File name:

CyberLink_Promeo_Downloader.exe

Full analysis: https://app.any.run/tasks/e41a5d1b-f9b2-496b-ad95-b86232bea9f9
Verdict: Malicious activity
Analysis date: November 28, 2023, 01:09:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

137C8080F61AEF8DFD7D55EEDC3A31A9

SHA1:

91B288355045696540F087C5668D71D7DB04797D

SHA256:

00614252720F2E145A8F1626E060C076804FA0B4472689A5978EC6B79A6D499A

SSDEEP:

49152:51eti4dhPa8thJM0ErNd1/vwcGncBplLcOUKA3lVBZqx8r9Qlf0dAeQQcu:51eticPa8tArNdibKplQ13lrZqm2lfOh

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Steals credentials from Web Browsers

      • CyberLink_Promeo_Downloader.exe (PID: 4028)

    • Actions looks like stealing of personal data

      • CyberLink_Promeo_Downloader.exe (PID: 4028)
      • CyberLink_Promeo_Downloader.exe (PID: 3176)

  • SUSPICIOUS

    • Reads browser cookies

      • CyberLink_Promeo_Downloader.exe (PID: 4028)

    • Reads the Internet Settings

      • CyberLink_Promeo_Downloader.exe (PID: 4028)
      • CyberLink_Promeo_Downloader.exe (PID: 3176)

    • Reads settings of System Certificates

      • CyberLink_Promeo_Downloader.exe (PID: 4028)
      • CyberLink_Promeo_Downloader.exe (PID: 3176)

    • Checks Windows Trust Settings

      • CyberLink_Promeo_Downloader.exe (PID: 4028)
      • CyberLink_Promeo_Downloader.exe (PID: 3176)

    • Reads security settings of Internet Explorer

      • CyberLink_Promeo_Downloader.exe (PID: 4028)
      • CyberLink_Promeo_Downloader.exe (PID: 3176)

  • INFO

    • Checks supported languages

      • CyberLink_Promeo_Downloader.exe (PID: 4028)
      • wmpnscfg.exe (PID: 2584)
      • CyberLink_Promeo_Downloader.exe (PID: 3176)

    • Reads the machine GUID from the registry

      • CyberLink_Promeo_Downloader.exe (PID: 4028)
      • wmpnscfg.exe (PID: 2584)
      • CyberLink_Promeo_Downloader.exe (PID: 3176)

    • Reads the computer name

      • CyberLink_Promeo_Downloader.exe (PID: 4028)
      • wmpnscfg.exe (PID: 2584)
      • CyberLink_Promeo_Downloader.exe (PID: 3176)

    • Checks proxy server information

      • CyberLink_Promeo_Downloader.exe (PID: 4028)
      • CyberLink_Promeo_Downloader.exe (PID: 3176)

    • Process checks computer location settings

      • CyberLink_Promeo_Downloader.exe (PID: 4028)
      • CyberLink_Promeo_Downloader.exe (PID: 3176)

    • Create files in a temporary directory

      • CyberLink_Promeo_Downloader.exe (PID: 4028)
      • CyberLink_Promeo_Downloader.exe (PID: 3176)

    • Creates files in the program directory

      • CyberLink_Promeo_Downloader.exe (PID: 4028)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 2584)
      • CyberLink_Promeo_Downloader.exe (PID: 3176)

    • Creates files or folders in the user directory

      • CyberLink_Promeo_Downloader.exe (PID: 4028)
      • CyberLink_Promeo_Downloader.exe (PID: 3176)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:07:18 18:18:08+02:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 640000
InitializedDataSize: 520704
UninitializedDataSize: -
EntryPoint: 0x863ba
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 3.0.0.9118
ProductVersionNumber: 3.0.0.9118
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: CyberLink
FileDescription: CyberLink Downloader
FileVersion: 3.0.0.9118
InternalName: CLDownloader
LegalCopyright: Copyright (C) CyberLink Corporation. All rights reserved
OriginalFileName: CLDownloader.exe
ProductName: CLDownloader
ProductVersion: 3.0.0.9118
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start cyberlink_promeo_downloader.exe wmpnscfg.exe no specs cyberlink_promeo_downloader.exe cyberlink_promeo_downloader.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2584"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
2980"C:\Users\admin\AppData\Local\Temp\CyberLink_Promeo_Downloader.exe" C:\Users\admin\AppData\Local\Temp\CyberLink_Promeo_Downloader.exe—explorer.exe
User:
admin
Company:
CyberLink
Integrity Level:
MEDIUM
Description:
CyberLink Downloader
Exit code:
3221226540
Version:
3.0.0.9118
Modules
Images
c:\users\admin\appdata\local\temp\cyberlink_promeo_downloader.exe
c:\windows\system32\ntdll.dll
3176"C:\Users\admin\AppData\Local\Temp\CyberLink_Promeo_Downloader.exe" C:\Users\admin\AppData\Local\Temp\CyberLink_Promeo_Downloader.exe
explorer.exe
User:
admin
Company:
CyberLink
Integrity Level:
HIGH
Description:
CyberLink Downloader
Exit code:
0
Version:
3.0.0.9118
Modules
Images
c:\users\admin\appdata\local\temp\cyberlink_promeo_downloader.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wininet.dll
4028"C:\Users\admin\AppData\Local\Temp\CyberLink_Promeo_Downloader.exe" C:\Users\admin\AppData\Local\Temp\CyberLink_Promeo_Downloader.exe
explorer.exe
User:
admin
Company:
CyberLink
Integrity Level:
HIGH
Description:
CyberLink Downloader
Exit code:
0
Version:
3.0.0.9118
Modules
Images
c:\users\admin\appdata\local\temp\cyberlink_promeo_downloader.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wininet.dll
Total events
12 267
Read events
12 170
Write events
94
Delete events
3

