analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

C:\Users\admin\AppData\Local\Temp\Rar$DRb3472.16976\Sality.gen.55a00c72391b2e89c4500.exe

Full analysis: https://app.any.run/tasks/ccfb8a06-04d7-4faa-a0b9-2c84519a98bb
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: January 15, 2022, 00:20:23
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

CF3469AC31255A00C72391B2E89C4500

SHA1:

296B3E7D0E2986370792B84EC6B67219D76443EF

SHA256:

DC153C2998D06E29764C8406D712E140760691B7DF4817D8FB01C7EC9E0D4A34

SSDEEP:

6144:0YZ2xjAjQGyLl2CNXZPNeE4Km9uL4NjcH41QSoo2TTd1C:0YZ2xjAPel2CtZPNeGccvo2TB1C

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was injected by another process

      • Dwm.exe (PID: 592)
      • taskeng.exe (PID: 784)
      • ctfmon.exe (PID: 1120)
      • Explorer.EXE (PID: 1656)
      • DllHost.exe (PID: 852)
      • DllHost.exe (PID: 3164)
      • DllHost.exe (PID: 2908)
      • DllHost.exe (PID: 1088)

    • Runs injected code in another process

      • Sality.gen.55a00c72391b2e89c4500.exe (PID: 2256)

    • Loads the Task Scheduler COM API

      • CCleaner.exe (PID: 3676)
      • CCleaner.exe (PID: 524)
      • CCUpdate.exe (PID: 3148)
      • CCleaner.exe (PID: 3544)
      • ccleaner.exe (PID: 3816)
      • ccleaner.exe (PID: 1992)
      • AvEmUpdate.exe (PID: 2180)
      • AvEmUpdate.exe (PID: 2024)

    • Drops executable file immediately after starts

      • CCleaner.exe (PID: 524)
      • ccupdate588_free.exe (PID: 4024)
      • CCleaner.exe (PID: 3544)
      • ccleaner.exe (PID: 3816)
      • ccleaner.exe (PID: 1992)
      • avg_antivirus_free_setup.exe (PID: 3200)
      • SetupInf.exe (PID: 3092)
      • DrvInst.exe (PID: 2736)

    • Loads dropped or rewritten executable

      • CCleaner.exe (PID: 524)
      • ccupdate588_free.exe (PID: 4024)
      • CCleaner.exe (PID: 3544)
      • ccleaner.exe (PID: 3816)
      • ccleaner.exe (PID: 1992)
      • CCUpdate.exe (PID: 2716)
      • instup.exe (PID: 2212)
      • instup.exe (PID: 1004)
      • AvEmUpdate.exe (PID: 2024)
      • AvEmUpdate.exe (PID: 2688)
      • AvEmUpdate.exe (PID: 2756)
      • avBugReport.exe (PID: 3460)
      • avBugReport.exe (PID: 3708)

    • Changes settings of System certificates

      • CCleaner.exe (PID: 524)
      • ccleaner.exe (PID: 1992)
      • SetupInf.exe (PID: 3092)

    • Application was dropped or rewritten from another process

      • ccupdate588_free.exe (PID: 4024)
      • CCleaner.exe (PID: 3544)
      • CCUpdate.exe (PID: 3148)
      • ccleaner.exe (PID: 3816)
      • ccleaner.exe (PID: 1992)
      • Microstub.exe (PID: 3412)
      • CCUpdate.exe (PID: 2716)
      • avg_antivirus_free_setup.exe (PID: 3200)
      • instup.exe (PID: 2212)
      • instup.exe (PID: 1004)
      • sbr.exe (PID: 3156)
      • SetupInf.exe (PID: 1260)
      • SetupInf.exe (PID: 1144)
      • SetupInf.exe (PID: 3484)
      • SetupInf.exe (PID: 2380)
      • AvEmUpdate.exe (PID: 2180)
      • AvEmUpdate.exe (PID: 2024)
      • AvEmUpdate.exe (PID: 2688)
      • avBugReport.exe (PID: 3708)
      • AvEmUpdate.exe (PID: 2756)
      • avBugReport.exe (PID: 3460)
      • SetupInf.exe (PID: 4072)
      • SetupInf.exe (PID: 3092)

    • Changes the autorun value in the registry

      • instup.exe (PID: 1004)

