download:

clean_master_1_1.exe

Full analysis: https://app.any.run/tasks/67fbaa0c-4976-49c1-9751-465d85ba9354
Verdict: Malicious activity
Analysis date: May 05, 2018, 10:05:50
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5:

26017BC0F9A14316E5B6BB0D7AE77EFC

SHA1:

8DE6EB35DBF044FCA51213FC2232FEB3A9B9DD6F

SHA256:

A2884990DB488DCC8E9C27AD0F441B874D511D79C5D6818535C06843516B2CC3

SSDEEP:

393216:YztbLFMgcPwHDuuNWJIiJyNADILn8nf838NM0AzzLCxhDU0w+I7wrqib3yDKxU:cnFGPMDGJIiJy5ofWAMnzLCxy0NI8DbE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • clean_master_1_1.exe (PID: 1952)

    • Application was dropped or rewritten from another process

      • cmtray.exe (PID: 3200)
      • cmtray.exe (PID: 3708)
      • cmcore.exe (PID: 2576)
      • cmlicense.exe (PID: 1020)
      • kismain.exe (PID: 3632)
      • cmtray.exe (PID: 2488)
      • kismain.exe (PID: 3932)
      • cmtray.exe (PID: 2388)
      • kismain.exe (PID: 2796)
      • kismain.exe (PID: 3632)
      • cmtray.exe (PID: 2928)
      • cmtray.exe (PID: 2820)
      • feedbackwin.exe (PID: 3168)

    • Application loaded dropped or rewritten executable

      • cmtray.exe (PID: 3200)
      • cmcore.exe (PID: 2576)
      • cmtray.exe (PID: 3708)
      • cmlicense.exe (PID: 1020)
      • clean_master_1_1.exe (PID: 1952)
      • cmtray.exe (PID: 2488)
      • kismain.exe (PID: 3632)
      • kismain.exe (PID: 3932)
      • cmtray.exe (PID: 2928)
      • kismain.exe (PID: 2796)
      • cmtray.exe (PID: 2388)
      • kismain.exe (PID: 3632)
      • feedbackwin.exe (PID: 3168)
      • cmtray.exe (PID: 2820)

    • Actions looks like stealing of personal data

      • cmtray.exe (PID: 3200)

    • Loads the Task Scheduler DLL interface

      • cmtray.exe (PID: 3200)

    • Loads the Task Scheduler COM API

      • cmtray.exe (PID: 3200)

  • SUSPICIOUS

    • Writes to a desktop.ini file (may be used to cloak folders)

      • clean_master_1_1.exe (PID: 1952)
      • cmtray.exe (PID: 3200)

    • Creates files in the Windows directory

      • clean_master_1_1.exe (PID: 1952)

    • Creates files in the driver directory

      • clean_master_1_1.exe (PID: 1952)

    • Creates files in the program directory

      • cmlicense.exe (PID: 1020)
      • SearchIndexer.exe (PID: 2408)
      • clean_master_1_1.exe (PID: 1952)
      • cmtray.exe (PID: 3200)

    • Creates a software uninstall entry

      • clean_master_1_1.exe (PID: 1952)
      • cmtray.exe (PID: 3200)

    • Creates files in the user directory

      • cmtray.exe (PID: 3200)

    • Creates COM task schedule object

      • clean_master_1_1.exe (PID: 1952)

    • Searches for installed software

      • cmtray.exe (PID: 3200)

    • Creates or modifies windows services

      • cmtray.exe (PID: 3200)

    • Removes files from Windows directory

      • cmtray.exe (PID: 3200)

  • INFO

    • Loads rich edit control libraries

      • cmtray.exe (PID: 3200)

    • Dropped object may contain Bitcoin addresses

      • clean_master_1_1.exe (PID: 1952)

