download:

clean_master_1_1.exe

Full analysis: https://app.any.run/tasks/3a9d4ae4-392d-45f3-aa4b-61b41f47d55e
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: September 17, 2019, 10:16:01
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adware
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5:

26017BC0F9A14316E5B6BB0D7AE77EFC

SHA1:

8DE6EB35DBF044FCA51213FC2232FEB3A9B9DD6F

SHA256:

A2884990DB488DCC8E9C27AD0F441B874D511D79C5D6818535C06843516B2CC3

SSDEEP:

393216:YztbLFMgcPwHDuuNWJIiJyNADILn8nf838NM0AzzLCxhDU0w+I7wrqib3yDKxU:cnFGPMDGJIiJy5ofWAMnzLCxy0NI8DbE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • clean_master_1_1.exe (PID: 2656)

    • Loads dropped or rewritten executable

      • cmtray.exe (PID: 3152)
      • clean_master_1_1.exe (PID: 2656)
      • cmcore.exe (PID: 2548)
      • cmtray.exe (PID: 3476)
      • kismain.exe (PID: 3236)
      • cmtray.exe (PID: 2416)
      • feedbackwin.exe (PID: 2512)
      • feedbackwin.exe (PID: 2900)
      • kismain.exe (PID: 2356)
      • cmtray.exe (PID: 2660)
      • cmlicense.exe (PID: 3348)
      • cmtray.exe (PID: 3468)
      • cmtray.exe (PID: 3548)
      • cmlive.exe (PID: 3928)

    • Application was dropped or rewritten from another process

      • cmcore.exe (PID: 2548)
      • cmtray.exe (PID: 3152)
      • cmtray.exe (PID: 3476)
      • kismain.exe (PID: 3236)
      • cmtray.exe (PID: 2416)
      • feedbackwin.exe (PID: 2512)
      • feedbackwin.exe (PID: 2900)
      • cmtray.exe (PID: 2660)
      • kismain.exe (PID: 2356)
      • cmlicense.exe (PID: 3348)
      • cmtray.exe (PID: 3468)
      • cmtray.exe (PID: 3548)
      • cmlive.exe (PID: 3928)

    • Actions looks like stealing of personal data

      • cmtray.exe (PID: 3152)
      • cmtray.exe (PID: 3548)

    • Loads the Task Scheduler DLL interface

      • cmtray.exe (PID: 3152)

    • Changes the login/logoff helper path in the registry

      • cmtray.exe (PID: 3152)

    • Loads the Task Scheduler COM API

      • cmtray.exe (PID: 3152)

  • SUSPICIOUS

    • Creates files in the Windows directory

      • clean_master_1_1.exe (PID: 2656)

    • Writes to a desktop.ini file (may be used to cloak folders)

      • clean_master_1_1.exe (PID: 2656)
      • cmtray.exe (PID: 3152)

    • Creates COM task schedule object

      • clean_master_1_1.exe (PID: 2656)

    • Executed as Windows Service

      • cmcore.exe (PID: 2548)
      • SearchIndexer.exe (PID: 3224)

    • Creates a software uninstall entry

      • clean_master_1_1.exe (PID: 2656)
      • cmtray.exe (PID: 3152)
      • cmtray.exe (PID: 3548)

    • Creates files in the driver directory

      • clean_master_1_1.exe (PID: 2656)

    • Creates files in the user directory

      • cmtray.exe (PID: 3152)
      • cmtray.exe (PID: 3548)

    • Searches for installed software

      • cmtray.exe (PID: 3152)
      • cmtray.exe (PID: 3548)

    • Executable content was dropped or overwritten

      • clean_master_1_1.exe (PID: 2656)
      • cmtray.exe (PID: 3152)

    • Creates files in the program directory

      • clean_master_1_1.exe (PID: 2656)
      • cmtray.exe (PID: 3152)
      • SearchIndexer.exe (PID: 3224)
      • feedbackwin.exe (PID: 2900)
      • cmlicense.exe (PID: 3348)
      • cmtray.exe (PID: 3548)
      • cmlive.exe (PID: 3928)
      • cmtray.exe (PID: 3468)

    • Removes files from Windows directory

      • cmtray.exe (PID: 3152)

    • Reads the cookies of Google Chrome

      • cmtray.exe (PID: 3152)

    • Creates or modifies windows services

      • cmtray.exe (PID: 3152)