  • SUSPICIOUS

    • Checks supported languages

      • Sality.gen.55a00c72391b2e89c4500.exe (PID: 2256)
      • CCleaner.exe (PID: 3676)
      • CCleaner.exe (PID: 524)
      • ccupdate588_free.exe (PID: 4024)
      • CCUpdate.exe (PID: 3148)
      • CCleaner.exe (PID: 3544)
      • ccleaner.exe (PID: 3816)
      • ccleaner.exe (PID: 1992)
      • Microstub.exe (PID: 3412)
      • CCUpdate.exe (PID: 2716)
      • avg_antivirus_free_setup.exe (PID: 3200)
      • instup.exe (PID: 2212)
      • instup.exe (PID: 1004)
      • sbr.exe (PID: 3156)
      • Reader_sl.exe (PID: 3588)
      • AdobeARM.exe (PID: 3456)
      • SetupInf.exe (PID: 1260)
      • SetupInf.exe (PID: 3484)
      • SetupInf.exe (PID: 2380)
      • SetupInf.exe (PID: 1144)
      • AvEmUpdate.exe (PID: 2024)
      • AvEmUpdate.exe (PID: 2180)
      • AvEmUpdate.exe (PID: 2688)
      • AvEmUpdate.exe (PID: 2756)
      • avBugReport.exe (PID: 3460)
      • avBugReport.exe (PID: 3708)
      • SetupInf.exe (PID: 4072)
      • SetupInf.exe (PID: 3092)
      • DrvInst.exe (PID: 2736)

    • Reads the computer name

      • Sality.gen.55a00c72391b2e89c4500.exe (PID: 2256)
      • CCleaner.exe (PID: 3676)
      • CCleaner.exe (PID: 524)
      • ccupdate588_free.exe (PID: 4024)
      • CCUpdate.exe (PID: 3148)
      • CCleaner.exe (PID: 3544)
      • ccleaner.exe (PID: 3816)
      • ccleaner.exe (PID: 1992)
      • Microstub.exe (PID: 3412)
      • CCUpdate.exe (PID: 2716)
      • avg_antivirus_free_setup.exe (PID: 3200)
      • instup.exe (PID: 2212)
      • instup.exe (PID: 1004)
      • AdobeARM.exe (PID: 3456)
      • SetupInf.exe (PID: 1260)
      • SetupInf.exe (PID: 3484)
      • SetupInf.exe (PID: 1144)
      • SetupInf.exe (PID: 2380)
      • AvEmUpdate.exe (PID: 2180)
      • AvEmUpdate.exe (PID: 2024)
      • AvEmUpdate.exe (PID: 2688)
      • AvEmUpdate.exe (PID: 2756)
      • avBugReport.exe (PID: 3460)
      • avBugReport.exe (PID: 3708)
      • SetupInf.exe (PID: 4072)
      • SetupInf.exe (PID: 3092)
      • DrvInst.exe (PID: 2736)

    • Reads Environment values

      • CCleaner.exe (PID: 3676)
      • CCleaner.exe (PID: 524)
      • ccupdate588_free.exe (PID: 4024)
      • CCleaner.exe (PID: 3544)
      • ccleaner.exe (PID: 3816)
      • ccleaner.exe (PID: 1992)
      • instup.exe (PID: 2212)
      • instup.exe (PID: 1004)
      • AvEmUpdate.exe (PID: 2180)
      • AvEmUpdate.exe (PID: 2024)
      • AvEmUpdate.exe (PID: 2688)
      • AvEmUpdate.exe (PID: 2756)
      • vssvc.exe (PID: 2168)

    • Creates files in the program directory

      • CCleaner.exe (PID: 524)
      • ccupdate588_free.exe (PID: 4024)
      • CCleaner.exe (PID: 3544)
      • ccleaner.exe (PID: 3816)
      • ccleaner.exe (PID: 1992)
      • CCUpdate.exe (PID: 3148)
      • avg_antivirus_free_setup.exe (PID: 3200)
      • instup.exe (PID: 2212)
      • instup.exe (PID: 1004)
      • AdobeARM.exe (PID: 3456)
      • AvEmUpdate.exe (PID: 2180)
      • AvEmUpdate.exe (PID: 2024)
      • avBugReport.exe (PID: 3460)

    • Executed via Task Scheduler

      • CCleaner.exe (PID: 524)

    • Executable content was dropped or overwritten

      • CCleaner.exe (PID: 524)
      • Sality.gen.55a00c72391b2e89c4500.exe (PID: 2256)
      • ccupdate588_free.exe (PID: 4024)
      • CCleaner.exe (PID: 3544)
      • ccleaner.exe (PID: 3816)
      • ccleaner.exe (PID: 1992)
      • CCUpdate.exe (PID: 3148)
      • Microstub.exe (PID: 3412)
      • avg_antivirus_free_setup.exe (PID: 3200)
      • instup.exe (PID: 2212)
      • instup.exe (PID: 1004)
      • AdobeARM.exe (PID: 3456)
      • AvEmUpdate.exe (PID: 2024)
      • SetupInf.exe (PID: 3092)
      • DrvInst.exe (PID: 2736)