    • Dropped object may contain URL's

      • cmtray.exe (PID: 3200)
      • clean_master_1_1.exe (PID: 1952)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (30.7)
.exe | UPX compressed Win32 Executable (30.1)
.exe | Win32 EXE Yoda's Crypter (29.5)
.exe | Win32 Executable (generic) (5)
.exe | Generic Win/DOS Executable (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1970:01:07 08:19:28+01:00
PEType: PE32
LinkerVersion: 8
CodeSize: 458752
InitializedDataSize: 90112
UninitializedDataSize: 602112
EntryPoint: 0x1035b0
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2018.1.3.1009
ProductVersionNumber: 9.3.667.240
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: Cheetah Mobile,Inc.
FileVersion: 2017,12,05,240
LegalCopyright: Copyright(c) 2011-2017 Cheetah Mobile,Inc.
ProductName: Clean Master For PC
ProductVersion: 9,3,328347,240

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 07-Jan-1970 07:19:28
Detected languages:
  • Chinese - PRC
  • English - United States
CompanyName: Cheetah Mobile,Inc.
FileVersion: 2017,12,05,240
LegalCopyright: Copyright(c) 2011-2017 Cheetah Mobile,Inc.
ProductName: Clean Master For PC
ProductVersion: 9,3,328347,240

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000F8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 3
Time date stamp: 07-Jan-1970 07:19:28
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
UPX0
0x00001000
0x00093000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
UPX1
0x00094000
0x00070000
0x0006F800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.93015
.rsrc
0x00104000
0x00016000
0x00015400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.68883

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.08469
934
Latin 1 / Western European
English - United States
RT_MANIFEST
2
5.92517
9640
Latin 1 / Western European
Chinese - PRC
RT_ICON
3
5.88285
4264
Latin 1 / Western European
Chinese - PRC
RT_ICON
4
7.74234
9640
Latin 1 / Western European
Chinese - PRC
RT_ICON
5
7.70728
4264
Latin 1 / Western European
Chinese - PRC
RT_ICON
6
7.60149
1128
Latin 1 / Western European
Chinese - PRC
RT_ICON
100
7.41195
1323
Latin 1 / Western European
Chinese - PRC
XML
101
7.78794
2843
Latin 1 / Western European
Chinese - PRC
XML
1000
7.81228
2884
Latin 1 / Western European
Chinese - PRC
PNG
1001
7.72939
1420
Latin 1 / Western European
Chinese - PRC
PNG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.DLL
MSIMG32.dll
OLEAUT32.dll
SHELL32.dll
SHLWAPI.dll
USER32.dll
VERSION.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
57
Monitored processes
19
Malicious processes
5
Suspicious processes
10

