\uTorrent\uTorrent.exe
uTorrent.tmp
User:
admin
Company:
BitTorrent Inc.
Integrity Level:
HIGH
Description:
µTorrent
Exit code:
0
Version:
3.5.5.46304
Modules
Images
c:\users\admin\appdata\roaming\utorrent\utorrent.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
1932"C:\Users\admin\AppData\Local\Temp\is-LL5V0.tmp\uTorrent.exe" /S /FORCEINSTALL 1110010101111110C:\Users\admin\AppData\Local\Temp\is-LL5V0.tmp\uTorrent.exe
uTorrent.tmp
User:
admin
Company:
BitTorrent Inc.
Integrity Level:
HIGH
Description:
µTorrent
Exit code:
1
Version:
3.5.5.46304
Modules
Images
c:\users\admin\appdata\local\temp\is-ll5v0.tmp\utorrent.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
2944"C:\Users\admin\AppData\Local\Temp\uTorrent.exe" C:\Users\admin\AppData\Local\Temp\uTorrent.exe
Explorer.EXE
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
µTorrent® Classic
Exit code:
0
Version:
3.5
Modules
Images
c:\users\admin\appdata\local\temp\utorrent.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3004"C:\Program Files\Internet Explorer\iexplore.exe" http://utorrent.com/prodnews?v=3%2e5%2e5%2e1%2e46304&pv=0.0.0.0.0C:\Program Files\Internet Explorer\iexplore.exe
uTorrent.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
3232"C:\Users\admin\AppData\Roaming\uTorrent\updates\3.5.5_46304\utorrentie.exe" uTorrent_448_02E571C8_1431641624 µTorrent4823DF041B09 uTorrent ieC:\Users\admin\AppData\Roaming\uTorrent\updates\3.5.5_46304\utorrentie.exe
uTorrent.exe
User:
admin
Company:
BitTorrent Inc.
Integrity Level:
LOW
Description:
WebHelper
Exit code:
0
Version:
1.0.0
Modules
Images
c:\users\admin\appdata\roaming\utorrent\updates\3.5.5_46304\utorrentie.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3304"C:\Users\admin\AppData\Local\Temp\is-6AHQU.tmp\uTorrent.tmp" /SL5="$2013A,881024,815104,C:\Users\admin\AppData\Local\Temp\uTorrent.exe" /SPAWNWND=$20130 /NOTIFYWND=$20138 C:\Users\admin\AppData\Local\Temp\is-6AHQU.tmp\uTorrent.tmp
uTorrent.exe
User:
admin
Company:
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-6ahqu.tmp\utorrent.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3320"C:\Users\admin\AppData\Local\Temp\is-L9MIQ.tmp\uTorrent.tmp" /SL5="$20138,881024,815104,C:\Users\admin\AppData\Local\Temp\uTorrent.exe" C:\Users\admin\AppData\Local\Temp\is-L9MIQ.tmp\uTorrent.tmp—uTorrent.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\temp\is-l9miq.tmp\utorrent.tmp
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3380"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3004 CREDAT:275457 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3436"C:\Users\admin\AppData\Roaming\uTorrent\updates\3.5.5_46304\utorrentie.exe" uTorrent_448_02DE7CE8_1532321600 µTorrent4823DF041B09 uTorrent ieC:\Users\admin\AppData\Roaming\uTorrent\updates\3.5.5_46304\utorrentie.exe
uTorrent.exe
User:
admin
Company:
BitTorrent Inc.
Integrity Level:
LOW
Description:
WebHelper
Exit code:
0
Version:
1.0.0
Modules
Images
c:\users\admin\appdata\roaming\utorrent\updates\3.5.5_46304\utorrentie.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
28 923
Read events
28 571
Write events
345
Delete events
7

Modification events

(PID) Process:(3304) uTorrent.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
E80C0000E4A015119288D801
(PID) Process:(3304) uTorrent.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
0794A81602534FE29F04D0753D2A1F30C03751FF3D4E225BDEBA71AF8B1377B0
(PID) Process:(3304) uTorrent.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(3304) uTorrent.tmpKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1932) uTorrent.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1932) uTorrent.exeKey:HKEY_CURRENT_USER\Software\BitTorrent
Operation:writeName:computerID
Value:
9CAEF501CD6162DFAC520DCBA6E2915B2ED93A93B7DCD168
(PID) Process:(1932) uTorrent.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(1932) uTorrent.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000003B010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1932) uTorrent.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1932) uTorrent.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
9
Suspicious files
28
Text files
49
Unknown types
19