    • Reads internet explorer settings

      • CCleaner.exe (PID: 524)
      • ccleaner.exe (PID: 1992)

    • Reads CPU info

      • CCleaner.exe (PID: 524)
      • CCleaner.exe (PID: 3544)
      • ccupdate588_free.exe (PID: 4024)
      • ccleaner.exe (PID: 3816)
      • ccleaner.exe (PID: 1992)
      • avg_antivirus_free_setup.exe (PID: 3200)
      • instup.exe (PID: 2212)
      • instup.exe (PID: 1004)
      • SetupInf.exe (PID: 1260)
      • SetupInf.exe (PID: 3484)
      • SetupInf.exe (PID: 2380)
      • SetupInf.exe (PID: 1144)
      • AvEmUpdate.exe (PID: 2180)
      • AvEmUpdate.exe (PID: 2024)
      • AvEmUpdate.exe (PID: 2688)
      • AvEmUpdate.exe (PID: 2756)
      • avBugReport.exe (PID: 3460)
      • avBugReport.exe (PID: 3708)
      • SetupInf.exe (PID: 4072)
      • SetupInf.exe (PID: 3092)

    • Drops a file that was compiled in debug mode

      • CCleaner.exe (PID: 524)
      • Sality.gen.55a00c72391b2e89c4500.exe (PID: 2256)
      • ccupdate588_free.exe (PID: 4024)
      • CCleaner.exe (PID: 3544)
      • ccleaner.exe (PID: 3816)
      • ccleaner.exe (PID: 1992)
      • CCUpdate.exe (PID: 3148)
      • Microstub.exe (PID: 3412)
      • avg_antivirus_free_setup.exe (PID: 3200)
      • instup.exe (PID: 2212)
      • instup.exe (PID: 1004)
      • AvEmUpdate.exe (PID: 2024)
      • SetupInf.exe (PID: 3092)
      • DrvInst.exe (PID: 2736)

    • Reads the date of Windows installation

      • CCleaner.exe (PID: 524)
      • ccleaner.exe (PID: 1992)

    • Creates files in the user directory

      • CCleaner.exe (PID: 524)
      • ccleaner.exe (PID: 1992)

    • Searches for installed software

      • CCleaner.exe (PID: 524)
      • ccupdate588_free.exe (PID: 4024)
      • ccleaner.exe (PID: 1992)

    • Creates a directory in Program Files

      • CCleaner.exe (PID: 524)
      • instup.exe (PID: 1004)
      • AvEmUpdate.exe (PID: 2024)

    • Adds / modifies Windows certificates

      • CCleaner.exe (PID: 524)
      • ccleaner.exe (PID: 1992)

    • Drops a file with too old compile date

      • Sality.gen.55a00c72391b2e89c4500.exe (PID: 2256)
      • instup.exe (PID: 1004)

    • Creates a software uninstall entry

      • ccupdate588_free.exe (PID: 4024)
      • instup.exe (PID: 1004)

    • Application launched itself

      • ccleaner.exe (PID: 3816)
      • CCUpdate.exe (PID: 3148)
      • AvEmUpdate.exe (PID: 2024)

    • Reads default file associations for system extensions

      • Explorer.EXE (PID: 1656)

    • Creates files in the Windows directory

      • Microstub.exe (PID: 3412)
      • avg_antivirus_free_setup.exe (PID: 3200)
      • instup.exe (PID: 2212)
      • instup.exe (PID: 1004)
      • DrvInst.exe (PID: 2736)

    • Starts itself from another location

      • instup.exe (PID: 2212)

    • Creates or modifies windows services

      • instup.exe (PID: 2212)
      • instup.exe (PID: 1004)

    • Removes files from Windows directory

      • instup.exe (PID: 2212)
      • instup.exe (PID: 1004)
      • DrvInst.exe (PID: 2736)

    • Drops a file with a compile date too recent

      • RdrCEF.exe (PID: 2476)
      • instup.exe (PID: 1004)

    • Creates files in the driver directory

      • instup.exe (PID: 1004)
      • DrvInst.exe (PID: 2736)

    • Changes default file association

      • instup.exe (PID: 1004)

    • Creates/Modifies COM task schedule object

      • instup.exe (PID: 1004)

    • Executed via COM

      • DrvInst.exe (PID: 2736)

    • Executed as Windows Service

      • vssvc.exe (PID: 2168)

  • INFO

    • Manual execution by user

      • CCleaner.exe (PID: 3676)
      • explorer.exe (PID: 2712)
      • AcroRd32.exe (PID: 2928)

