analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://download.cnet.com/

Full analysis: https://app.any.run/tasks/4720115a-9845-4918-b5f1-f96666e84ef4
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: November 30, 2020, 02:42:36
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adware
slimware
loader
Indicators:
MD5:

6B8C8F9CA2BF5254A06D8AFE02B04658

SHA1:

464C29FDC9D651AD000E4255CC065AC4A2DA85EE

SHA256:

3939DCABB2430E4165C1583497F9A45E995AA57029FBF11E1F6F095CE2D8DFAE

SSDEEP:

3:N8SElbKK:2SKmK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • DriverUpdate-setup-c6c70d62-619e-4609-a60c-533fde116ed1.exe (PID: 3864)
      • DriverUpdate-setup-c6c70d62-619e-4609-a60c-533fde116ed1.exe (PID: 2812)
      • SlimWare.Session.exe (PID: 2516)
      • SlimWare.Services.exe (PID: 2924)
      • scpD47C.tmp.exe (PID: 312)
      • SlimServiceFactory.exe (PID: 2848)
      • SlimService.exe (PID: 1016)
      • SlimCleaner-setup.exe (PID: 3388)

    • SLIMWARE was detected

      • DriverUpdate-setup-c6c70d62-619e-4609-a60c-533fde116ed1.exe (PID: 2812)
      • SlimWare.Session.exe (PID: 2516)

    • Changes settings of System certificates

      • DriverUpdate-setup-c6c70d62-619e-4609-a60c-533fde116ed1.exe (PID: 2812)
      • SlimWare.Session.exe (PID: 2516)

    • Loads dropped or rewritten executable

      • DriverUpdate.exe (PID: 952)
      • SlimWare.Services.exe (PID: 2924)
      • csrss.exe (PID: 344)
      • SlimWare.Session.exe (PID: 2516)
      • explorer.exe (PID: 376)
      • svchost.exe (PID: 860)
      • SlimService.exe (PID: 1016)

    • Loads the Task Scheduler COM API

      • DriverUpdate.exe (PID: 952)

    • Changes the autorun value in the registry

      • DriverUpdate.exe (PID: 952)

    • Loads the Task Scheduler DLL interface

      • DriverUpdate.exe (PID: 952)

    • Connects to CnC server

      • SlimWare.Session.exe (PID: 2516)

  • SUSPICIOUS

    • Drops a file that was compiled in debug mode

      • chrome.exe (PID: 2128)
      • DriverUpdate-setup-c6c70d62-619e-4609-a60c-533fde116ed1.exe (PID: 2812)
      • msiexec.exe (PID: 1356)
      • scpD47C.tmp.exe (PID: 312)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 2128)
      • DriverUpdate-setup-c6c70d62-619e-4609-a60c-533fde116ed1.exe (PID: 2812)
      • msiexec.exe (PID: 1356)
      • DriverUpdate.exe (PID: 952)
      • scpD47C.tmp.exe (PID: 312)

    • Changes IE settings (feature browser emulation)

      • MsiExec.exe (PID: 2616)

    • Adds / modifies Windows certificates

      • DriverUpdate-setup-c6c70d62-619e-4609-a60c-533fde116ed1.exe (PID: 2812)
      • SlimWare.Session.exe (PID: 2516)

    • Creates a directory in Program Files

      • msiexec.exe (PID: 1356)

    • Creates COM task schedule object

      • msiexec.exe (PID: 1356)

    • Executed via COM

      • SlimWare.Session.exe (PID: 2516)
      • unsecapp.exe (PID: 3088)

    • Drops a file with too old compile date

      • msiexec.exe (PID: 1356)

    • Executed as Windows Service

      • SlimWare.Services.exe (PID: 2924)

    • Creates files in the Windows directory

      • svchost.exe (PID: 860)

    • Starts CMD.EXE for commands execution

      • MsiExec.exe (PID: 3464)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 1980)

