download:

Setup.exe

Full analysis: https://app.any.run/tasks/cf3ce250-4732-4879-85b2-4211e76f0f5b
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: December 02, 2019, 20:46:20
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
adware
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

5B63A953AE3D2A0FA49FAC37829DD116

SHA1:

884514A856907B63DB5AB0E4683365A4BBDE5F17

SHA256:

B15BFF0CC2B5600ABACE0DDC795D824CD5863F856D43743A3182CBDCFD2E38F2

SSDEEP:

12288:p1OgLdaOv50/kxr3uzAo9k/3teNJlWcnizFZGULTdhDLHC8RW+dWDjU9Xh2:p1OYdaRPiEWcQBTdhDLLQDMk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads the Task Scheduler DLL interface

      • SymCCISExe.exe (PID: 3000)
      • SymInstallStub.exe (PID: 2988)
      • SymInstallStub.exe (PID: 2620)

    • Application was dropped or rewritten from another process

      • SymInstallStub.exe (PID: 2988)
      • SymCCISExe.exe (PID: 3000)
      • nssSetup.exe (PID: 3172)
      • NSS.exe (PID: 2432)
      • SymCCISExe.exe (PID: 2684)
      • SymInstallStub.exe (PID: 2620)
      • fsdSetup.exe (PID: 1416)
      • fsdSetup.exe (PID: 3776)
      • NSS.exe (PID: 2844)
      • NSS.exe (PID: 1944)
      • NSS.exe (PID: 3016)
      • NSS.exe (PID: 2928)
      • NSS.exe (PID: 584)
      • SymHtmlRender.exe (PID: 3420)

    • Changes the autorun value in the registry

      • nssSetup.exe (PID: 3172)
      • SymInstallStub.exe (PID: 2988)
      • SymInstallStub.exe (PID: 2620)
      • fsdSetup.exe (PID: 1416)
      • fsdSetup.exe (PID: 3776)

    • Loads dropped or rewritten executable

      • nssSetup.exe (PID: 3172)
      • SymCCISExe.exe (PID: 3000)
      • NSS.exe (PID: 2432)
      • rundll32.exe (PID: 444)
      • rundll32.exe (PID: 2956)
      • NSS.exe (PID: 584)
      • SymHtmlRender.exe (PID: 3420)
      • SymCCISExe.exe (PID: 2684)
      • NSS.exe (PID: 2844)
      • rundll32.exe (PID: 1520)
      • NSS.exe (PID: 3016)
      • NSS.exe (PID: 1944)
      • NSS.exe (PID: 2928)
      • rundll32.exe (PID: 1212)

    • Downloads executable files from the Internet

      • SymCCISExe.exe (PID: 3000)
      • SymCCISExe.exe (PID: 2684)

    • Loads the Task Scheduler COM API

      • NSS.exe (PID: 2432)
      • NSS.exe (PID: 584)
      • NSS.exe (PID: 3016)
      • NSS.exe (PID: 2928)

    • Changes settings of System certificates

      • NSS.exe (PID: 2928)

  • SUSPICIOUS

    • Reads internet explorer settings

      • SymCCISExe.exe (PID: 3000)
      • fsdSetup.exe (PID: 3776)

    • Executable content was dropped or overwritten

      • Setup.exe (PID: 1852)
      • SymCCISExe.exe (PID: 3000)
      • SymInstallStub.exe (PID: 2988)
      • nssSetup.exe (PID: 3172)
      • SymCCISExe.exe (PID: 2684)
      • fsdSetup.exe (PID: 1416)
      • SymInstallStub.exe (PID: 2620)

    • Creates a software uninstall entry

      • nssSetup.exe (PID: 3172)

    • Creates files in the program directory

      • SymInstallStub.exe (PID: 2988)
      • NSS.exe (PID: 2432)
      • NSS.exe (PID: 584)
      • nssSetup.exe (PID: 3172)
      • SymCCISExe.exe (PID: 2684)
      • fsdSetup.exe (PID: 1416)
      • fsdSetup.exe (PID: 3776)
      • NSS.exe (PID: 3016)
      • NSS.exe (PID: 2928)

