download:

clean_master_1_1.exe

Full analysis: https://app.any.run/tasks/d09f49f5-9918-4fda-ac64-76a8b384131b
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: November 21, 2019, 10:35:43
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adware
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5:

26017BC0F9A14316E5B6BB0D7AE77EFC

SHA1:

8DE6EB35DBF044FCA51213FC2232FEB3A9B9DD6F

SHA256:

A2884990DB488DCC8E9C27AD0F441B874D511D79C5D6818535C06843516B2CC3

SSDEEP:

393216:YztbLFMgcPwHDuuNWJIiJyNADILn8nf838NM0AzzLCxhDU0w+I7wrqib3yDKxU:cnFGPMDGJIiJy5ofWAMnzLCxy0NI8DbE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • clean_master_1_1.exe (PID: 2112)

    • Loads dropped or rewritten executable

      • cmtray.exe (PID: 3972)
      • cmcore.exe (PID: 2668)
      • clean_master_1_1.exe (PID: 2112)
      • cmtray.exe (PID: 616)
      • feedbackwin.exe (PID: 1948)
      • kismain.exe (PID: 836)
      • cmtray.exe (PID: 4044)
      • cmlive.exe (PID: 3240)
      • kismain.exe (PID: 2376)
      • cmtray.exe (PID: 1916)
      • cmdriverbooster.exe (PID: 3676)
      • cmlive.exe (PID: 1876)
      • soundtool.exe (PID: 3868)
      • NetHelper.exe (PID: 3256)
      • soundtool.exe (PID: 2636)

    • Application was dropped or rewritten from another process

      • cmtray.exe (PID: 616)
      • cmcore.exe (PID: 2668)
      • cmtray.exe (PID: 3972)
      • feedbackwin.exe (PID: 1948)
      • kismain.exe (PID: 836)
      • cmtray.exe (PID: 4044)
      • cmlive.exe (PID: 3240)
      • cmtray.exe (PID: 1916)
      • cmlive.exe (PID: 1876)
      • kismain.exe (PID: 2376)
      • cmdriverbooster.exe (PID: 3676)
      • soundtool.exe (PID: 3868)
      • NetHelper.exe (PID: 3256)
      • soundtool.exe (PID: 2636)

    • Actions looks like stealing of personal data

      • cmtray.exe (PID: 3972)

    • Changes the login/logoff helper path in the registry

      • cmtray.exe (PID: 3972)

    • Loads the Task Scheduler DLL interface

      • cmtray.exe (PID: 3972)

    • Loads the Task Scheduler COM API

      • cmtray.exe (PID: 3972)

  • SUSPICIOUS

    • Creates files in the Windows directory

      • clean_master_1_1.exe (PID: 2112)
      • PnPutil.exe (PID: 1820)
      • soundtool.exe (PID: 3868)

    • Executable content was dropped or overwritten

      • clean_master_1_1.exe (PID: 2112)
      • cmtray.exe (PID: 3972)

    • Creates files in the driver directory

      • clean_master_1_1.exe (PID: 2112)

    • Creates a software uninstall entry

      • clean_master_1_1.exe (PID: 2112)
      • cmtray.exe (PID: 3972)

    • Writes to a desktop.ini file (may be used to cloak folders)

      • clean_master_1_1.exe (PID: 2112)
      • cmtray.exe (PID: 3972)

    • Creates files in the user directory

      • cmtray.exe (PID: 3972)

    • Executed as Windows Service

      • cmcore.exe (PID: 2668)
      • locator.exe (PID: 1248)
      • vssvc.exe (PID: 3124)
      • SearchIndexer.exe (PID: 3040)

    • Creates COM task schedule object

      • clean_master_1_1.exe (PID: 2112)

    • Searches for installed software

      • cmtray.exe (PID: 3972)

    • Connects to server without host name

      • cmtray.exe (PID: 3972)

    • Reads the cookies of Mozilla Firefox

      • cmtray.exe (PID: 3972)

    • Creates files in the program directory

      • clean_master_1_1.exe (PID: 2112)
      • SearchIndexer.exe (PID: 3040)
      • cmcore.exe (PID: 2668)
      • cmdriverbooster.exe (PID: 3676)
      • cmtray.exe (PID: 3972)
      • NetHelper.exe (PID: 3256)
      • soundtool.exe (PID: 3868)
      • cmlive.exe (PID: 1876)

    • Reads the cookies of Google Chrome

      • cmtray.exe (PID: 3972)