    • Drops a file with a compile date too recent

      • msiexec.exe (PID: 1356)

  • INFO

    • Reads the hosts file

      • chrome.exe (PID: 2128)
      • chrome.exe (PID: 4000)

    • Application launched itself

      • chrome.exe (PID: 2128)
      • msiexec.exe (PID: 1356)
      • chrome.exe (PID: 3644)

    • Dropped object may contain Bitcoin addresses

      • msiexec.exe (PID: 1356)

    • Creates files in the program directory

      • msiexec.exe (PID: 1356)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 1356)

    • Reads settings of System Certificates

      • chrome.exe (PID: 4000)
      • SlimWare.Session.exe (PID: 2516)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
82
Monitored processes
43
Malicious processes
9
Suspicious processes
2

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start drop and start drop and start drop and start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs driverupdate-setup-c6c70d62-619e-4609-a60c-533fde116ed1.exe no specs #SLIMWARE driverupdate-setup-c6c70d62-619e-4609-a60c-533fde116ed1.exe msiexec.exe msiexec.exe no specs driverupdate.exe slimware.services.exe no specs csrss.exe no specs #SLIMWARE slimware.session.exe svchost.exe explorer.exe no specs unsecapp.exe no specs scpd47c.tmp.exe driverupdate.exe no specs slimcleaner-setup.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msiexec.exe no specs cmd.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs slimservice.exe no specs slimservicefactory.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2128"C:\Program Files\Google\Chrome\Application\chrome.exe" --disk-cache-dir=null --disk-cache-size=1 --media-cache-size=1 --disable-gpu-shader-disk-cache --disable-background-networking "https://download.cnet.com/"C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
2780"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=75.0.3770.100 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x71b1a9d0,0x71b1a9e0,0x71b1a9ecC:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
1824"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2132 --on-initialized-event-handle=316 --parent-handle=320 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
3244"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1032,11275635538881055376,9981705284021976719,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgACAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=1014490966699867508 --mojo-platform-channel-handle=1056 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
75.0.3770.100
4000"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1032,11275635538881055376,9981705284021976719,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=5869291256301009314 --mojo-platform-channel-handle=1472 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
564"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1032,11275635538881055376,9981705284021976719,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=8226475632644624812 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2068 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
2352"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1032,11275635538881055376,9981705284021976719,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=9946009695422319383 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2164 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
75.0.3770.100
3400"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1032,11275635538881055376,9981705284021976719,131072 --enable-features=PasswordImport --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=7240720595341016477 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2288 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
2552"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1032,11275635538881055376,9981705284021976719,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=18430609460675038884 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
1684"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1032,11275635538881055376,9981705284021976719,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=9397103870543248196 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
75.0.3770.100
Total events
4 539
Read events
3 740
Write events
0
Delete events
0