    • Reads the cookies of Mozilla Firefox

      • cmtray.exe (PID: 3152)

    • Reads Internet Cache Settings

      • cmtray.exe (PID: 3152)

    • Uses RUNDLL32.EXE to load library

      • cmtray.exe (PID: 3152)

    • Application launched itself

      • cmtray.exe (PID: 3468)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • clean_master_1_1.exe (PID: 2656)
      • cmtray.exe (PID: 3152)

    • Manual execution by user

      • cmtray.exe (PID: 3468)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (30.7)
.exe | UPX compressed Win32 Executable (30.1)
.exe | Win32 EXE Yoda's Crypter (29.5)
.exe | Win32 Executable (generic) (5)
.exe | Generic Win/DOS Executable (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1970:01:07 08:19:28+01:00
PEType: PE32
LinkerVersion: 8
CodeSize: 458752
InitializedDataSize: 90112
UninitializedDataSize: 602112
EntryPoint: 0x1035b0
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2018.1.3.1009
ProductVersionNumber: 9.3.667.240
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: Cheetah Mobile,Inc.
FileVersion: 2017,12,05,240
LegalCopyright: Copyright(c) 2011-2017 Cheetah Mobile,Inc.
ProductName: Clean Master For PC
ProductVersion: 9,3,328347,240

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 07-Jan-1970 07:19:28
Detected languages:
  • Chinese - PRC
  • English - United States
CompanyName: Cheetah Mobile,Inc.
FileVersion: 2017,12,05,240
LegalCopyright: Copyright(c) 2011-2017 Cheetah Mobile,Inc.
ProductName: Clean Master For PC
ProductVersion: 9,3,328347,240

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000F8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 3
Time date stamp: 07-Jan-1970 07:19:28
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
UPX0
0x00001000
0x00093000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
UPX1
0x00094000
0x00070000
0x0006F800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.93015
.rsrc
0x00104000
0x00016000
0x00015400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.68883

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.08469
934
Latin 1 / Western European
English - United States
RT_MANIFEST
2
5.92517
9640
Latin 1 / Western European
Chinese - PRC
RT_ICON
3
5.88285
4264
Latin 1 / Western European
Chinese - PRC
RT_ICON
4
7.74234
9640
Latin 1 / Western European
Chinese - PRC
RT_ICON
5
7.70728
4264
Latin 1 / Western European
Chinese - PRC
RT_ICON
6
7.60149
1128
Latin 1 / Western European
Chinese - PRC
RT_ICON
100
7.41195
1323
Latin 1 / Western European
Chinese - PRC
XML
101
7.78794
2843
Latin 1 / Western European
Chinese - PRC
XML
1000
7.81228
2884
Latin 1 / Western European
Chinese - PRC
PNG
1001
7.72939
1420
Latin 1 / Western European
Chinese - PRC
PNG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.DLL
MSIMG32.dll
OLEAUT32.dll
SHELL32.dll
SHLWAPI.dll
USER32.dll
VERSION.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
62
Monitored processes
20
Malicious processes
10
Suspicious processes
5