    • Reads settings of System Certificates

      • CCleaner.exe (PID: 524)
      • ccupdate588_free.exe (PID: 4024)
      • CCUpdate.exe (PID: 3148)
      • ccleaner.exe (PID: 1992)
      • Microstub.exe (PID: 3412)
      • chrome.exe (PID: 2144)
      • CCUpdate.exe (PID: 2716)
      • avg_antivirus_free_setup.exe (PID: 3200)
      • instup.exe (PID: 2212)
      • instup.exe (PID: 1004)
      • AdobeARM.exe (PID: 3456)
      • AcroRd32.exe (PID: 2928)
      • RdrCEF.exe (PID: 2476)
      • AvEmUpdate.exe (PID: 2024)
      • AvEmUpdate.exe (PID: 2688)
      • AvEmUpdate.exe (PID: 2756)
      • avBugReport.exe (PID: 3708)
      • avBugReport.exe (PID: 3460)
      • DrvInst.exe (PID: 2736)

    • Reads the hosts file

      • CCleaner.exe (PID: 524)
      • CCleaner.exe (PID: 3544)
      • ccleaner.exe (PID: 3816)
      • ccleaner.exe (PID: 1992)
      • chrome.exe (PID: 3404)
      • chrome.exe (PID: 2144)
      • instup.exe (PID: 2212)
      • instup.exe (PID: 1004)
      • RdrCEF.exe (PID: 2476)

    • Checks Windows Trust Settings

      • CCleaner.exe (PID: 524)
      • ccupdate588_free.exe (PID: 4024)
      • ccleaner.exe (PID: 1992)
      • AcroRd32.exe (PID: 2928)
      • AdobeARM.exe (PID: 3456)
      • DrvInst.exe (PID: 2736)

    • Checks supported languages

      • DllHost.exe (PID: 3164)
      • explorer.exe (PID: 3424)
      • chrome.exe (PID: 3012)
      • chrome.exe (PID: 1800)
      • chrome.exe (PID: 3404)
      • chrome.exe (PID: 2144)
      • chrome.exe (PID: 612)
      • chrome.exe (PID: 2620)
      • chrome.exe (PID: 2452)
      • chrome.exe (PID: 2912)
      • chrome.exe (PID: 2540)
      • chrome.exe (PID: 2628)
      • AcroRd32.exe (PID: 2928)
      • DllHost.exe (PID: 2908)
      • explorer.exe (PID: 2712)
      • RdrCEF.exe (PID: 2476)
      • AcroRd32.exe (PID: 1564)
      • RdrCEF.exe (PID: 3668)
      • RdrCEF.exe (PID: 2236)
      • RdrCEF.exe (PID: 4056)
      • RdrCEF.exe (PID: 2956)
      • RdrCEF.exe (PID: 1244)
      • RdrCEF.exe (PID: 560)
      • DllHost.exe (PID: 1088)
      • vssvc.exe (PID: 2168)

    • Reads the computer name

      • DllHost.exe (PID: 3164)
      • chrome.exe (PID: 3404)
      • chrome.exe (PID: 2144)
      • chrome.exe (PID: 1800)
      • chrome.exe (PID: 2452)
      • chrome.exe (PID: 2628)
      • explorer.exe (PID: 2712)
      • DllHost.exe (PID: 2908)
      • AcroRd32.exe (PID: 2928)
      • RdrCEF.exe (PID: 2476)
      • AcroRd32.exe (PID: 1564)
      • DllHost.exe (PID: 1088)
      • vssvc.exe (PID: 2168)

    • Application launched itself

      • chrome.exe (PID: 3404)
      • AcroRd32.exe (PID: 2928)
      • RdrCEF.exe (PID: 2476)

    • Changes settings of System certificates

      • chrome.exe (PID: 2144)
      • DrvInst.exe (PID: 2736)

    • Adds / modifies Windows certificates

      • chrome.exe (PID: 2144)
      • DrvInst.exe (PID: 2736)

    • Searches for installed software

      • AcroRd32.exe (PID: 2928)
      • AcroRd32.exe (PID: 1564)
      • DrvInst.exe (PID: 2736)

    • Reads CPU info

      • AcroRd32.exe (PID: 1564)

    • Dropped object may contain Bitcoin addresses

      • instup.exe (PID: 1004)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2015:02:04 08:20:36+01:00
PEType: PE32
LinkerVersion: 6
CodeSize: 167936
InitializedDataSize: 106496
UninitializedDataSize: -
EntryPoint: 0xd9aa
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 6.22.1.1
ProductVersionNumber: 6.22.1.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: Internet Download Manager agent for click monitoring in IE-based browsers
CompanyName: Tonec Inc.
FileDescription: Internet Download Manager agent for click monitoring in IE-based browsers
FileVersion: 6, 22, 1, 1
InternalName: IEMonitor
LegalCopyright: Tonec Inc., Copyright © 1999 - 2015
LegalTrademarks: Internet Download Manager
OriginalFileName: IEMonitor.EXE
PrivateBuild: -
ProductName: IEMonitor Application
ProductVersion: 6, 22, 1, 1
SpecialBuild: -