Modification events

No data
Executable files
64
Suspicious files
194
Text files
138
Unknown types
12

Dropped files

PID
Process
Filename
Type
2128chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-5FC45C28-850.pma —
MD5:—
SHA256:—
2128chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\6bfb2368-e215-411f-b89e-7e7433b4ffd0.tmp —
MD5:—
SHA256:—
2128chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000048.dbtmp —
MD5:—
SHA256:—
2128chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old —
MD5:—
SHA256:—
2128chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RF13f08d.TMPtext
MD5:C2DDBA63E4A2BD2E39A8B6C2C6384AAE
SHA256:6D5C1C78341C6F84911055D970ADDB0EC3499F8BF7FADE062122A22209CE67D9
2128chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.oldtext
MD5:D4322EEBAC92D1B8F7A6F5E39F6264B7
SHA256:A3EEDF21B850DCC7CE5AE04395ECDD2D29DA4EA549C8A185DD9E8B552A87B8C2
2128chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.oldtext
MD5:FB5B20517A0D1F7DAD485989565BEE5E
SHA256:99405F66EDBEB2306F4D0B4469DCADFF5293B5E1549C588CCFACEA439BB3B101
2128chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old~RF13f08d.TMPtext
MD5:FB5B20517A0D1F7DAD485989565BEE5E
SHA256:99405F66EDBEB2306F4D0B4469DCADFF5293B5E1549C588CCFACEA439BB3B101
2128chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RF13f06e.TMPtext
MD5:D4322EEBAC92D1B8F7A6F5E39F6264B7
SHA256:A3EEDF21B850DCC7CE5AE04395ECDD2D29DA4EA549C8A185DD9E8B552A87B8C2
2128chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
51
TCP/UDP connections
176
DNS requests
115
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2812
DriverUpdate-setup-c6c70d62-619e-4609-a60c-533fde116ed1.exe
GET
200
65.9.70.109:80
http://cdn.slimcleaner.com/downloads/silentdownloader/SlimCleanerPlus-Downloader.exe.bz2
US
compressed
136 Kb
whitelisted
2812
DriverUpdate-setup-c6c70d62-619e-4609-a60c-533fde116ed1.exe
POST
200
54.175.182.177:80
http://apps-api.slimwareutilities.com/rpc/installer-data/c6c70d62-619e-4609-a60c-533fde116ed1
US
text
909 b
malicious
312
scpD47C.tmp.exe
GET
301
54.175.182.177:80
http://apps-api.slimwareutilities.com/install/scp/6.1/x86/SlimCleaner-setup.exe?machineId=5BC50DB6-C184-44E6-8F59-30E5868C1DE8
US
—
—
malicious
312
scpD47C.tmp.exe
GET
200
3.224.125.34:80
http://stc.slimwareutilities.com/gettrack?product=SW1&p2=%5ESW2%5E%5E%5E&secondOfferOrigin=%5ESW1%5Exdm111&ul_stubid=9fa7ad61-e836-43ad-8c99-8094417b4407
US
—
—
shared
2812
DriverUpdate-setup-c6c70d62-619e-4609-a60c-533fde116ed1.exe