    • Creates files in the Windows directory

      • nssSetup.exe (PID: 3172)

    • Creates files in the driver directory

      • nssSetup.exe (PID: 3172)

    • Uses RUNDLL32.EXE to load library

      • NSS.exe (PID: 584)
      • NSS.exe (PID: 3016)
      • NSS.exe (PID: 2928)
      • NSS.exe (PID: 2432)

    • Starts itself from another location

      • fsdSetup.exe (PID: 1416)

    • Application launched itself

      • NSS.exe (PID: 2844)
      • NSS.exe (PID: 1944)

    • Adds / modifies Windows certificates

      • NSS.exe (PID: 2928)

  • INFO

    • Reads the hosts file

      • NSS.exe (PID: 584)
      • NSS.exe (PID: 2928)

    • Dropped object may contain Bitcoin addresses

      • nssSetup.exe (PID: 3172)
      • NSS.exe (PID: 584)
      • NSS.exe (PID: 2928)

    • Manual execution by user

      • NSS.exe (PID: 2844)
      • NSS.exe (PID: 1944)

    • Reads settings of System Certificates

      • NSS.exe (PID: 584)
      • NSS.exe (PID: 2928)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:11:18 17:27:35+01:00
PEType: PE32
LinkerVersion: 6
CodeSize: 104960
InitializedDataSize: 178688
UninitializedDataSize: -
EntryPoint: 0x14b04
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.1.4.19
ProductVersionNumber: 9.20.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Symantec
FileDescription: SymCCIS
FileVersion: 2.1.4
InternalName: SymCCIS
LegalCopyright: Copyright © 2015 Symantec Corporation.
OriginalFileName: SymCCIS
ProductName: Norton Product Installer
ProductVersion: 2.1.4

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 18-Nov-2010 16:27:35
Detected languages:
  • English - United States
CompanyName: Symantec
FileDescription: SymCCIS
FileVersion: 2.1.4
InternalName: SymCCIS
LegalCopyright: Copyright © 2015 Symantec Corporation.
OriginalFilename: SymCCIS
ProductName: Norton Product Installer
ProductVersion: 2.1.4

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000E8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 18-Nov-2010 16:27:35
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x000199EA
0x00019A00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.60849
.rdata
0x0001B000
0x00004494
0x00004600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.36802
.data
0x00020000
0x00005A48
0x00003200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
1.37054
.sxdata
0x00026000
0x00000004
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_LNK_INFO, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.0203931
.rsrc
0x00027000
0x00023F68
0x00024000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.08366

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.67679
1744
Latin 1 / Western European
English - United States
RT_MANIFEST
5
1.43775
52
Latin 1 / Western European
English - United States
RT_STRING
11
3.33114
1320
Latin 1 / Western European
UNKNOWN
RT_ICON
12
4.13046
2920
Latin 1 / Western European
UNKNOWN
RT_ICON
13
2.84238
5160
Latin 1 / Western European
UNKNOWN
RT_ICON
14
3.50025
11560
Latin 1 / Western European
UNKNOWN
RT_ICON
15
2.87659
81960
Latin 1 / Western European
UNKNOWN
RT_ICON
16
7.98642
40717
Latin 1 / Western European
UNKNOWN
RT_ICON
500
3.0766
166
Latin 1 / Western European
English - United States
RT_DIALOG
501
2.90863
90
Latin 1 / Western European
UNKNOWN
RT_GROUP_ICON