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 04-Feb-2015 07:20:36
Detected languages:
  • English - United States
Comments: Internet Download Manager agent for click monitoring in IE-based browsers
CompanyName: Tonec Inc.
FileDescription: Internet Download Manager agent for click monitoring in IE-based browsers
FileVersion: 6, 22, 1, 1
InternalName: IEMonitor
LegalCopyright: Tonec Inc., Copyright © 1999 - 2015
LegalTrademarks: Internet Download Manager
OriginalFilename: IEMonitor.EXE
PrivateBuild: -
ProductName: IEMonitor Application
ProductVersion: 6, 22, 1, 1
SpecialBuild: -

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000110

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 4
Time date stamp: 04-Feb-2015 07:20:36
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00028602
0x00029000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
6.58023
.rdata
0x0002A000
0x000099CC
0x0000A000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.55484
.data
0x00034000
0x00008D88
0x00005000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
2.87323
.rsrc
0x0003D000
0x00018000
0x00018000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.51958

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.2986
1422
UNKNOWN
UNKNOWN
RT_MANIFEST
2
5.8336
4264
UNKNOWN
English - United States
RT_ICON
3
6.35549
1128
UNKNOWN
English - United States
RT_ICON
4
3.02695
308
UNKNOWN
English - United States
RT_CURSOR
5
2.74274
180
UNKNOWN
English - United States
RT_CURSOR
102
3.24466
322
UNKNOWN
English - United States
RT_DIALOG
128
2.45849
48
UNKNOWN
English - United States
RT_GROUP_ICON
3841
2.81705
130
UNKNOWN
English - United States
RT_STRING
3842
0.960953
42
UNKNOWN
English - United States
RT_STRING
3843
3.04939
330
UNKNOWN
English - United States
RT_STRING

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
OLEAUT32.dll
OLEPRO32.DLL
USER32.dll
WININET.dll
WINSPOOL.DRV
comdlg32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
100
Monitored processes
59
Malicious processes
20
Suspicious processes
8

Behavior graph

Click at the process to see the details
inject inject inject inject inject inject inject start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start sality.gen.55a00c72391b2e89c4500.exe taskeng.exe dwm.exe explorer.exe ctfmon.exe DllHost.exe ccleaner.exe no specs ccleaner.exe ccupdate588_free.exe ccleaner.exe ccupdate.exe ccleaner.exe explorer.exe no specs ccleaner.exe DllHost.exe microstub.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs ccupdate.exe chrome.exe no specs avg_antivirus_free_setup.exe instup.exe instup.exe sbr.exe no specs explorer.exe no specs Thumbnail Cache Class Factory for Out of Proc Server acrord32.exe acrord32.exe no specs rdrcef.exe rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs DllHost.exe adobearm.exe reader_sl.exe no specs setupinf.exe no specs setupinf.exe no specs setupinf.exe no specs setupinf.exe no specs avemupdate.exe no specs avemupdate.exe avemupdate.exe avemupdate.exe avbugreport.exe avbugreport.exe setupinf.exe no specs setupinf.exe drvinst.exe vssvc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2256"C:\Users\admin\AppData\Local\Temp\Sality.gen.55a00c72391b2e89c4500.exe" C:\Users\admin\AppData\Local\Temp\Sality.gen.55a00c72391b2e89c4500.exe
Explorer.EXE
User:
admin
Company:
Tonec Inc.
Integrity Level:
MEDIUM
Description:
Internet Download Manager agent for click monitoring in IE-based browsers
Version:
6, 22, 1, 1
Modules
Images
c:\users\admin\appdata\local\temp\sality.gen.55a00c72391b2e89c4500.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\comdlg32.dll
784taskeng.exe {3901DEF8-731D-4EFC-B458-65638CE999E3}C:\Windows\system32\taskeng.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Engine
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskeng.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
592"C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Desktop Window Manager
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dwm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\uxtheme.dll
1656C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1120C:\Windows\System32\ctfmon.exe C:\Windows\System32\ctfmon.exe
taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CTF Loader
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ctfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msctfmonitor.dll
c:\windows\system32\msctf.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
852C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}C:\Windows\system32\DllHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3676"C:\Program Files\CCleaner\CCleaner.exe" C:\Program Files\CCleaner\CCleaner.exe—Explorer.EXE
User:
admin
Company:
Piriform Software Ltd
Integrity Level:
MEDIUM
Description:
CCleaner
Exit code:
0
Version:
5.74.0.8198
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\ccleaner\ccleaner.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\nsi.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
524"C:\Program Files\CCleaner\CCleaner.exe" /uacC:\Program Files\CCleaner\CCleaner.exe
taskeng.exe
User:
admin
Company:
Piriform Software Ltd
Integrity Level:
HIGH
Description:
CCleaner
Exit code:
0
Version:
5.74.0.8198
Modules
Images
c:\program files\ccleaner\ccleaner.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\nsi.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
4024"C:\Program Files\CCleaner\temp_ccupdate\ccupdate588_free.exe" /INSTDIR='C:\Program Files\CCleaner' /L=1033 /COMMANDLINE='/uac'C:\Program Files\CCleaner\temp_ccupdate\ccupdate588_free.exe
CCleaner.exe
User:
admin
Company:
Piriform Software Ltd
Integrity Level:
HIGH
Description:
CCleaner Installer
Exit code:
0
Version:
5.88.0.9346
Modules
Images
c:\program files\ccleaner\temp_ccupdate\ccupdate588_free.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
3544"C:\Program Files\CCleaner\CCleaner.exe" /createSkipUAC 5.74.8198C:\Program Files\CCleaner\CCleaner.exe
ccupdate588_free.exe
User:
admin
Company:
Piriform Software Ltd
Integrity Level:
HIGH
Description:
CCleaner
Exit code:
0
Version:
5.88.0.9346
Modules
Images
c:\program files\ccleaner\ccleaner.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
Total events
111 933
Read events
102 678
Write events
9 170
Delete events
85