GET
200
65.9.68.57:80
http://download.driverupdate.net/5.8.15/x86/DriverUpdate-setup.msi.bz2
US
compressed
5.59 Mb
shared
2516
SlimWare.Session.exe
GET
200
54.205.104.89:80
http://trk.slimwareutilities.com/ulc.php?ev=Startup&platformOSVersion=6.1&installId=3BE57C02-76F5-468C-A400-44AF016115FF&browser=chrome&productVersion=5.8.15&product=SW2&hasUI=no&upl=YTo5OntzOjk6InVsX3N0dWJpZCI7czozNjoiOWZhN2FkNjEtZTgzNi00M2FkLThjOTktODA5NDQxN2I0NDA3IjtzOjEwOiJ1bF9jb2JyYW5kIjtzOjM6IlNXMiI7czo3OiJwcm9kdWN0IjtzOjM6IlNXMiI7czoxMjoidXNlclNlZ21lbnRzIjtPOjg6InN0ZENsYXNzIjoxOntzOjQ6IlNpdGUiO086ODoic3RkQ2xhc3MiOjI6e3M6NjoiRG9tYWluIjtzOjEyOiJzbGltd2FyZS5jb20iO3M6NDoiUGFnZSI7czoyMjoiL2Rvd25sb2FkL2RyaXZlcnVwZGF0ZSI7fX1zOjExOiJicm93c2VyVHlwZSI7czo2OiJDaHJvbWUiO3M6MTQ6ImJyb3dzZXJWZXJzaW9uIjtzOjEzOiI3NS4wLjM3NzAuMTAwIjtzOjE1OiJicm93c2VyTGFuZ3VhZ2UiO3M6NToiZW4tdXMiO3M6MTA6InBsYXRmb3JtT1MiO3M6NzoiV2luZG93cyI7czoxNzoicGxhdGZvcm1PU1ZlcnNpb24iO3M6MzoiNi4xIjt9&machineId=5BC50DB6-C184-44E6-8F59-30E5868C1DE8&isRegistered=no&platformOS=Windows&eventSource=SYSTEM
US
text
2 b
malicious
312
scpD47C.tmp.exe
GET
200
65.9.70.109:80
http://cdn.slimcleaner.com/downloads/4.3.0.79/x86/SlimCleaner-setup.exe
US
executable
7.76 Mb
whitelisted
2812
DriverUpdate-setup-c6c70d62-619e-4609-a60c-533fde116ed1.exe
GET
200
54.205.104.89:80
http://trk.slimwareutilities.com/ulc.php?ev=InstallerFinished&upl=YTo5OntzOjk6InVsX3N0dWJpZCI7czozNjoiOWZhN2FkNjEtZTgzNi00M2FkLThjOTktODA5NDQxN2I0NDA3IjtzOjEwOiJ1bF9jb2JyYW5kIjtzOjM6IlNXMiI7czo3OiJwcm9kdWN0IjtzOjM6IlNXMiI7czoxMjoidXNlclNlZ21lbnRzIjtPOjg6InN0ZENsYXNzIjoxOntzOjQ6IlNpdGUiO086ODoic3RkQ2xhc3MiOjI6e3M6NjoiRG9tYWluIjtzOjEyOiJzbGltd2FyZS5jb20iO3M6NDoiUGFnZSI7czoyMjoiL2Rvd25sb2FkL2RyaXZlcnVwZGF0ZSI7fX1zOjExOiJicm93c2VyVHlwZSI7czo2OiJDaHJvbWUiO3M6MTQ6ImJyb3dzZXJWZXJzaW9uIjtzOjEzOiI3NS4wLjM3NzAuMTAwIjtzOjE1OiJicm93c2VyTGFuZ3VhZ2UiO3M6NToiZW4tdXMiO3M6MTA6InBsYXRmb3JtT1MiO3M6NzoiV2luZG93cyI7czoxNzoicGxhdGZvcm1PU1ZlcnNpb24iO3M6MzoiNi4xIjt9&machineId=5BC50DB6-C184-44E6-8F59-30E5868C1DE8&platformOS=Windows&platformOSVersion=6.1&installer=LI0&installerVersion=2.24.6.42&product=SW2&installId=3BE57C02-76F5-468C-A400-44AF016115FF&productVersion=5.8.15.0
US
text
2 b
malicious
2812
DriverUpdate-setup-c6c70d62-619e-4609-a60c-533fde116ed1.exe
GET
200
54.205.104.89:80