    • Creates or modifies windows services

      • cmtray.exe (PID: 3972)

    • Reads Internet Cache Settings

      • cmtray.exe (PID: 3972)

    • Removes files from Windows directory

      • cmtray.exe (PID: 3972)

    • Executed via COM

      • DllHost.exe (PID: 3388)
      • rundll32.exe (PID: 2856)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • clean_master_1_1.exe (PID: 2112)
      • cmtray.exe (PID: 3972)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (30.7)
.exe | UPX compressed Win32 Executable (30.1)
.exe | Win32 EXE Yoda's Crypter (29.5)
.exe | Win32 Executable (generic) (5)
.exe | Generic Win/DOS Executable (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1970:01:07 08:19:28+01:00
PEType: PE32
LinkerVersion: 8
CodeSize: 458752
InitializedDataSize: 90112
UninitializedDataSize: 602112
EntryPoint: 0x1035b0
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2018.1.3.1009
ProductVersionNumber: 9.3.667.240
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: Cheetah Mobile,Inc.
FileVersion: 2017,12,05,240
LegalCopyright: Copyright(c) 2011-2017 Cheetah Mobile,Inc.
ProductName: Clean Master For PC
ProductVersion: 9,3,328347,240

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 07-Jan-1970 07:19:28
Detected languages:
  • Chinese - PRC
  • English - United States
CompanyName: Cheetah Mobile,Inc.
FileVersion: 2017,12,05,240
LegalCopyright: Copyright(c) 2011-2017 Cheetah Mobile,Inc.
ProductName: Clean Master For PC
ProductVersion: 9,3,328347,240

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000F8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 3
Time date stamp: 07-Jan-1970 07:19:28
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
UPX0
0x00001000
0x00093000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
UPX1
0x00094000
0x00070000
0x0006F800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.93015
.rsrc
0x00104000
0x00016000
0x00015400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.68883

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.08469
934
Latin 1 / Western European
English - United States
RT_MANIFEST
2
5.92517
9640
Latin 1 / Western European
Chinese - PRC
RT_ICON
3
5.88285
4264
Latin 1 / Western European
Chinese - PRC
RT_ICON
4
7.74234
9640
Latin 1 / Western European
Chinese - PRC
RT_ICON
5
7.70728
4264
Latin 1 / Western European
Chinese - PRC
RT_ICON
6
7.60149
1128
Latin 1 / Western European
Chinese - PRC
RT_ICON
100
7.41195
1323
Latin 1 / Western European
Chinese - PRC
XML
101
7.78794
2843
Latin 1 / Western European
Chinese - PRC
XML
1000
7.81228
2884
Latin 1 / Western European
Chinese - PRC
PNG
1001
7.72939
1420
Latin 1 / Western European
Chinese - PRC
PNG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.DLL
MSIMG32.dll
OLEAUT32.dll
SHELL32.dll
SHLWAPI.dll
USER32.dll
VERSION.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
69
Monitored processes
25
Malicious processes
10
Suspicious processes
4