Dropped files

PID
Process
Filename
Type
1932uTorrent.exeC:\Users\admin\AppData\Local\Temp\utt472C.tmp —
MD5:—
SHA256:—
1932uTorrent.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\1f91d2d17ea675d4c2c3192e241743f9_90059c37-1320-41a4-b58d-2b75a9850d2fbinary
MD5:—
SHA256:—
1932uTorrent.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\µTorrent.lnklnk
MD5:—
SHA256:—
1932uTorrent.exeC:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnklnk
MD5:—
SHA256:—
1932uTorrent.exeC:\Users\admin\AppData\Roaming\uTorrent\settings.dat.newbinary
MD5:—
SHA256:—
3304uTorrent.tmpC:\Users\admin\AppData\Local\Temp\is-LL5V0.tmp\WebAdvisor.pngimage
MD5:8E33326078C4CC8439E43A21DA50B2E3
SHA256:01ADAD87D078004D4006C4BD46CF58901D3595D1A9401CE106326AAC335C0EAE
448uTorrent.exeC:\Users\admin\AppData\Local\Temp\utt6A74.tmp —
MD5:—
SHA256:—
3304uTorrent.tmpC:\Users\admin\AppData\Local\Temp\is-LL5V0.tmp\prod0compressed
MD5:D6BE5546BBCE27020B742C5966838158
SHA256:49082EF6E5B8CEAC180171309611EAC88DAC603684CDE04E3725945A6722BCE2
1932uTorrent.exeC:\Users\admin\AppData\Roaming\uTorrent\settings.datbinary
MD5:—
SHA256:—
1932uTorrent.exeC:\Users\admin\AppData\Roaming\uTorrent\maindoc.icoimage
MD5:B768B1F1A8C26BABBBC31FC551336221
SHA256:663775C46DCE1CA8B104642374F93215A1B1E5E2AFD7618B69D6EBF056AFA5F1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
37
TCP/UDP connections
71
DNS requests
51
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1932
uTorrent.exe
GET
200
82.221.103.246:80
http://update.utorrent.li/installstats.php?cl=uTorrent&v=111916256&h=zWFi36xSDcum4pFb&w=1DB10106&bu=0&pr=0&cmp=0&ocmp=0&showinstall&pid=1932&cau=0&lunv=0&au=0&view=win32
IS
—
—
whitelisted
448
uTorrent.exe
GET
—
173.254.195.58:80
http://update.bittorrent.com/time.php
US
—
—
whitelisted
448
uTorrent.exe
GET
—
178.79.242.181:80
http://apps.bittorrent.com/utorrent-onboarding/player.btapp
DE
—
—
whitelisted
1932
uTorrent.exe
GET
200
82.221.103.246:80
http://update.utorrent.li/installstats.php?cl=uTorrent&v=111916256&h=zWFi36xSDcum4pFb&w=1DB10106&bu=0&pr=0&cmp=0&ocmp=0&installresult&pid=1932&cau=0&lunv=0&installresult=0&exit=1&au=0&ic=1&view=win32
IS
—
—
whitelisted
448
uTorrent.exe
GET
200
178.79.242.181:80
http://cdn.ap.bittorrent.com/control/feature/tags/ut.json
DE
binary
2.85 Kb
shared
448
uTorrent.exe
GET
200
178.79.242.16:80
http://cdn.ap.bittorrent.com/control/tags/ut.json
DE
binary
23.6 Kb
shared
3232
utorrentie.exe
GET
200
192.124.249.36:80
http://ocsp.godaddy.com//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D
US
der
1.66 Kb
whitelisted
448
uTorrent.exe
POST
200
54.243.113.215:80
http://i-29.b-46304.ut.bench.utorrent.com/e?i=29
US
binary
21 b
suspicious
448
uTorrent.exe
POST
200
54.243.58.192:80
http://i-32.b-46304.ut.bench.utorrent.com/e?i=32
US
binary
21 b
suspicious
448
uTorrent.exe
POST
200
50.19.114.184:80
http://i-21.b-46304.ut.bench.utorrent.com/e?i=21
US
binary
21 b
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3304
uTorrent.tmp
143.204.101.180:443
d4w1kp01cnm54.cloudfront.net
—
US
unknown
3304
uTorrent.tmp
143.204.214.198:443
d1kdfd0mvwu9ig.cloudfront.net
—
US
malicious
3304
uTorrent.tmp
13.33.244.214:443
d3cfdnjelz8u20.cloudfront.net
—
US
unknown
3524
saBSI.exe
104.208.16.0:443
cu1pehnswad01.servicebus.windows.net
Microsoft Corporation
US
unknown
—
—
23.35.236.229:443
sadownload.mcafee.com
Zayo Bandwidth Inc
US
suspicious
448
uTorrent.exe
173.254.195.58:80
update.bittorrent.com
QuadraNet, Inc
US
suspicious
3304
uTorrent.tmp
108.156.253.141:443
d4bohzj3dmv4j.cloudfront.net
—
US
whitelisted
3524
saBSI.exe
23.35.236.229:443
sadownload.mcafee.com
Zayo Bandwidth Inc
US
suspicious
3436
utorrentie.exe
178.79.242.181:80
apps.bittorrent.com
Limelight Networks, Inc.
DE
suspicious
1932
uTorrent.exe
82.221.103.246:80
update.utorrent.li
Thor Data Center ehf
IS
suspicious