http://trk.slimwareutilities.com/ulc.php?ev=InstallerInvoked&upl=YTo5OntzOjk6InVsX3N0dWJpZCI7czozNjoiOWZhN2FkNjEtZTgzNi00M2FkLThjOTktODA5NDQxN2I0NDA3IjtzOjEwOiJ1bF9jb2JyYW5kIjtzOjM6IlNXMiI7czo3OiJwcm9kdWN0IjtzOjM6IlNXMiI7czoxMjoidXNlclNlZ21lbnRzIjtPOjg6InN0ZENsYXNzIjoxOntzOjQ6IlNpdGUiO086ODoic3RkQ2xhc3MiOjI6e3M6NjoiRG9tYWluIjtzOjEyOiJzbGltd2FyZS5jb20iO3M6NDoiUGFnZSI7czoyMjoiL2Rvd25sb2FkL2RyaXZlcnVwZGF0ZSI7fX1zOjExOiJicm93c2VyVHlwZSI7czo2OiJDaHJvbWUiO3M6MTQ6ImJyb3dzZXJWZXJzaW9uIjtzOjEzOiI3NS4wLjM3NzAuMTAwIjtzOjE1OiJicm93c2VyTGFuZ3VhZ2UiO3M6NToiZW4tdXMiO3M6MTA6InBsYXRmb3JtT1MiO3M6NzoiV2luZG93cyI7czoxNzoicGxhdGZvcm1PU1ZlcnNpb24iO3M6MzoiNi4xIjt9&machineId=5BC50DB6-C184-44E6-8F59-30E5868C1DE8&platformOS=Windows&platformOSVersion=6.1&installer=LI0&installerVersion=2.24.6.42&product=SW2&msBclVersion=4.7.0
US
text
2 b
malicious
2812
DriverUpdate-setup-c6c70d62-619e-4609-a60c-533fde116ed1.exe
GET
200
54.205.104.89:80
http://trk.slimwareutilities.com/ulc.php?ev=TrackEvent&upl=YTo5OntzOjk6InVsX3N0dWJpZCI7czozNjoiOWZhN2FkNjEtZTgzNi00M2FkLThjOTktODA5NDQxN2I0NDA3IjtzOjEwOiJ1bF9jb2JyYW5kIjtzOjM6IlNXMiI7czo3OiJwcm9kdWN0IjtzOjM6IlNXMiI7czoxMjoidXNlclNlZ21lbnRzIjtPOjg6InN0ZENsYXNzIjoxOntzOjQ6IlNpdGUiO086ODoic3RkQ2xhc3MiOjI6e3M6NjoiRG9tYWluIjtzOjEyOiJzbGltd2FyZS5jb20iO3M6NDoiUGFnZSI7czoyMjoiL2Rvd25sb2FkL2RyaXZlcnVwZGF0ZSI7fX1zOjExOiJicm93c2VyVHlwZSI7czo2OiJDaHJvbWUiO3M6MTQ6ImJyb3dzZXJWZXJzaW9uIjtzOjEzOiI3NS4wLjM3NzAuMTAwIjtzOjE1OiJicm93c2VyTGFuZ3VhZ2UiO3M6NToiZW4tdXMiO3M6MTA6InBsYXRmb3JtT1MiO3M6NzoiV2luZG93cyI7czoxNzoicGxhdGZvcm1PU1ZlcnNpb24iO3M6MzoiNi4xIjt9&machineId=5BC50DB6-C184-44E6-8F59-30E5868C1DE8&platformOS=Windows&platformOSVersion=6.1&installer=LI0&installerVersion=2.24.6.42&product=SW2&installId=3BE57C02-76F5-468C-A400-44AF016115FF&description=InstallerScan-LI&result=installScanCompleted
US
text
2 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4000
chrome.exe
216.58.208.34:443
securepubads.g.doubleclick.net
Google Inc.
US
whitelisted
4000
chrome.exe
151.101.13.188:443
download.cnet.com
Fastly
US
malicious
4000
chrome.exe
151.101.65.188:443
at.cbsi.com
Fastly
US
unknown
4000
chrome.exe
13.224.190.125:443
static.chartbeat.com
—
US
unknown
4000
chrome.exe
104.75.88.141:443
c.go-mpulse.net
Akamai Technologies, Inc.
NL
unknown
4000
chrome.exe
172.217.12.205:443
accounts.google.com
Google Inc.
US
suspicious
4000
chrome.exe
104.16.148.64:443
cdn.cookielaw.org
Cloudflare Inc
US
unknown
4000
chrome.exe
142.250.80.10:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted
4000
chrome.exe
151.101.194.202:443
mab.chartbeat.com
Fastly
US
suspicious
4000
chrome.exe
104.20.185.68:443
geolocation.onetrust.com
Cloudflare Inc
US
shared