Behavior graph

Click at the process to see the details
drop and start drop and start start clean_master_1_1.exe cmcore.exe no specs cmtray.exe cmtray.exe no specs kismain.exe no specs cmtray.exe no specs searchindexer.exe no specs searchprotocolhost.exe no specs searchfilterhost.exe no specs searchprotocolhost.exe no specs rundll32.exe no specs feedbackwin.exe no specs feedbackwin.exe no specs kismain.exe no specs cmtray.exe no specs cmlicense.exe no specs cmtray.exe no specs cmtray.exe cmlive.exe clean_master_1_1.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
344"C:\Windows\system32\SearchFilterHost.exe" 0 512 516 524 65536 520 C:\Windows\system32\SearchFilterHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Windows Search Filter Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchfilterhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2256"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\system32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2356"C:\program files\cmcm\Clean Master\kismain.exe" /tool /exepath:driver_booster\cmdriverbooster.exe /toolname:bootdriverC:\program files\cmcm\Clean Master\kismain.exe—cmtray.exe
User:
admin
Company:
Cheetah Mobile,Inc.
Integrity Level:
HIGH
Exit code:
3221225547
Version:
2017,10,31,122
Modules
Images
c:\program files\cmcm\clean master\kismain.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
2416"C:\program files\cmcm\Clean Master\cmtray.exe" /kismain /settingC:\program files\cmcm\Clean Master\cmtray.exe—kismain.exe
User:
admin
Company:
Cheetah Mobile,Inc.
Integrity Level:
HIGH
Exit code:
1
Version:
2017,12,14,288
Modules
Images
c:\program files\cmcm\clean master\cmtray.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2452"C:\Windows\system32\rundll32.exe" inetCpl.cpl,ClearMyTracksByProcess Flags:449C:\Windows\system32\rundll32.exe—cmtray.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
2512"C:\program files\cmcm\Clean Master\feedbackwin.exe" /from:kismainC:\program files\cmcm\Clean Master\feedbackwin.exe—cmtray.exe
User:
admin
Company:
Cheetah Mobile,Inc.
Integrity Level:
HIGH
Exit code:
0
Version:
2017,12,13,284
Modules
Images
c:\program files\cmcm\clean master\feedbackwin.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2548"c:\program files\cmcm\Clean Master\cmcore.exe" /service cmcorec:\program files\cmcm\Clean Master\cmcore.exe—services.exe
User:
SYSTEM
Company:
Cheetah Mobile,Inc.
Integrity Level:
SYSTEM
Exit code:
0
Version:
2017,12,13,283
Modules
Images
c:\program files\cmcm\clean master\cmcore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2656"C:\Users\admin\Desktop\clean_master_1_1.exe" C:\Users\admin\Desktop\clean_master_1_1.exe
explorer.exe
User:
admin
Company:
Cheetah Mobile,Inc.
Integrity Level:
HIGH
Exit code:
0
Version:
2017,12,05,240
Modules
Images
c:\users\admin\desktop\clean_master_1_1.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
2660"C:\program files\cmcm\Clean Master\cmtray.exe" /kismain /tool /exepath:driver_booster\cmdriverbooster.exe /toolname:bootdriverC:\program files\cmcm\Clean Master\cmtray.exe—kismain.exe
User:
admin
Company:
Cheetah Mobile,Inc.
Integrity Level:
HIGH
Exit code:
1
Version:
2017,12,14,288
Modules
Images
c:\program files\cmcm\clean master\cmtray.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2864"C:\Users\admin\Desktop\clean_master_1_1.exe" C:\Users\admin\Desktop\clean_master_1_1.exe—explorer.exe
User:
admin
Company:
Cheetah Mobile,Inc.
Integrity Level:
MEDIUM
Exit code:
3221226540
Version:
2017,12,05,240
Modules
Images
c:\users\admin\desktop\clean_master_1_1.exe
c:\systemroot\system32\ntdll.dll
Total events
3 078
Read events
2 617
Write events
405
Delete events
56

Modification events

(PID) Process:(2656) clean_master_1_1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\cmpc
Operation:writeName:ProgramPath
Value:
c:\program files\cmcm\Clean Master\
(PID) Process:(2656) clean_master_1_1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\cmpc
Operation:writeName:InstallVersion
Value:
6.0
(PID) Process:(2656) clean_master_1_1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\cmpc
Operation:writeName:PackageVersion
Value:
6.0
(PID) Process:(2656) clean_master_1_1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\cmpc
Operation:writeName:Lang
Value:
English
(PID) Process:(2656) clean_master_1_1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\cmpc
Operation:writeName:ProductID
Value:
6488085
(PID) Process:(2656) clean_master_1_1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\cmpc
Operation:writeName:versiontypes
Value:
184549376
(PID) Process:(2656) clean_master_1_1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\cmpc\Setup
Operation:writeName:iid
Value:
207116401
(PID) Process:(2656) clean_master_1_1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\cmpc\Setup
Operation:writeName:tod1
Value:
1
(PID) Process:(2656) clean_master_1_1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\cmpc\Setup
Operation:writeName:tod2
Value:
1
(PID) Process:(2656) clean_master_1_1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\cmpc\Setup
Operation:writeName:tid1
Value:
1
Executable files
89
Suspicious files
175
Text files
1 280
Unknown types
63