Modification events

(PID) Process:(2256) Sality.gen.55a00c72391b2e89c4500.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Operation:writeName:Hidden
Value:
2
(PID) Process:(2256) Sality.gen.55a00c72391b2e89c4500.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:GlobalUserOffline
Value:
0
(PID) Process:(2256) Sality.gen.55a00c72391b2e89c4500.exeKey:HKEY_CURRENT_USER\Software\Aaspp\-227342143
Operation:writeName:1768776801
Value:
144
(PID) Process:(2256) Sality.gen.55a00c72391b2e89c4500.exeKey:HKEY_CURRENT_USER\Software\Aaspp\-227342143
Operation:writeName:-757413694
Value:
0
(PID) Process:(2256) Sality.gen.55a00c72391b2e89c4500.exeKey:HKEY_CURRENT_USER\Software\Aaspp\-227342143
Operation:writeName:1011363107
Value:
0
(PID) Process:(2256) Sality.gen.55a00c72391b2e89c4500.exeKey:HKEY_CURRENT_USER\Software\Aaspp\-227342143
Operation:writeName:-1514827388
Value:
35
(PID) Process:(2256) Sality.gen.55a00c72391b2e89c4500.exeKey:HKEY_CURRENT_USER\Software\Aaspp\-227342143
Operation:writeName:253949413
Value:
476
(PID) Process:(2256) Sality.gen.55a00c72391b2e89c4500.exeKey:HKEY_CURRENT_USER\Software\Aaspp\-227342143
Operation:writeName:2022726214
Value:
0C00687474703A2F2F7777772E6C656479617A696C696D2E636F6D2F6C6F676F2E67696600687474703A2F2F6B73616E64726166617368696F6E2E636F6D2F6C6F676F2E67696600687474703A2F2F7777772E6C6166796572692E636F6D2F696D616765732F6C6F676F2E67696600687474703A2F2F6B756C7070617375722E636F6D2F6C6F676F2E67696600687474703A2F2F746F616C6C616465706170656C2E636F6D2E61722F696D616765732F6C6F676F2E67696600687474703A2F2F7777772E65636F6C652D7361696E742D73696D6F6E2E6E65742F696E6465785F746F702F6C6F676F2E67696600687474703A2F2F6C617A617265612E726F2F696D616765732F6C6F676F2E67696600687474703A2F2F6B6F6F6E6164616E6365322E636F6D2F696D616765732F6C6F676F2E67696600687474703A2F2F6B75706C752E62656C2E74722F696D616765732F6C6F676F2E67696600687474703A2F2F7777772E6C69646572616E636173706F6C6974696361732E636F6D2E62722F6C6F676F2E67696600687474703A2F2F7777772E6C6567616C62696C676973617961722E636F6D2F696D672F6C6F676F2E67696600687474703A2F2F6C696665636F6D32342E636F2E63632F696D616765732F6C6F676F2E676966
(PID) Process:(2256) Sality.gen.55a00c72391b2e89c4500.exeKey:HKEY_CURRENT_USER\Software\Aaspp\-227342143
Operation:writeName:-503464281
Value:
83AD022F944CCF21DDECD41871254667172BA39F3E949513F4CC29B07060AC534912E5BCB155880C2C4326E6FB83E6FA099D4219F6885291D527824C5507229614A07CE2AF035D97263FF7F26AD2ACC9D5D4395D4B8B3109DC5C0C87B31A1505E6E94E08EF20E71B91B96D3856F531DADFD78A894AD6A6C177136C5657B01661
(PID) Process:(2256) Sality.gen.55a00c72391b2e89c4500.exeKey:HKEY_CURRENT_USER\Software\Aaspp
Operation:writeName:a1_0
Value:
Executable files
548
Suspicious files
376
Text files
302
Unknown types
68

