File name:

8eb08322033f193a5e7ea16d83c0cd324efaaab628fb245bdb27f6977c2a6d86

Full analysis: https://app.any.run/tasks/a71ada1e-5c8e-4061-82df-5878e23dc84b
Verdict: Malicious activity
Threats:

GCleaner is a type of malware loader that has the capability to deliver numerous malicious software programs, which differ based on the location of the targeted victim. This malware is commonly spread through fraudulent websites that advertise free PC optimization tools

Malware Trends Tracker     >>>
Analysis date: July 11, 2025, 08:07:40
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto
gcleaner
loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

ECE1D1507B62C20327E999C6936A95A7

SHA1:

B512BB8131168CC268F487C655116A37D8B888D3

SHA256:

8EB08322033F193A5E7EA16D83C0CD324EFAAAB628FB245BDB27F6977C2A6D86

SSDEEP:

98304:YDJWQ+WliEl+bJKTmRioXMN9rbciB7LropD1XGtzAugKSih+mJJdzOY5IP1xLwwg:e7CHcd

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • 8eb08322033f193a5e7ea16d83c0cd324efaaab628fb245bdb27f6977c2a6d86.exe (PID: 4412)

    • GCLEANER has been found (auto)

      • 8eb08322033f193a5e7ea16d83c0cd324efaaab628fb245bdb27f6977c2a6d86.exe (PID: 4412)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • cvtres.exe (PID: 3800)

  • INFO

    • The sample compiled with english language support

      • 8eb08322033f193a5e7ea16d83c0cd324efaaab628fb245bdb27f6977c2a6d86.exe (PID: 4412)

    • Checks supported languages

      • 8eb08322033f193a5e7ea16d83c0cd324efaaab628fb245bdb27f6977c2a6d86.exe (PID: 4412)
      • cvtres.exe (PID: 3800)

    • Manual execution by a user

      • cvtres.exe (PID: 3800)

    • Reads the machine GUID from the registry

      • cvtres.exe (PID: 3800)
      • 8eb08322033f193a5e7ea16d83c0cd324efaaab628fb245bdb27f6977c2a6d86.exe (PID: 4412)

    • Reads the software policy settings

      • cvtres.exe (PID: 3800)

    • Creates files or folders in the user directory

      • cvtres.exe (PID: 3800)

    • Reads the computer name

      • cvtres.exe (PID: 3800)
      • 8eb08322033f193a5e7ea16d83c0cd324efaaab628fb245bdb27f6977c2a6d86.exe (PID: 4412)

    • Checks proxy server information

      • cvtres.exe (PID: 3800)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:09:09 08:08:20+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 14.1
CodeSize: 2385920
InitializedDataSize: 991744
UninitializedDataSize: -
EntryPoint: 0x1d5b87
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 10.0.0.0
ProductVersionNumber: 10.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: WiFi Password Key Generator Software
FileVersion: 10.0.0.0
LegalCopyright: Copyright (C) 2007-2019, All rights reserved
ProductName: WiFi Password Key Generator
ProductVersion: 10.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
130
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 8eb08322033f193a5e7ea16d83c0cd324efaaab628fb245bdb27f6977c2a6d86.exe no specs cvtres.exe

Process information

PID
CMD
Path
Indicators
Parent process
3800"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Version:
14.32.31326.0
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4412"C:\Users\admin\AppData\Local\Temp\8eb08322033f193a5e7ea16d83c0cd324efaaab628fb245bdb27f6977c2a6d86.exe" C:\Users\admin\AppData\Local\Temp\8eb08322033f193a5e7ea16d83c0cd324efaaab628fb245bdb27f6977c2a6d86.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
WiFi Password Key Generator Software
Exit code:
4294967295
Version:
10.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\8eb08322033f193a5e7ea16d83c0cd324efaaab628fb245bdb27f6977c2a6d86.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
685
Read events
685
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
3
Text files
0
Unknown types
3

Dropped files

PID
Process
Filename
Type
3800cvtres.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8der
MD5:1FBB37F79B317A9A248E7C4CE4F5BAC5
SHA256:9BF639C595FE335B6F694EE35990BEFD2123F5E07FD1973FF619E3FC88F5F49F
3800cvtres.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2A42127F349D54E7AA939366FF86F74E_F6AD3ACFD3F6A32178BCCDCB3AF6610Bder
MD5:C71D1E14C55AF58CC8AE9A7FB68696CC
SHA256:B99EE9AEBE10A44B4EE7B210A3675C7DF19D193591433887BEA809FA408C4854
3800cvtres.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:DE9547754DEA4F67372CA5FE0287B99F
SHA256:59A3ADF4EEC67CFBD69E46C97CAD67D7A7943C9EB508E4274105F930D4E757E6
3800cvtres.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2A42127F349D54E7AA939366FF86F74E_F6AD3ACFD3F6A32178BCCDCB3AF6610Bbinary
MD5:609224A6BEE7E2750F4EB22562F297AA
SHA256:DC5D4E36834117C253594B5A3BD1B34BD861258D6D081493FEFB4CDC13B39BDC
3800cvtres.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12der
MD5:CA8A9BDCA7AD59F5C8B7E1AA63160039
SHA256:81B7FA53B692B4D26E2E8943F2DDA2F9563CFCB0E11F48679EB2BE4F8C375B90
3800cvtres.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:73A3E9568C4ADC0F27A7AFBD098E624C
SHA256:7AC26D39B18DF7E2D78F5262FE63123B54E19311860B08A9189D4C9E49E73460
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
8
DNS requests
5
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.216.77.23:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6336
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
23.216.77.23:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
whitelisted
google.com
  • 142.250.186.110
whitelisted
crl.microsoft.com
  • 23.216.77.23
  • 23.216.77.18
  • 23.216.77.25
  • 23.216.77.4
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted

Threats

PID
Process
Class
Message
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
8eb08322033f193a5e7ea16d83c0cd324efaaab628fb245bdb27f6977c2a6d86