Dropped files

PID
Process
Filename
Type
2656clean_master_1_1.exeC:\Users\admin\AppData\Local\Temp\kcm\kcmsetup.logtext
MD5:—
SHA256:—
2656clean_master_1_1.exeC:\Users\admin\AppData\Local\Temp\kcm\~16af11\install_res\en\203.xmltext
MD5:—
SHA256:—
2656clean_master_1_1.exeC:\Users\admin\AppData\Local\Temp\kcm\~16af11\setup.xmlxml
MD5:—
SHA256:—
2656clean_master_1_1.exeC:\Users\admin\AppData\Local\Temp\kcm\~16af11\install_res\en\102.xmltext
MD5:—
SHA256:—
2656clean_master_1_1.exeC:\Users\admin\AppData\Local\Temp\kcm\~16af11\install_res\en\1018.pngimage
MD5:93AFA797C6239208168931562010AAA2
SHA256:69EDCB4C14027172D3D637ADD73AEFAB5E1BA9F3A4E26EEB6173D89A759B7B30
2656clean_master_1_1.exeC:\Users\admin\AppData\Local\Temp\kcm\~16af11\product.xmlxml
MD5:C1EBA844FB25EF74DB3E522B1ACE9D1D
SHA256:443C8E53683AB94B007C137273657C29FDB7EB42DF580A588625055F32547E90
2656clean_master_1_1.exeC:\Users\admin\AppData\Local\Temp\kcm\~16af11\install_res\en\5000.pngimage
MD5:2AC819C5DA5B1014184B3C215C818C82
SHA256:FE8A10A67F5F74A12E2F23CF3DB82C3172615750E6AD81CA0829E7F0FE0CC839
2656clean_master_1_1.exeC:\Users\admin\AppData\Local\Temp\kcm\~16af11\install_res\en\1005.pngimage
MD5:234111F4D1D05C5F89C42E9DF025C674
SHA256:64F39A78AC38AF68A0EDAECAEF25603D72CD7CCFE48E86FCBDA8D94F0D4520AC
2656clean_master_1_1.exeC:\Users\admin\AppData\Local\Temp\kcm\~16af11\clear_i.xmlxml
MD5:B408BA77FE11B792826B9D021A4EE8C7
SHA256:076573F088CE0337BABDE85BEDBC18BEE1D6DE678EC46B97DBA7ACEE94E3E89B
2656clean_master_1_1.exeC:\program files\cmcm\Clean Master\data\softicon\softicon48\60000208.pngimage
MD5:242B906EC250504CE970E539D0F9DBE7
SHA256:F2BE254313242D341823C2FAB061A9146E92D8F3E5B414712541BD45B969FF24
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
80
TCP/UDP connections
82
DNS requests
18
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3152
cmtray.exe
POST
—
114.112.93.166:8080
http://114.112.93.166:8080/kurl_query?1516984
CN
—
—
suspicious
3152
cmtray.exe
GET
200
120.92.75.25:80
http://api.pc120.com/time/?u=c2e68126dd6ce612ddd883d0729a92b5&t=1568715438
CN
xml
110 b
suspicious
3152
cmtray.exe
GET
200
120.92.75.25:80
http://api.pc120.com/time/?u=c2e68126dd6ce612ddd883d0729a92b5&t=1568715436
CN
xml
110 b
suspicious
3152
cmtray.exe
POST
200
35.174.78.65:80
http://hw.optimize.cloud.duba.net/squery?1601515
US
binary
2.11 Kb
suspicious
2656
clean_master_1_1.exe
POST
200
34.217.165.249:80
http://helppccm1.ksmobile.com/c/
US
text
36 b
malicious
3152
cmtray.exe
POST
200
49.51.10.138:80
http://liveupdate5.qudongtianshi.com/postcmpc1.aspx
CN
xml
13.4 Kb
malicious
3152
cmtray.exe
POST
—
114.112.93.166:8080
http://114.112.93.166:8080/kurl_query?1601781
CN
—
—
suspicious
3152
cmtray.exe
POST
200
110.43.81.34:80
http://rq.optimize.cloud.duba.net/pquery?1601890
CN
binary
3.24 Kb
suspicious
3152
cmtray.exe
GET
404
116.211.183.213:80
http://config.i.duba.net/cmpc/uplive/uplive_en_us.txt?time=1513765
CN
html
611 b
whitelisted
3152
cmtray.exe
POST
200
123.207.105.156:8080
http://knsv2.cloud.duba.net:8080/kurl_query?1624640
CN
binary
131 b
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3152
cmtray.exe
116.211.183.213:80
config.i.duba.net
CHINANET Hubei province network
CN
malicious
3152
cmtray.exe
116.211.183.212:80
config.i.duba.net
CHINANET Hubei province network
CN
suspicious
3152
cmtray.exe
120.92.75.25:80
api.pc120.com
Beijing Kingsoft Cloud Internet Technology Co., Ltd
CN
suspicious
3152
cmtray.exe
114.112.93.166:8080
—
China Unicom Beijing Province Network
CN
suspicious
3152
cmtray.exe
218.24.18.57:80
cv.duba.net
CHINA UNICOM China169 Backbone
CN
suspicious
3152
cmtray.exe
101.227.95.5:80
cu003.www.duba.net
China Telecom (Group)
CN
suspicious
3152
cmtray.exe
49.51.10.138:80
liveupdate5.qudongtianshi.com
Tencent Building, Kejizhongyi Avenue
CN
malicious
2656
clean_master_1_1.exe
34.217.165.249:80
helppccm1.ksmobile.com
Amazon.com, Inc.
US
malicious
3152
cmtray.exe
123.207.105.156:8080
knsv2.cloud.duba.net
Shenzhen Tencent Computer Systems Company Limited
CN
suspicious
3152
cmtray.exe
35.174.78.65:80
hw.optimize.cloud.duba.net
Amazon.com, Inc.
US
suspicious