Dropped files

PID
Process
Filename
Type
524CCleaner.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\YTIVEB7MYNPR1I704S07.tempbinary
MD5:9BC9EF1C6B86399827D946C9A402E27C
SHA256:DC882FAFDBD228E041740284A695A6F76138178E8CEC5B9FAF17CE0F17F39CAD
524CCleaner.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_42D518C245FE7F2F9F026AD6DD212548der
MD5:81DDC7A0DC10D2139F77EA7E31A135D4
SHA256:48F1FD51CC37270BD6752709C2736D1BAF6CE9CCC34D876C0E5DBEA6875A0DEB
524CCleaner.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ed7a5cc3cca8d52a.customDestinations-msbinary
MD5:9BC9EF1C6B86399827D946C9A402E27C
SHA256:DC882FAFDBD228E041740284A695A6F76138178E8CEC5B9FAF17CE0F17F39CAD
524CCleaner.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\auto[1].txttext
MD5:6934FD0F64BDEB0A8F30B277AE4BF392
SHA256:81E03D89C0E3830781EF7BE99E85EAC7C9CDD8FFFAF3FE437ADDA68285228D8C
524CCleaner.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_ACB084F1532E23E916946A083A45F6BFbinary
MD5:9EEF7A0DC2000E9D1D67423A065BAC3E
SHA256:7F5E3E9A8D1EFEEF997EEFA0B1F1922B92393A6305FD8631CAD245AD87454B5B
524CCleaner.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\K896080H.txttext
MD5:3B3612B56A83B9B99DB8EDD90E4FDA68
SHA256:F0135CB1D735163D7E3A0B6137471D2ABECECD98654AF403F931DD6F3AFC2188
524CCleaner.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5ABbinary
MD5:32A484C28BC2F313553EEE83CB7343DE
SHA256:D2D09B2CCAA44917928737D74AF7690756CBF0ADAAC877B5C152FE71C5CD164B
524CCleaner.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:2FE646A2AD4F705FBF6E2E2590CACEF3
SHA256:608EAE992659E9A9950E56F68AD35B9FB665A6557F2A53B069EF126C121A0CCF
524CCleaner.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_42D518C245FE7F2F9F026AD6DD212548binary
MD5:2A73E232470B8886E8C7DBEECB1ED3F7
SHA256:8E9E6A4A9660D7292FD1355BF83CDD6C13D2B7BB20093D31DAC9A0B4D6BED4E6
524CCleaner.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_B514E3306E9B5CC22C1D3DB90570477Abinary
MD5:993104A1F648A7939F8E28486C0E60D5
SHA256:7996761FC0BEC04CEFF51FEE78A0B9E490105F2DA9B52E99FD517CEDD90CED68
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
95
TCP/UDP connections
198
DNS requests
185
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
524
CCleaner.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D
US
der
471 b
whitelisted
524
CCleaner.exe
GET
200
151.101.2.202:80
http://www.ccleaner.com/auto?a=0&p=cc&v=5.74.8198&l=1033&lk=&mk=IJR6-W5SV-5KYR-QBZD-6BY4-RN5Z-WAV9-RVK2-HZ8S&o=6.1W3&au=0&mx=97B7721C4994E2556FF6A439510F665DB45337A341A47E15F4997584423BF714&gd=19ce970b-f6c0-4a09-bae4-274b971730e0
US
text
61 b
whitelisted
524
CCleaner.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAonX%2BcE1u7LI9XNW0saTgQ%3D
US
der
471 b
whitelisted
524
CCleaner.exe
GET
200
104.18.21.226:80
http://ocsp2.globalsign.com/rootr3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT1nGh%2FJBjWKnkPdZIzB1bqhelHBwQUj%2FBLf6guRSSuTVD6Y5qL3uLdG7wCEHgDGCDPAjbzpoUYuu%2B39wE%3D
US
der
1.40 Kb
whitelisted
524
CCleaner.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
US
der
471 b
whitelisted
3148
CCUpdate.exe
HEAD
200
2.16.107.89:80
http://emupdate.avcdn.net/files/emupdate/pong.txt
unknown
—
—
whitelisted
524
CCleaner.exe
GET
200
104.18.21.226:80
http://ocsp2.globalsign.com/rootr3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT1nGh%2FJBjWKnkPdZIzB1bqhelHBwQUj%2FBLf6guRSSuTVD6Y5qL3uLdG7wCEHophRq39F1meVBmQbb%2F1x0%3D
US
der
1.40 Kb
whitelisted
524
CCleaner.exe
GET
200
67.27.158.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?73b7d3a1cfdea95d
US
compressed
4.70 Kb
whitelisted
524
CCleaner.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/ca/gsatlasr3dvtlsca2020/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQT6XbZiiF%2BR%2FUEno7LSD4H4YmN6gQUQm1XLU8fJnd0pidk9oD6j0ho%2FnwCEAFGrms5JJ34O54lbm4pcLY%3D
US
der
1.42 Kb
whitelisted
524
CCleaner.exe
GET
200
104.18.20.226:80
http://crl.globalsign.com/ca/gsatlasr3dvtlsca2020.crl
US
binary
225 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
524
CCleaner.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
524
CCleaner.exe
2.16.107.121:80
ncc.avast.com
Akamai International B.V.
—
suspicious
524
CCleaner.exe
5.62.40.203:443
analytics.ff.avast.com
AVAST Software s.r.o.
DE
unknown
524
CCleaner.exe
151.101.2.202:443
www.ccleaner.com
Fastly
US
suspicious
524
CCleaner.exe
5.62.40.172:443
shepherd.ff.avast.com
AVAST Software s.r.o.
DE
suspicious
524
CCleaner.exe
67.26.73.254:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious
524
CCleaner.exe
104.18.21.226:80
ocsp2.globalsign.com
Cloudflare Inc
US
shared
524
CCleaner.exe
5.62.45.77:443
ipm-provider.ff.avast.com
AVAST Software s.r.o.
US
unknown
524
CCleaner.exe
151.101.2.202:80
www.ccleaner.com
Fastly
US
suspicious
524
CCleaner.exe
67.27.158.126:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
malicious