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start clean_master_1_1.exe cmcore.exe cmtray.exe cmtray.exe no specs feedbackwin.exe no specs kismain.exe no specs cmtray.exe no specs searchindexer.exe no specs searchprotocolhost.exe no specs searchfilterhost.exe no specs searchprotocolhost.exe no specs cmlive.exe cmlive.exe no specs kismain.exe no specs cmtray.exe no specs cmdriverbooster.exe locator.exe no specs SPPSurrogate no specs vssvc.exe no specs pnputil.exe no specs nethelper.exe soundtool.exe soundtool.exe no specs rundll32.exe no specs clean_master_1_1.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
616"c:\program files\cmcm\Clean Master\cmtray.exe" /src:9c:\program files\cmcm\Clean Master\cmtray.exe—clean_master_1_1.exe
User:
admin
Company:
Cheetah Mobile,Inc.
Integrity Level:
HIGH
Exit code:
1
Version:
2017,12,14,288
Modules
Images
c:\program files\cmcm\clean master\cmtray.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
836"C:\program files\cmcm\Clean Master\kismain.exe" /settingC:\program files\cmcm\Clean Master\kismain.exe—cmtray.exe
User:
admin
Company:
Cheetah Mobile,Inc.
Integrity Level:
HIGH
Exit code:
0
Version:
2017,10,31,122
Modules
Images
c:\program files\cmcm\clean master\kismain.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
1248C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe—services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Rpc Locator
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\locator.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1404"C:\Windows\system32\SearchFilterHost.exe" 0 512 516 524 65536 520 C:\Windows\system32\SearchFilterHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Windows Search Filter Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchfilterhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1560"C:\Users\admin\Desktop\clean_master_1_1.exe" C:\Users\admin\Desktop\clean_master_1_1.exe—explorer.exe
User:
admin
Company:
Cheetah Mobile,Inc.
Integrity Level:
MEDIUM
Exit code:
3221226540
Version:
2017,12,05,240
Modules
Images
c:\users\admin\desktop\clean_master_1_1.exe
c:\systemroot\system32\ntdll.dll
1820"C:\Windows\System32\PnPutil.exe" -eC:\Windows\System32\PnPutil.exe—cmdriverbooster.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft PnP Utility - Tool to add, delete and enumerate driver packages.
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\pnputil.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\setupapi.dll
1876"C:\program files\cmcm\Clean Master\cmlive.exe" /skipcs3forceC:\program files\cmcm\Clean Master\cmlive.exe
cmtray.exe
User:
admin
Company:
Cheetah Mobile,Inc.
Integrity Level:
HIGH
Exit code:
0
Version:
2017,12,25,314
Modules
Images
c:\program files\cmcm\clean master\cmlive.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1916"C:\program files\cmcm\Clean Master\cmtray.exe" /kismain /tool /exepath:driver_booster\cmdriverbooster.exe /toolname:bootdriverC:\program files\cmcm\Clean Master\cmtray.exe—kismain.exe
User:
admin
Company:
Cheetah Mobile,Inc.
Integrity Level:
HIGH
Exit code:
1
Version:
2017,12,14,288
Modules
Images
c:\program files\cmcm\clean master\cmtray.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
1948"C:\program files\cmcm\Clean Master\feedbackwin.exe" /from:kismainC:\program files\cmcm\Clean Master\feedbackwin.exe—cmtray.exe
User:
admin
Company:
Cheetah Mobile,Inc.
Integrity Level:
HIGH
Exit code:
0
Version:
2017,12,13,284
Modules
Images
c:\program files\cmcm\clean master\feedbackwin.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1984"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\system32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
2 605
Read events
2 338
Write events
223
Delete events
44

Modification events

(PID) Process:(2112) clean_master_1_1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\cmpc
Operation:writeName:ProgramPath
Value:
c:\program files\cmcm\Clean Master\
(PID) Process:(2112) clean_master_1_1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\cmpc
Operation:writeName:InstallVersion
Value:
6.0
(PID) Process:(2112) clean_master_1_1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\cmpc
Operation:writeName:PackageVersion
Value:
6.0
(PID) Process:(2112) clean_master_1_1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\cmpc
Operation:writeName:Lang
Value:
English
(PID) Process:(2112) clean_master_1_1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\cmpc
Operation:writeName:ProductID
Value:
6488085
(PID) Process:(2112) clean_master_1_1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\cmpc
Operation:writeName:versiontypes
Value:
184549376
(PID) Process:(2112) clean_master_1_1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\cmpc\Setup
Operation:writeName:iid
Value:
207116401
(PID) Process:(2112) clean_master_1_1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\cmpc\Setup
Operation:writeName:tod1
Value:
1
(PID) Process:(2112) clean_master_1_1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\cmpc\Setup
Operation:writeName:tod2
Value:
1
(PID) Process:(2112) clean_master_1_1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\cmpc\Setup
Operation:writeName:tid1
Value:
1
Executable files
124
Suspicious files
162
Text files
1 340
Unknown types
99