Behavior graph

Click at the process to see the details
drop and start drop and start start clean_master_1_1.exe cmcore.exe no specs cmtray.exe cmtray.exe no specs cmlicense.exe no specs kismain.exe no specs cmtray.exe no specs searchindexer.exe no specs searchprotocolhost.exe no specs searchfilterhost.exe no specs searchprotocolhost.exe no specs kismain.exe no specs cmtray.exe no specs kismain.exe no specs cmtray.exe no specs kismain.exe no specs cmtray.exe no specs feedbackwin.exe no specs clean_master_1_1.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
800"C:\Users\admin\AppData\Local\Temp\clean_master_1_1.exe" C:\Users\admin\AppData\Local\Temp\clean_master_1_1.exe—explorer.exe
User:
admin
Company:
Cheetah Mobile,Inc.
Integrity Level:
MEDIUM
Exit code:
3221226540
Version:
2017,12,05,240
Modules
Images
c:\users\admin\appdata\local\temp\clean_master_1_1.exe
c:\systemroot\system32\ntdll.dll
1020"C:\program files\cmcm\Clean Master\cmlicense.exe" /src:6C:\program files\cmcm\Clean Master\cmlicense.exe—cmtray.exe
User:
admin
Company:
Cheetah Mobile,Inc.
Integrity Level:
HIGH
Exit code:
0
Version:
2017,12,12,280
Modules
Images
c:\program files\cmcm\clean master\cmlicense.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1952"C:\Users\admin\AppData\Local\Temp\clean_master_1_1.exe" C:\Users\admin\AppData\Local\Temp\clean_master_1_1.exe
explorer.exe
User:
admin
Company:
Cheetah Mobile,Inc.
Integrity Level:
HIGH
Exit code:
0
Version:
2017,12,05,240
Modules
Images
c:\users\admin\appdata\local\temp\clean_master_1_1.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
2312"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1302019708-1500728564-335382590-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1302019708-1500728564-335382590-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"C:\Windows\system32\SearchProtocolHost.exe—SearchIndexer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2388"C:\program files\cmcm\Clean Master\cmtray.exe" /kismain /lite_privacy_safe:3C:\program files\cmcm\Clean Master\cmtray.exe—kismain.exe
User:
admin
Company:
Cheetah Mobile,Inc.
Integrity Level:
HIGH
Exit code:
1
Version:
2017,12,14,288
Modules
Images
c:\program files\cmcm\clean master\cmtray.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
2408C:\Windows\system32\SearchIndexer.exe /EmbeddingC:\Windows\system32\SearchIndexer.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Indexer
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchindexer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2488"C:\program files\cmcm\Clean Master\cmtray.exe" /kismain /settingC:\program files\cmcm\Clean Master\cmtray.exe—kismain.exe
User:
admin
Company:
Cheetah Mobile,Inc.
Integrity Level:
HIGH
Exit code:
1
Version:
2017,12,14,288
Modules
Images
c:\program files\cmcm\clean master\cmtray.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2576"c:\program files\cmcm\Clean Master\cmcore.exe" /service cmcorec:\program files\cmcm\Clean Master\cmcore.exe—services.exe
User:
SYSTEM
Company:
Cheetah Mobile,Inc.
Integrity Level:
SYSTEM
Exit code:
0
Version:
2017,12,13,283
Modules
Images
c:\program files\cmcm\clean master\cmcore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2792"C:\Windows\system32\SearchFilterHost.exe" 0 512 516 524 65536 520 C:\Windows\system32\SearchFilterHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Windows Search Filter Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchfilterhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2796"C:\program files\cmcm\Clean Master\kismain.exe" /settingC:\program files\cmcm\Clean Master\kismain.exe—cmtray.exe
User:
admin
Company:
Cheetah Mobile,Inc.
Integrity Level:
HIGH
Exit code:
0
Version:
2017,10,31,122
Modules
Images
c:\program files\cmcm\clean master\kismain.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
Total events
2 640
Read events
2 411
Write events
189
Delete events
40

Modification events

(PID) Process:(1952) clean_master_1_1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\cmpc
Operation:writeName:ProgramPath
Value:
c:\program files\cmcm\Clean Master\
(PID) Process:(1952) clean_master_1_1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\cmpc
Operation:writeName:InstallVersion
Value:
6.0
(PID) Process:(1952) clean_master_1_1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\cmpc
Operation:writeName:PackageVersion
Value:
6.0
(PID) Process:(1952) clean_master_1_1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\cmpc
Operation:writeName:Lang
Value:
English
(PID) Process:(1952) clean_master_1_1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\cmpc
Operation:writeName:ProductID
Value:
6488085
(PID) Process:(1952) clean_master_1_1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\cmpc
Operation:writeName:versiontypes
Value:
184549376
(PID) Process:(1952) clean_master_1_1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\cmpc\Setup
Operation:writeName:iid
Value:
207116401
(PID) Process:(1952) clean_master_1_1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\cmpc\Setup
Operation:writeName:tod1
Value:
1
(PID) Process:(1952) clean_master_1_1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\cmpc\Setup
Operation:writeName:tod2
Value:
1
(PID) Process:(1952) clean_master_1_1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\cmpc\Setup
Operation:writeName:tid1
Value:
1
Executable files
64
Suspicious files
147
Text files
1 227
Unknown types
16