DNS requests

Domain
IP
Reputation
ncc.avast.com
  • 2.16.107.121
  • 2.16.107.99
whitelisted
analytics.ff.avast.com
  • 5.62.40.203
  • 5.62.40.211
  • 5.62.40.212
whitelisted
www.ccleaner.com
  • 151.101.2.202
  • 151.101.66.202
  • 151.101.130.202
  • 151.101.194.202
whitelisted
ipm-provider.ff.avast.com
  • 5.62.45.77
  • 69.94.76.75
  • 69.94.76.70
  • 5.62.38.45
  • 5.62.46.73
  • 5.62.38.203
  • 5.62.44.204
  • 5.62.44.219
  • 5.62.46.138
  • 69.94.76.96
  • 5.62.53.249
  • 5.62.45.67
whitelisted
shepherd.ff.avast.com
  • 5.62.40.172
  • 69.94.69.113
whitelisted
ctldl.windowsupdate.com
  • 67.27.158.126
  • 8.253.207.121
  • 67.27.157.126
  • 67.27.159.126
  • 67.26.73.254
  • 2.16.186.56
  • 2.16.186.81
whitelisted
ocsp2.globalsign.com
  • 104.18.21.226
  • 104.18.20.226
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
license.piriform.com
  • 151.101.2.109
  • 151.101.66.109
  • 151.101.130.109
  • 151.101.194.109
whitelisted
ocsp.globalsign.com
  • 104.18.21.226
  • 104.18.20.226
whitelisted

Threats

PID
Process
Class
Message
524
CCleaner.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
3544
CCleaner.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
3816
ccleaner.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
1992
ccleaner.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
3148
CCUpdate.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3412
Microstub.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
924
svchost.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
2024
AvEmUpdate.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
—
—
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
—
—
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
4 ETPRO signatures available at the full report
Process
Message
CCleaner.exe
Failed to open log file 'C:\Program Files\CCleaner'
CCleaner.exe
startCheckingLicense()
CCleaner.exe
Using Sciter version 4.4.4.4-r8057
CCleaner.exe
OnLanguage - en
CCleaner.exe
OnLanguage - en
CCleaner.exe
observing CurrentIndex changed - 0
CCleaner.exe
observing CurrentIndex changed - Context.FirstTime=true CurrentIndex=0 LastIndex=4
CCleaner.exe
observing currentResultDetails changed - None
CCleaner.exe
SetStrings - Live Region updated: ,
CCleaner.exe
observing currentModeType changed - Preview
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
C:\Users\admin\AppData\Local\Temp\Rar$DRb3472.16976\Sality.gen.55a00c72391b2e89c4500.exe