Imports

KERNEL32.dll
OLEAUT32.dll
SHELL32.dll
USER32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
68
Monitored processes
20
Malicious processes
18
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start drop and start drop and start drop and start setup.exe symccisexe.exe syminstallstub.exe nsssetup.exe nss.exe rundll32.exe no specs nss.exe rundll32.exe no specs symhtmlrender.exe symccisexe.exe syminstallstub.exe fsdsetup.exe fsdsetup.exe nss.exe no specs nss.exe rundll32.exe no specs nss.exe no specs nss.exe rundll32.exe no specs setup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
444"C:\Windows\System32\rundll32.exe" "C:\Program Files\Norton Security Scan\Engine\4.7.0.181\pePIDyn.dll" _RunServer@16C:\Windows\System32\rundll32.exe—NSS.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
584"C:\Program Files\Norton Security Scan\Engine\4.7.0.181\NSS.exe" action=run mode=fmui fmui="C:\Program Files\Norton Security Scan\Branding\Config.dll" setup=CORE start=FirstLaunch ptkdata="C:\ProgramData\Norton\{397E31AA-0D78-4649-A01C-339D73A2ED35}\NSS_4.7.0.181"C:\Program Files\Norton Security Scan\Engine\4.7.0.181\NSS.exe
nssSetup.exe
User:
admin
Company:
Symantec Corporation
Integrity Level:
HIGH
Description:
Norton Security Scan
Exit code:
0
Version:
4.7.0.181
Modules
Images
c:\program files\norton security scan\engine\4.7.0.181\nss.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\program files\norton security scan\engine\4.7.0.181\msvcp140.dll
c:\program files\norton security scan\engine\4.7.0.181\vcruntime140.dll
1212"C:\Windows\System32\rundll32.exe" "C:\Program Files\Norton Security Scan\Engine\4.7.0.181\pePIDyn.dll" _RunServer@16C:\Windows\System32\rundll32.exe—NSS.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1416"C:\Users\admin\AppData\Local\Temp\fsdSetup.exe" C:\Users\admin\AppData\Local\Temp\fsdSetup.exe
SymInstallStub.exe
User:
admin
Company:
Symantec Corporation
Integrity Level:
HIGH
Description:
Norton Download Manager
Exit code:
0
Version:
5.9.0.16
Modules
Images
c:\users\admin\appdata\local\temp\fsdsetup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1520"C:\Windows\System32\rundll32.exe" "C:\Program Files\Norton Security Scan\Engine\4.7.0.181\pePIDyn.dll" _RunServer@16C:\Windows\System32\rundll32.exe—NSS.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1852"C:\Users\admin\Desktop\Setup.exe" C:\Users\admin\Desktop\Setup.exe
explorer.exe
User:
admin
Company:
Symantec
Integrity Level:
HIGH
Description:
SymCCIS
Exit code:
0
Version:
2.1.4
Modules
Images
c:\users\admin\desktop\setup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
1944"C:\Program Files\Norton Security Scan\Engine\4.7.0.181\NSS.exe" action=run mode=fmui fmui="C:\Program Files\Norton Security Scan\Branding\Config.dll" setup=CORE start=Normal ptkdata="C:\ProgramData\Norton\{397E31AA-0D78-4649-A01C-339D73A2ED35}\NSS_4.7.0.181"C:\Program Files\Norton Security Scan\Engine\4.7.0.181\NSS.exe—explorer.exe
User:
admin
Company:
Symantec Corporation
Integrity Level:
MEDIUM
Description:
Norton Security Scan
Exit code:
0
Version:
4.7.0.181
Modules
Images
c:\program files\norton security scan\engine\4.7.0.181\nss.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\program files\norton security scan\engine\4.7.0.181\msvcp140.dll
c:\program files\norton security scan\engine\4.7.0.181\vcruntime140.dll
1972"C:\Users\admin\Desktop\Setup.exe" C:\Users\admin\Desktop\Setup.exe—explorer.exe
User:
admin
Company:
Symantec
Integrity Level:
MEDIUM
Description:
SymCCIS
Exit code:
3221226540
Version:
2.1.4
Modules
Images
c:\users\admin\desktop\setup.exe
c:\systemroot\system32\ntdll.dll
2432"C:\Program Files\Norton Security Scan\Engine\4.7.0.181\NSS.exe" action=run mode=fmui fmui="C:\Program Files\Norton Security Scan\Branding\Config.dll" setup=LITE start=Install ptkdata="C:\ProgramData\Norton\{397E31AA-0D78-4649-A01C-339D73A2ED35}\NSS_4.7.0.181"C:\Program Files\Norton Security Scan\Engine\4.7.0.181\NSS.exe
nssSetup.exe
User:
admin
Company:
Symantec Corporation
Integrity Level:
HIGH
Description:
Norton Security Scan
Exit code:
0
Version:
4.7.0.181
Modules
Images
c:\program files\norton security scan\engine\4.7.0.181\nss.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\program files\norton security scan\engine\4.7.0.181\msvcp140.dll
c:\program files\norton security scan\engine\4.7.0.181\vcruntime140.dll
2620"C:\Program Files\Norton Security Scan\Engine\4.7.0.181\SymInstallStub.exe" /staging=false /partnerid=symantecnss /productlist=fsd /closeuiC:\Program Files\Norton Security Scan\Engine\4.7.0.181\SymInstallStub.exe
NSS.exe
User:
admin
Company:
Symantec Corporation
Integrity Level:
HIGH
Description:
SymInstallStub
Exit code:
0
Version:
3.8.3.55
Modules
Images
c:\program files\norton security scan\engine\4.7.0.181\syminstallstub.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
3 374
Read events
3 011
Write events
353
Delete events
10