Dropped files

PID
Process
Filename
Type
1952clean_master_1_1.exeC:\Users\admin\AppData\Local\Temp\kcm\kcmsetup.logtext
MD5:—
SHA256:—
1952clean_master_1_1.exeC:\Users\admin\AppData\Local\Temp\kcm\~fb9d1\install_res\en\1005.pngimage
MD5:234111F4D1D05C5F89C42E9DF025C674
SHA256:64F39A78AC38AF68A0EDAECAEF25603D72CD7CCFE48E86FCBDA8D94F0D4520AC
1952clean_master_1_1.exeC:\Users\admin\AppData\Local\Temp\kcm\~fb9d1\install_res\en\214.xmltext
MD5:987C1613EE72D5B0703CD7D69735FCC1
SHA256:9CE2C780D067BA0E598152583044B461B1C44EA16A6E21011E151954482E6212
1952clean_master_1_1.exeC:\Users\admin\AppData\Local\Temp\kcm\~fb9d1\install_res\en\1018.pngimage
MD5:93AFA797C6239208168931562010AAA2
SHA256:69EDCB4C14027172D3D637ADD73AEFAB5E1BA9F3A4E26EEB6173D89A759B7B30
1952clean_master_1_1.exeC:\Users\admin\AppData\Local\Temp\kcm\~fb9d1\install_res\en\102.xmltext
MD5:4A30C49981293EC06DCA5BED130CB805
SHA256:EFC10B546FDF30C67DB83E1A529813E7D2C5AD9A0B3B41293CB4CE436D7390EA
1952clean_master_1_1.exeC:\Users\admin\AppData\Local\Temp\kcm\~fb9d1\product.xmlxml
MD5:C1EBA844FB25EF74DB3E522B1ACE9D1D
SHA256:443C8E53683AB94B007C137273657C29FDB7EB42DF580A588625055F32547E90
1952clean_master_1_1.exeC:\program files\cmcm\Clean Master\data\softicon\softicon48\60000073.pngimage
MD5:E761E599D9DBCA83131221E77B28356E
SHA256:2E405B176E4F0B2848DED168CD6E9201AC255770E0E712CBBF5B53919F7C480F
1952clean_master_1_1.exeC:\Users\admin\AppData\Local\Temp\kcm\~fb9d1\install_res\en\5000.pngimage
MD5:2AC819C5DA5B1014184B3C215C818C82
SHA256:FE8A10A67F5F74A12E2F23CF3DB82C3172615750E6AD81CA0829E7F0FE0CC839
1952clean_master_1_1.exeC:\Users\admin\AppData\Local\Temp\kcm\~fb9d1\clear_i.xmlxml
MD5:B408BA77FE11B792826B9D021A4EE8C7
SHA256:076573F088CE0337BABDE85BEDBC18BEE1D6DE678EC46B97DBA7ACEE94E3E89B
1952clean_master_1_1.exeC:\program files\cmcm\Clean Master\data\softicon\softicon48\60000107.pngimage
MD5:99322BEF942711C47163DC31007F8769
SHA256:0A7B3D3E57B99EAF2D39434C322271ECF6D462435EA88D63EEF3A41AE4C335DF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
23
TCP/UDP connections
23
DNS requests
15
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
POST
200
49.51.10.138:80
http://liveupdate5.qudongtianshi.com/postcmpc1.aspx
CN
xml
13.4 Kb
malicious
—
—
GET
200
120.92.75.29:80
http://api.pc120.com/time/?u=10c2985929565675083b99605cb1c2fc&t=1525514818
CN
xml
110 b
suspicious
—
—
GET
200
120.92.75.25:80
http://api.pc120.com/time/?u=10c2985929565675083b99605cb1c2fc&t=1525514818
CN
xml
110 b
suspicious
—
—
POST
—
114.112.93.166:8080
http://114.112.93.166:8080/kurl_query?1048890
CN
—
—
suspicious
—
—
GET
200
122.193.207.64:80
http://cv.duba.net/cv?uuid=10c2985929565675083b99605cb1c2fc&tc=1048921&p=cmtray.exe&c=0
CN
xml
986 b
whitelisted
—
—
POST
200
123.207.105.156:8080
http://knsv2.cloud.duba.net:8080/kurl_query?1058953
CN
binary
279 b
suspicious
—
—
POST
200
52.72.143.90:80
http://helppccm1.ksmobile.com/c/
US
text
36 b
malicious
—
—
POST
200
52.48.28.58:80
http://urlauth.ksmobile.net/spp_query/?t=1525514931?1161265
IE
binary
77 b
unknown
—
—
POST
200
52.202.0.154:80
http://hw.optimize.cloud.duba.net/squery?1177843
US
binary
2.70 Kb
suspicious
—
—
GET
404
112.253.11.135:80
http://config.i.duba.net/cmpc/uplive/uplive_en_us.txt?time=1045687
CN
html
624 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
112.253.11.135:80
config.i.duba.net
CHINA UNICOM China169 Backbone
CN
unknown
—
—
49.51.10.138:80
liveupdate5.qudongtianshi.com
Tencent Building, Kejizhongyi Avenue
CN
malicious
—
—
120.92.75.29:80
api.pc120.com
Beijing Kingsoft Cloud Internet Technology Co., Ltd
CN
suspicious
—
—
114.112.93.166:8080
—
China Unicom Beijing Province Network
CN
suspicious
—
—
120.92.75.25:80
api.pc120.com
Beijing Kingsoft Cloud Internet Technology Co., Ltd
CN
suspicious
—
—
122.193.207.64:80
cv.duba.net
CHINA UNICOM China169 Backbone
CN
unknown
—
—
116.207.163.79:80
cu003.www.duba.net
No.31,Jin-rong Street
CN
suspicious
—
—
52.72.143.90:80
helppccm1.ksmobile.com
Amazon.com, Inc.
US
unknown
—
—
123.207.105.156:8080
knsv2.cloud.duba.net
Shenzhen Tencent Computer Systems Company Limited
CN
suspicious
—
—
52.48.28.58:80
urlauth.ksmobile.net
Amazon.com, Inc.
IE
unknown