Modification events

(PID) Process:(4028) CyberLink_Promeo_Downloader.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(4028) CyberLink_Promeo_Downloader.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000059010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4028) CyberLink_Promeo_Downloader.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(4028) CyberLink_Promeo_Downloader.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(4028) CyberLink_Promeo_Downloader.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(4028) CyberLink_Promeo_Downloader.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(4028) CyberLink_Promeo_Downloader.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4028) CyberLink_Promeo_Downloader.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4028) CyberLink_Promeo_Downloader.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FCC67766-6201-4AD1-A6B8-2F4553C93D47}
Operation:writeName:WpadDecisionReason
Value:
1
(PID) Process:(4028) CyberLink_Promeo_Downloader.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FCC67766-6201-4AD1-A6B8-2F4553C93D47}
Operation:writeName:WpadDecisionTime
Value:
B018B88A9721DA01
Executable files
0
Suspicious files
23
Text files
93
Unknown types
4

Dropped files

PID
Process
Filename
Type
4028CyberLink_Promeo_Downloader.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
4028CyberLink_Promeo_Downloader.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\U20J14KP.txttext
MD5:E1BE0CE9331C7D5596DE16FF6A8838DE
SHA256:—
4028CyberLink_Promeo_Downloader.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_D93C575AD9E9AF9B95268A3CB953B5A1binary
MD5:31D338582553DE823893840515106B19
SHA256:—
4028CyberLink_Promeo_Downloader.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:092E9E90984EAACE1AC7A6E8A83ADBF9
SHA256:—
4028CyberLink_Promeo_Downloader.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
4028CyberLink_Promeo_Downloader.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\4Q9JIL3Q.txttext
MD5:E71D8D6D622B9B3BDD668DCEDD18D348
SHA256:—
4028CyberLink_Promeo_Downloader.exeC:\ProgramData\CyberLink\Downloader\Item0.initext
MD5:F3B25701FE362EC84616A93A45CE9998
SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
4028CyberLink_Promeo_Downloader.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9915FBCE5ECE56452A09FB65EDE2FAD2_8F7D75A9886FCC7456204A535FDA93D2binary
MD5:C14BE4C1301E0BD73DC85DDC42D7FA38
SHA256:—
4028CyberLink_Promeo_Downloader.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\V155MK5D.txttext
MD5:291803525E3615453003B34C3F2DBA50
SHA256:—
4028CyberLink_Promeo_Downloader.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_D93C575AD9E9AF9B95268A3CB953B5A1der
MD5:781ACFB1E2D42E29956C9FECC649E9CC
SHA256:F4C204514EEC61A4487F015F7708889A2176D7E344CA5A904AC2120438870788
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
72
DNS requests
23
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4028
CyberLink_Promeo_Downloader.exe
GET
200
184.24.77.194:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f96c9c0907b9ecd4
unknown
—
4.66 Kb
unknown
4028
CyberLink_Promeo_Downloader.exe
GET
200
184.24.77.194:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?69835f913cf8ac2b
unknown
—
4.66 Kb
unknown
4028
CyberLink_Promeo_Downloader.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJaiu8Zb34NbCEEshrmcCs%3D
unknown
—
471 b
unknown
4028
CyberLink_Promeo_Downloader.exe
GET
200
192.229.221.95:80
http://status.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSFvn094QJ%2BcWGTwWWEy%2BBXPZkW8AQUo8heZVTlMHjBBeoHCmpZzLn%2B3loCEAnOrRNxqwzZwccRJ7GTMmg%3D
unknown
—
471 b
unknown
1080
svchost.exe
GET
304
184.24.77.194:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8c278ce706dba7cc
unknown
—
—
unknown
1080
svchost.exe
GET
200
184.24.77.194:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?68971ffabf4767b1
unknown
—
61.6 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
4028
CyberLink_Promeo_Downloader.exe
54.213.190.95:443
dna.cyberlink.com
AMAZON-02
US
unknown
2588
svchost.exe
239.255.255.250:1900
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4028
CyberLink_Promeo_Downloader.exe
75.2.35.53:443
downloader.cyberlink.com
AMAZON-02
US
unknown
4028
CyberLink_Promeo_Downloader.exe
184.24.77.194:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
4028
CyberLink_Promeo_Downloader.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
unknown
1080
svchost.exe
184.24.77.194:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
4028
CyberLink_Promeo_Downloader.exe
18.66.147.66:443
fcs.cyberlink.com
AMAZON-02
US
unknown

DNS requests

Domain
IP
Reputation
dna.cyberlink.com
  • 54.213.190.95
  • 34.211.90.44
  • 100.20.177.156
unknown
downloader.cyberlink.com
  • 75.2.35.53
  • 99.83.161.79
unknown
ctldl.windowsupdate.com
  • 184.24.77.194
  • 184.24.77.202
unknown
ocsp.digicert.com
  • 192.229.221.95
unknown
status.thawte.com
  • 192.229.221.95
unknown
fcs.cyberlink.com
  • 18.66.147.66
  • 18.66.147.16
  • 18.66.147.28
  • 18.66.147.86
unknown
liveupdate.cyberlink.com
  • 34.210.216.118
  • 35.80.131.217
  • 52.35.51.172
unknown
www.cyberlink.com
  • 75.2.35.53
  • 99.83.161.79
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
CyberLink_Promeo_Downloader.exe