Modification events

(PID) Process:(3000) SymCCISExe.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3000) SymCCISExe.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SymCCISExe_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3000) SymCCISExe.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SymCCISExe_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3000) SymCCISExe.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SymCCISExe_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(3000) SymCCISExe.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SymCCISExe_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(3000) SymCCISExe.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SymCCISExe_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3000) SymCCISExe.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SymCCISExe_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(3000) SymCCISExe.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SymCCISExe_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3000) SymCCISExe.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SymCCISExe_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3000) SymCCISExe.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SymCCISExe_RASMANCS
Operation:writeName:FileTracingMask
Value:
4294901760
Executable files
282
Suspicious files
41
Text files
31
Unknown types
7

Dropped files

PID
Process
Filename
Type
2988SymInstallStub.exeC:\Users\admin\AppData\Local\Temp\SymInstallStub\symantec\ISD51D.tmp —
MD5:—
SHA256:—
2988SymInstallStub.exeC:\Users\admin\AppData\Local\Temp\IS3232.tmp —
MD5:—
SHA256:—
1852Setup.exeC:\Users\admin\AppData\Local\Temp\7zSB64A.tmp\SymCCIS.dllexecutable
MD5:—
SHA256:—
1852Setup.exeC:\Users\admin\AppData\Local\Temp\7zSB64A.tmp\SymCCISExe.exeexecutable
MD5:—
SHA256:—
3000SymCCISExe.exeC:\Users\admin\AppData\Local\Temp\7zSB64A.tmp\SCC.configbinary
MD5:—
SHA256:—
2988SymInstallStub.exeC:\ProgramData\Norton\{086A63F0-6B13-4F29-9695-134E7A01E963}\LC.INItext
MD5:—
SHA256:—
2988SymInstallStub.exeC:\Users\admin\AppData\Local\Temp\SymInstallStub\symantec\SymInstallStub.config.txtbinary
MD5:—
SHA256:—
3172nssSetup.exeC:\Program Files\NortonInstaller\{397E31AA-0D78-4649-A01C-339D73A2ED35}\NSS\LicenseType\4.7.0.181\04\01\InsBrand.locexecutable
MD5:—
SHA256:—
3172nssSetup.exeC:\Program Files\NortonInstaller\{397E31AA-0D78-4649-A01C-339D73A2ED35}\NSS\LicenseType\4.7.0.181\06\01\InsBrand.locexecutable
MD5:—
SHA256:—
2988SymInstallStub.exeC:\Users\admin\AppData\Local\Temp\nssSetup.exeexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
40
DNS requests
15
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3776
fsdSetup.exe
HEAD
200
152.195.132.156:80
http://liveupdate.symantecliveupdate.com/upgrade/NSS/SymCCIS/Production/IS/ns/MUI/symantecnss/Setup.exe
US
—
—
whitelisted
3172
nssSetup.exe
POST
—
52.234.215.129:80
http://stats.norton.com/n/p?module=9000&error=100&MID=AC9B36B1-F0DA-4C70-BEBD-E3A5983BBD3E&build=90AE26E0CFF34AC9BFC3B2B1A3B45084&d=0&f=6.1.7601.1.0.0.0&g=AC9B36B1-F0DA-4C70-BEBD-E3A5983BBD3E&i=0&l=0&language=09.01&product=Norton%20Security%20Scan&t=0&u=00000000&upgrade=0&v=11.10.1.47&version=4.7.0.181&w=2&x=0&z=0&zzz=0fa45dec457a28828