Dropped files

PID
Process
Filename
Type
2112clean_master_1_1.exeC:\Users\admin\AppData\Local\Temp\kcm\kcmsetup.logtext
MD5:—
SHA256:—
2112clean_master_1_1.exeC:\Users\admin\AppData\Local\Temp\kcm\~39c9d2\install_res\en\214.xmltext
MD5:987C1613EE72D5B0703CD7D69735FCC1
SHA256:9CE2C780D067BA0E598152583044B461B1C44EA16A6E21011E151954482E6212
2112clean_master_1_1.exeC:\program files\cmcm\Clean Master\data\softicon\softicon32\60000208.pngimage
MD5:8D1BA5958F9C3FCCABF4FE8C6E1942BF
SHA256:7EBA8F8B5EB255A7E1172CE24D7D63827730B3CBF16707D048086872467AD89A
2112clean_master_1_1.exeC:\Users\admin\AppData\Local\Temp\kcm\~39c9d2\setup.xmlxml
MD5:3F5D1AD8BBD151569B49233F8E277D85
SHA256:EDCE88E356EC6C3561263E52B54139C47D70E6AC5E3E6DF067C6F1445199F6AE
2112clean_master_1_1.exeC:\program files\cmcm\Clean Master\data\softicon\softicon48\60000107.pngimage
MD5:99322BEF942711C47163DC31007F8769
SHA256:0A7B3D3E57B99EAF2D39434C322271ECF6D462435EA88D63EEF3A41AE4C335DF
2112clean_master_1_1.exeC:\program files\cmcm\Clean Master\data\softicon\softicon48\60000374.pngimage
MD5:8F1011AB3628A04358A8315AA20B6BA1
SHA256:D05D49356D643A132E4CEF2B766AAA6D2A0FB4562EDC708B92E084C17DF17E0D
2112clean_master_1_1.exeC:\program files\cmcm\Clean Master\data\softicon\softicon48\60000073.pngimage
MD5:E761E599D9DBCA83131221E77B28356E
SHA256:2E405B176E4F0B2848DED168CD6E9201AC255770E0E712CBBF5B53919F7C480F
2112clean_master_1_1.exeC:\program files\cmcm\Clean Master\data\softicon\softicon48\60000208.pngimage
MD5:242B906EC250504CE970E539D0F9DBE7
SHA256:F2BE254313242D341823C2FAB061A9146E92D8F3E5B414712541BD45B969FF24
2112clean_master_1_1.exeC:\Users\admin\AppData\Local\Temp\kcm\~39c9d2\install_res\en\102.xmltext
MD5:4A30C49981293EC06DCA5BED130CB805
SHA256:EFC10B546FDF30C67DB83E1A529813E7D2C5AD9A0B3B41293CB4CE436D7390EA
2112clean_master_1_1.exeC:\Users\admin\AppData\Local\Temp\kcm\~39c9d2\product.xmlxml
MD5:C1EBA844FB25EF74DB3E522B1ACE9D1D
SHA256:443C8E53683AB94B007C137273657C29FDB7EB42DF580A588625055F32547E90
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
114
TCP/UDP connections
116
DNS requests
27
Threats
14

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3972
cmtray.exe
POST
—
114.112.93.166:8080
http://114.112.93.166:8080/kurl_query?3947984
CN
—
—
suspicious
3972
cmtray.exe
POST
—
122.193.207.34:80
http://122.193.207.34/pquery?3948109
CN
—
—
suspicious
2112
clean_master_1_1.exe
POST
200
54.70.62.252:80
http://helppccm1.ksmobile.com/c/
US
text
36 b
malicious
3972
cmtray.exe
GET
200
120.92.75.29:80
http://api.pc120.com/time/?u=b184f1496cd6d58afb9ffe613d118ed3&t=1574332616
CN
xml
110 b
suspicious
3972
cmtray.exe
GET
200
120.92.75.29:80
http://api.pc120.com/time/?u=b184f1496cd6d58afb9ffe613d118ed3&t=1574332617
CN
xml
110 b
suspicious
3972
cmtray.exe
POST
—
221.228.204.34:80
http://221.228.204.34/pquery?3950140
CN
—
—
suspicious
3972
cmtray.exe
POST
200
35.174.78.65:80
http://hw.optimize.cloud.duba.net/squery?3946781
US
binary
2.25 Kb
suspicious
3972
cmtray.exe
POST
—
114.112.93.166:8080
http://114.112.93.166:8080/kurl_query?3803531
CN
—
—
suspicious
3972
cmtray.exe
POST
200
123.207.105.156:8080
http://knsv2.cloud.duba.net:8080/kurl_query?3813578
CN
binary
280 b
suspicious
3972
cmtray.exe
GET
200
175.6.11.62:80
http://config.i.duba.net/cmpc/config/competing_pop_cloud_cfg.ini
CN
text
170 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3972
cmtray.exe
120.92.75.29:80
api.pc120.com
Beijing Kingsoft Cloud Internet Technology Co., Ltd
CN
suspicious
3972
cmtray.exe
218.24.18.58:80
cv.duba.net
CHINA UNICOM China169 Backbone
CN
suspicious
3972
cmtray.exe
114.112.93.166:8080
—
China Unicom Beijing Province Network
CN
suspicious
3972
cmtray.exe
49.51.10.138:80
liveupdate5.qudongtianshi.com
Tencent Building, Kejizhongyi Avenue
CN
malicious
—
—
35.174.78.65:80
hw.optimize.cloud.duba.net
Amazon.com, Inc.
US
suspicious
3972
cmtray.exe
122.193.207.34:80
—
CHINA UNICOM China169 Backbone
CN
suspicious
3972
cmtray.exe
221.228.204.34:80
—
No.31,Jin-rong Street
CN
suspicious
3972
cmtray.exe
123.207.105.156:8080
knsv2.cloud.duba.net
Shenzhen Tencent Computer Systems Company Limited
CN
suspicious
3972
cmtray.exe
101.227.95.5:80
cu003.www.duba.net
China Telecom (Group)
CN
suspicious
1876
cmlive.exe
175.6.11.62:80
config.i.duba.net
No.293,Wanbao Avenue
CN
unknown