DNS requests

Domain
IP
Reputation
download.cnet.com
  • 151.101.13.188
whitelisted
accounts.google.com
  • 172.217.12.205
shared
cdn.cookielaw.org
  • 104.16.148.64
  • 104.16.149.64
whitelisted
cmg1.cbsistatic.com
  • 151.101.13.188
unknown
safebrowsing.googleapis.com
  • 142.250.80.10
whitelisted
c.go-mpulse.net
  • 104.75.88.141
whitelisted
dl1.cbsistatic.com
  • 151.101.13.188
whitelisted
at.cbsi.com
  • 151.101.65.188
  • 151.101.1.188
  • 151.101.129.188
  • 151.101.193.188
suspicious
static.chartbeat.com
  • 13.224.190.125
whitelisted
securepubads.g.doubleclick.net
  • 216.58.208.34
whitelisted

Threats

PID
Process
Class
Message
2812
DriverUpdate-setup-c6c70d62-619e-4609-a60c-533fde116ed1.exe
Generic Protocol Command Decode
SURICATA HTTP Request abnormal Content-Encoding header
2812
DriverUpdate-setup-c6c70d62-619e-4609-a60c-533fde116ed1.exe
Misc activity
ADWARE [PTsecurity] Win32/Slimware.A
2812
DriverUpdate-setup-c6c70d62-619e-4609-a60c-533fde116ed1.exe
Generic Protocol Command Decode
SURICATA HTTP Request abnormal Content-Encoding header
2812
DriverUpdate-setup-c6c70d62-619e-4609-a60c-533fde116ed1.exe
Generic Protocol Command Decode
SURICATA HTTP Request abnormal Content-Encoding header
2812
DriverUpdate-setup-c6c70d62-619e-4609-a60c-533fde116ed1.exe
Generic Protocol Command Decode
SURICATA HTTP Request abnormal Content-Encoding header
2812
DriverUpdate-setup-c6c70d62-619e-4609-a60c-533fde116ed1.exe
Generic Protocol Command Decode
SURICATA HTTP Request abnormal Content-Encoding header
2812
DriverUpdate-setup-c6c70d62-619e-4609-a60c-533fde116ed1.exe
Generic Protocol Command Decode
SURICATA HTTP Request abnormal Content-Encoding header
2516
SlimWare.Session.exe
Generic Protocol Command Decode
SURICATA HTTP Request abnormal Content-Encoding header
2516
SlimWare.Session.exe
Misc activity
ADWARE [PTsecurity] Win32/Slimware.A potentially unwanted Checkin
2516
SlimWare.Session.exe
Generic Protocol Command Decode
SURICATA HTTP Request abnormal Content-Encoding header
16 ETPRO signatures available at the full report
Process
Message
DriverUpdate-setup-c6c70d62-619e-4609-a60c-533fde116ed1.exe
Calling SetDllDirectory
DriverUpdate-setup-c6c70d62-619e-4609-a60c-533fde116ed1.exe
Loading C:\Windows\system32\BCRYPT.DLL
DriverUpdate-setup-c6c70d62-619e-4609-a60c-533fde116ed1.exe
Loading C:\Windows\system32\BCRYPT.DLL
DriverUpdate-setup-c6c70d62-619e-4609-a60c-533fde116ed1.exe
Loading C:\Windows\system32\RSAENH.DLL
DriverUpdate-setup-c6c70d62-619e-4609-a60c-533fde116ed1.exe
Loading C:\Windows\system32\CRYPT32.DLL
DriverUpdate-setup-c6c70d62-619e-4609-a60c-533fde116ed1.exe
Loading C:\Windows\system32\USERENV.DLL
DriverUpdate-setup-c6c70d62-619e-4609-a60c-533fde116ed1.exe
Loading C:\Windows\system32\USERENV.DLL
DriverUpdate-setup-c6c70d62-619e-4609-a60c-533fde116ed1.exe
Loading C:\Windows\system32\WINTRUST.DLL
DriverUpdate-setup-c6c70d62-619e-4609-a60c-533fde116ed1.exe
Loading C:\Windows\system32\GDIPLUS.DLL
DriverUpdate-setup-c6c70d62-619e-4609-a60c-533fde116ed1.exe
Loading C:\Windows\system32\MSI.DLL
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://download.cnet.com/