US
—
—
whitelisted
2684
SymCCISExe.exe
GET
400
40.118.201.45:80
http://stats.norton.com/n/p?module=9151&product=SymCCIS&version=2.1.4.3&language=09.01&os=6.1.7601.1.0&y=1033&a=SymCCISExe&b=symantecnss&d=false&f=-1&m="C:\Program%20Files\Norton%20Security%20Scan\Engine\4.7.0.181\SymCCISExe.exe"%20/downloadis%20/staging=false%20/uimode=silent%20/partnerid=symantecnss&n=0&o=0x0
US
—
—
malicious
3776
fsdSetup.exe
HEAD
200
152.195.132.120:80
http://liveupdate.symantec.com/upgrade/NSS/SymCCIS/Production/IS/fsd/MUI/symantecnss/FSDPlugin.dll
US
—
—
suspicious
3776
fsdSetup.exe
GET
—
152.195.132.156:80
http://liveupdate.symantecliveupdate.com/upgrade/NSS/SymCCIS/Production/IS/ns/MUI/symantecnss/Setup.exe
US
—
—
whitelisted
3000
SymCCISExe.exe
GET
200
52.234.215.129:80
http://stats.norton.com/n/p?module=9151&product=SymCCIS&version=2.1.4.19&language=09.01&os=6.1.7601.1.0&y=1033&b=symantec&a=RunInstallStub&f=nss&c=false&d=false&e=0x0&error=0&m=0
US
text
13 b
whitelisted
3776
fsdSetup.exe
GET
200
40.118.201.45:80
http://stats.norton.com/n/p?module=9090&language=09.01&product=Norton%20Download%20Manager&version=5.9.0.16&OS=6.1.7601.1.0.0&error=00000000&e=00000000&b=%7BNSSYM-B201-4abb-B07C-C084B04B4F12%7D&c=%7BNSB2254-2EED-40d2-8F41-EA92D16DCE3B%7D&MID=AC9B36B1-F0DA-4C70-BEBD-E3A5983BBD3E&y=0&z=0&zzz=01815defc57738f89
US
text
13 b
malicious
3000
SymCCISExe.exe
GET
400
52.234.215.129:80
http://stats.norton.com/n/p?module=9151&product=SymCCIS&version=2.1.4.19&language=09.01&os=6.1.7601.1.0&y=1033&a=SymCCISExe&b=symantec&d=&f=-1&m=.\SymCCISExe.exe%20/partnerid=symantec&n=0&o=0x0
US
text
13 b
whitelisted
3000
SymCCISExe.exe
GET
200
52.234.215.129:80
http://stats.norton.com/n/p?module=9151&product=SymCCIS&version=2.1.4.19&language=09.01&os=6.1.7601.1.0&y=1033&b=symantec&a=CallCriteriaChecker&f=10&c=false&d=false&e=0x0&error=0&j=nss=install&k=nss=1000&g=0.174&l=4.670&q=&t=&u=
US
text
13 b
whitelisted
3000
SymCCISExe.exe
GET
200
152.195.132.156:80
http://liveupdate.symantecliveupdate.com/upgrade/NSS/SymCCIS/Production/SymInstallStub.exe
US
executable
1.76 Mb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3000
SymCCISExe.exe
52.234.215.129:443
stats.norton.com
Microsoft Corporation
US
whitelisted
3172
nssSetup.exe
52.234.215.129:80
stats.norton.com
Microsoft Corporation
US
whitelisted
2988
SymInstallStub.exe
152.195.132.156:443
liveupdate.symantecliveupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2988
SymInstallStub.exe
40.118.201.45:443
stats.norton.com
Microsoft Corporation
US
malicious
2432
NSS.exe
52.234.215.129:443
stats.norton.com
Microsoft Corporation
US
whitelisted
2432
NSS.exe
152.195.132.156:443
liveupdate.symantecliveupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
584
NSS.exe
152.195.132.156:443
liveupdate.symantecliveupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
584
NSS.exe
40.118.201.45:443
stats.norton.com
Microsoft Corporation
US
malicious
584
NSS.exe
23.96.34.208:443
nss-shasta-rrs.symantec.com
Microsoft Corporation
US
unknown
2684
SymCCISExe.exe
40.118.201.45:80
stats.norton.com
Microsoft Corporation
US
malicious