DNS requests

Domain
IP
Reputation
d4w1kp01cnm54.cloudfront.net
  • 143.204.101.180
  • 143.204.101.56
  • 143.204.101.203
  • 143.204.101.114
whitelisted
d3cfdnjelz8u20.cloudfront.net
  • 13.33.244.214
  • 13.33.244.122
  • 13.33.244.107
  • 13.33.244.209
whitelisted
d4bohzj3dmv4j.cloudfront.net
  • 108.156.253.141
  • 108.156.253.36
  • 108.156.253.176
  • 108.156.253.164
whitelisted
d1kdfd0mvwu9ig.cloudfront.net
  • 143.204.214.198
  • 143.204.214.150
  • 143.204.214.34
  • 143.204.214.184
suspicious
router.bittorrent.com
  • 67.215.246.10
shared
router.utorrent.com
  • 82.221.103.244
whitelisted
update.utorrent.li
  • 82.221.103.246
  • 82.221.103.245
whitelisted
cu1pehnswad01.servicebus.windows.net
  • 104.208.16.0
whitelisted
apis.mosaic.analytics.awscommon.mcafee.com
  • 54.186.116.32
  • 44.228.56.39
unknown
sadownload.mcafee.com
  • 23.35.236.229
whitelisted

Threats

PID
Process
Class
Message
1932
uTorrent.exe
Potential Corporate Privacy Violation
ET P2P Bittorrent P2P Client User-Agent (uTorrent)
1932
uTorrent.exe
Potential Corporate Privacy Violation
ET P2P Bittorrent P2P Client User-Agent (uTorrent)
3524
saBSI.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
3524
saBSI.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
448
uTorrent.exe
Potential Corporate Privacy Violation
ET P2P BTWebClient UA uTorrent in use
448
uTorrent.exe
Potential Corporate Privacy Violation
ET P2P BTWebClient UA uTorrent in use
448
uTorrent.exe
Potential Corporate Privacy Violation
ET P2P BTWebClient UA uTorrent in use
448
uTorrent.exe
Potential Corporate Privacy Violation
ET P2P BitTorrent DHT ping request
Process
Message
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in current directory
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in EXE directory
saBSI.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\is-LL5V0.tmp\prod0_extract\saBSI.exe loading C:\Users\admin\AppData\Local\Temp\is-LL5V0.tmp\prod0_extract\mfeaaca.dll, WinVerifyTrust failed with 80092003
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in current directory
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in EXE directory
saBSI.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\is-LL5V0.tmp\prod0_extract\saBSI.exe loading C:\Users\admin\AppData\Local\Temp\is-LL5V0.tmp\prod0_extract\mfeaaca.dll, WinVerifyTrust failed with 80092003
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in current directory
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in EXE directory
saBSI.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\is-LL5V0.tmp\prod0_extract\saBSI.exe loading C:\Users\admin\AppData\Local\Temp\is-LL5V0.tmp\prod0_extract\mfeaaca.dll, WinVerifyTrust failed with 80092003
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in current directory
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
uTorrent.exe