DNS requests

Domain
IP
Reputation
config.i.duba.net
  • 112.253.11.135
  • 112.253.11.144
  • 112.253.11.139
  • 112.253.11.136
  • 112.253.11.137
  • 112.253.11.131
  • 112.253.11.143
  • 112.253.11.138
  • 112.253.11.132
whitelisted
liveupdate5.qudongtianshi.com
  • 49.51.10.138
malicious
cu003.www.duba.net
  • 116.207.163.79
malicious
api.pc120.com
  • 120.92.75.29
  • 120.92.75.25
suspicious
cv.duba.net
  • 122.193.207.64
whitelisted
helppccm1.ksmobile.com
  • 52.72.143.90
  • 52.6.148.74
  • 52.73.149.25
  • 52.71.217.145
  • 52.70.114.42
  • 52.55.170.193
  • 52.72.190.249
  • 52.7.88.79
malicious
knsv2.cloud.duba.net
  • 123.207.105.156
suspicious
urlauth.ksmobile.net
  • 52.48.28.58
  • 52.209.185.1
  • 52.30.33.31
  • 52.213.38.182
  • 52.49.80.161
  • 52.213.27.180
  • 52.209.180.107
  • 52.215.40.62
unknown
hw.optimize.cloud.duba.net
  • 52.202.0.154
  • 52.22.238.179
suspicious
cu004.www.duba.net
  • 116.207.163.79
malicious

Threats

PID
Process
Class
Message
—
—
A Network Trojan was detected
ET INFO Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
—
—
A Network Trojan was detected
ET INFO Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
Process
Message
clean_master_1_1.exe
KMainDlg::OnTimerForUnFoldAnimate:TickCount=0 11 06 42 166
clean_master_1_1.exe
KMainDlg::OnTimerForUnFoldAnimate:TickCount=0 11 06 42 197
clean_master_1_1.exe
KMainDlg::OnTimerForUnFoldAnimate:TickCount=0 11 06 42 229
clean_master_1_1.exe
KMainDlg::OnTimerForUnFoldAnimate:TickCount=0 11 06 42 260
clean_master_1_1.exe
KMainDlg::OnTimerForUnFoldAnimate:TickCount=0 11 06 42 291
clean_master_1_1.exe
KMainDlg::OnTimerForUnFoldAnimate:TickCount=0 11 06 42 322
clean_master_1_1.exe
KMainDlg::OnTimerForUnFoldAnimate:TickCount=0 11 06 42 354
clean_master_1_1.exe
KMainDlg::OnTimerForUnFoldAnimate:TickCount=0 11 06 42 385
clean_master_1_1.exe
KMainDlg::OnTimerForUnFoldAnimate:TickCount=0 11 06 42 416
clean_master_1_1.exe
KMainDlg::OnTimerForUnFoldAnimate:TickCount=0 11 06 42 447
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
clean_master_1_1.exe