DNS requests

Domain
IP
Reputation
config.i.duba.net
  • 175.6.11.62
  • 175.6.11.19
  • 175.6.11.18
  • 175.6.11.17
  • 175.6.42.10
  • 175.6.42.9
  • 175.6.11.214
  • 175.6.11.198
  • 175.6.11.197
  • 175.6.11.196
  • 175.6.11.142
  • 175.6.11.113
  • 175.6.11.103
whitelisted
helppccm1.ksmobile.com
  • 54.70.62.252
  • 54.69.252.207
  • 54.69.8.164
  • 54.69.45.9
  • 54.69.43.47
  • 54.70.176.238
  • 54.69.170.40
  • 54.70.205.215
malicious
api.pc120.com
  • 120.92.75.29
suspicious
cu003.www.duba.net
  • 101.227.95.5
malicious
cv.duba.net
  • 218.24.18.58
  • 218.24.18.55
  • 218.24.18.52
  • 218.24.18.62
  • 218.24.18.59
  • 218.24.18.56
  • 218.24.18.57
  • 218.24.18.63
  • 218.24.18.54
whitelisted
liveupdate5.qudongtianshi.com
  • 49.51.10.138
  • 118.89.21.163
malicious
knsv2.cloud.duba.net
  • 123.207.105.156
suspicious
hw.optimize.cloud.duba.net
  • 35.174.78.65
  • 52.202.0.154
suspicious
urlauth.ksmobile.net
  • 108.128.112.20
  • 108.128.213.82
  • 52.214.192.25
  • 52.17.209.111
  • 52.31.203.138
  • 52.211.73.127
  • 34.249.2.2
  • 52.208.213.95
unknown
cu004.www.duba.net
  • 218.24.18.58
  • 218.24.18.55
  • 218.24.18.52
  • 218.24.18.62
  • 218.24.18.59
  • 218.24.18.56
  • 218.24.18.57
  • 218.24.18.63
  • 218.24.18.54
malicious

Threats

PID
Process
Class
Message
2112
clean_master_1_1.exe
Misc activity
ADWARE [PTsecurity] PUP.Win32/KingSoft.E
3972
cmtray.exe
Generic Protocol Command Decode
SURICATA STREAM CLOSEWAIT FIN out of window
3972
cmtray.exe
Potentially Bad Traffic
ET INFO Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
3972
cmtray.exe
Potentially Bad Traffic
ET INFO Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
10 ETPRO signatures available at the full report
Process
Message
clean_master_1_1.exe
KMainDlg::OnTimerForUnFoldAnimate:TickCount=0 10 36 42 933
clean_master_1_1.exe
KMainDlg::OnTimerForUnFoldAnimate:TickCount=0 10 36 42 964
clean_master_1_1.exe
KMainDlg::OnTimerForUnFoldAnimate:TickCount=0 10 36 42 996
clean_master_1_1.exe
KMainDlg::OnTimerForUnFoldAnimate:TickCount=0 10 36 43 027
clean_master_1_1.exe
KMainDlg::OnTimerForUnFoldAnimate:TickCount=0 10 36 43 058
clean_master_1_1.exe
KMainDlg::OnTimerForUnFoldAnimate:TickCount=0 10 36 43 089
clean_master_1_1.exe
KMainDlg::OnTimerForUnFoldAnimate:TickCount=0 10 36 43 121
clean_master_1_1.exe
KMainDlg::OnTimerForUnFoldAnimate:TickCount=0 10 36 43 152
clean_master_1_1.exe
KMainDlg::OnTimerForUnFoldAnimate:TickCount=0 10 36 43 183
clean_master_1_1.exe
KMainDlg::OnTimerForUnFoldAnimate:TickCount=0 10 36 43 214
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
clean_master_1_1.exe