DNS requests

Domain
IP
Reputation
config.i.duba.net
  • 116.211.183.213
  • 116.211.183.214
  • 116.211.183.215
  • 116.211.183.216
  • 116.211.183.217
  • 116.211.183.218
  • 116.211.183.211
  • 116.211.183.212
whitelisted
api.pc120.com
  • 120.92.75.25
suspicious
cu003.www.duba.net
  • 101.227.95.5
malicious
cv.duba.net
  • 218.24.18.57
  • 218.24.18.63
  • 218.24.18.54
  • 218.24.18.58
  • 218.24.18.55
  • 218.24.18.52
  • 218.24.18.62
  • 218.24.18.59
  • 218.24.18.56
whitelisted
liveupdate5.qudongtianshi.com
  • 49.51.10.138
  • 118.89.21.163
malicious
helppccm1.ksmobile.com
  • 34.217.165.249
  • 34.223.218.162
  • 34.215.234.144
  • 34.215.1.161
  • 34.223.204.124
  • 34.217.247.153
  • 34.215.231.170
  • 34.215.132.6
malicious
knsv2.cloud.duba.net
  • 123.207.105.156
suspicious
hw.optimize.cloud.duba.net
  • 35.174.78.65
  • 52.202.0.154
suspicious
rq.optimize.cloud.duba.net
  • 110.43.81.34
suspicious
urlauth.ksmobile.net
  • 18.202.206.77
  • 34.240.191.194
  • 18.203.141.172
  • 52.18.239.2
  • 18.200.122.104
  • 34.255.237.221
  • 34.248.243.6
  • 3.248.161.19
unknown

Threats

PID
Process
Class
Message
—
—
A Network Trojan was detected
ET INFO Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
—
—
A Network Trojan was detected
ET INFO Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
—
—
Misc activity
ADWARE [PTsecurity] PUP.Win32/KingSoft.E
—
—
A Network Trojan was detected
ET INFO Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
—
—
A Network Trojan was detected
ET INFO Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
Process
Message
clean_master_1_1.exe
KMainDlg::OnTimerForUnFoldAnimate:TickCount=0 11 16 49 604
clean_master_1_1.exe
KMainDlg::OnTimerForUnFoldAnimate:TickCount=0 11 16 49 635
clean_master_1_1.exe
KMainDlg::OnTimerForUnFoldAnimate:TickCount=0 11 16 49 666
clean_master_1_1.exe
KMainDlg::OnTimerForUnFoldAnimate:TickCount=0 11 16 49 698
clean_master_1_1.exe
KMainDlg::OnTimerForUnFoldAnimate:TickCount=0 11 16 49 729
clean_master_1_1.exe
KMainDlg::OnTimerForUnFoldAnimate:TickCount=0 11 16 49 760
clean_master_1_1.exe
KMainDlg::OnTimerForUnFoldAnimate:TickCount=0 11 16 49 791
clean_master_1_1.exe
KMainDlg::OnTimerForUnFoldAnimate:TickCount=0 11 16 49 823
clean_master_1_1.exe
KMainDlg::OnTimerForUnFoldAnimate:TickCount=0 11 16 49 854
clean_master_1_1.exe
KMainDlg::OnTimerForUnFoldAnimate:TickCount=0 11 16 49 885
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
clean_master_1_1.exe