DNS requests

Domain
IP
Reputation
liveupdate.symantecliveupdate.com
  • 152.195.132.156
unknown
stats.norton.com
  • 52.234.215.129
  • 40.118.201.45
unknown
dns.msftncsi.com
  • 131.107.255.255
shared
stats.qalabs.symantec.com
  • —
unknown
nss-shasta-rrs.symantec.com
  • 23.96.34.208
unknown
www.download.windowsupdate.com
  • 205.185.216.42
  • 205.185.216.10
whitelisted
liveupdate.symantec.com
  • 152.195.132.120
suspicious

Threats

PID
Process
Class
Message
3000
SymCCISExe.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3000
SymCCISExe.exe
A Network Trojan was detected
ET POLICY Norton Update User-Agent (Install Stub)
3000
SymCCISExe.exe
Misc activity
ADWARE [PTsecurity] NSIS.DealPly.xiazai
3000
SymCCISExe.exe
A Network Trojan was detected
ET POLICY Norton Update User-Agent (Install Stub)
3000
SymCCISExe.exe
Misc activity
ADWARE [PTsecurity] NSIS.DealPly.xiazai
3000
SymCCISExe.exe
A Network Trojan was detected
ET POLICY Norton Update User-Agent (Install Stub)
3000
SymCCISExe.exe
Misc activity
ADWARE [PTsecurity] NSIS.DealPly.xiazai
2684
SymCCISExe.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2684
SymCCISExe.exe
A Network Trojan was detected
ET POLICY Norton Update User-Agent (Install Stub)
2684
SymCCISExe.exe
Misc activity
ADWARE [PTsecurity] NSIS.DealPly.xiazai
Process
Message
nssSetup.exe
Information at self.ready (C:\Users\CM\AppData\Local\Temp\c67f1a42-6de6-4272-b137-585ccac44d3d\CLOUD_CONNECT.tis(867)) self.ready
NSS.exe
wrong @const declaration at (res:std_colors.css(20))
NSS.exe
wrong @const declaration at (res:std_colors.css(20))
NSS.exe
unknown property 'table-layout' at (res:MainUISecurity.css(63))
NSS.exe
unknown property 'table-layout' at (res:MainUICookies.css(138))
NSS.exe
prevbutton: <button#scan_feature>
NSS.exe
Element to open: <details#scan_details/ScanDetails>
NSS.exe
x, w, imageWidth: 0 198 32
NSS.exe
in class ScanDetails::on_open() ...
NSS.exe
in class Details::on_open() ...
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Setup.exe