File name:

C:\Users\admin\AppData\Local\Temp\Rar$DRb3472.16976\Sality.gen.55a00c72391b2e89c4500.exe

Full analysis: https://app.any.run/tasks/ccfb8a06-04d7-4faa-a0b9-2c84519a98bb
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: January 15, 2022, 00:20:23
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

CF3469AC31255A00C72391B2E89C4500

SHA1:

296B3E7D0E2986370792B84EC6B67219D76443EF

SHA256:

DC153C2998D06E29764C8406D712E140760691B7DF4817D8FB01C7EC9E0D4A34

SSDEEP:

6144:0YZ2xjAjQGyLl2CNXZPNeE4Km9uL4NjcH41QSoo2TTd1C:0YZ2xjAPel2CtZPNeGccvo2TB1C

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Runs injected code in another process

      • Sality.gen.55a00c72391b2e89c4500.exe (PID: 2256)

    • Application was injected by another process

      • DllHost.exe (PID: 852)
      • Explorer.EXE (PID: 1656)
      • ctfmon.exe (PID: 1120)
      • Dwm.exe (PID: 592)
      • taskeng.exe (PID: 784)
      • DllHost.exe (PID: 3164)
      • DllHost.exe (PID: 2908)
      • DllHost.exe (PID: 1088)

    • Loads the Task Scheduler COM API

      • CCleaner.exe (PID: 3676)
      • CCleaner.exe (PID: 524)
      • CCUpdate.exe (PID: 3148)
      • CCleaner.exe (PID: 3544)
      • ccleaner.exe (PID: 3816)
      • ccleaner.exe (PID: 1992)
      • AvEmUpdate.exe (PID: 2180)
      • AvEmUpdate.exe (PID: 2024)

    • Drops executable file immediately after starts

      • CCleaner.exe (PID: 524)
      • ccupdate588_free.exe (PID: 4024)
      • CCleaner.exe (PID: 3544)
      • ccleaner.exe (PID: 3816)
      • ccleaner.exe (PID: 1992)
      • avg_antivirus_free_setup.exe (PID: 3200)
      • SetupInf.exe (PID: 3092)
      • DrvInst.exe (PID: 2736)

    • Loads dropped or rewritten executable

      • CCleaner.exe (PID: 524)
      • ccupdate588_free.exe (PID: 4024)
      • CCleaner.exe (PID: 3544)
      • ccleaner.exe (PID: 3816)
      • ccleaner.exe (PID: 1992)
      • CCUpdate.exe (PID: 2716)
      • instup.exe (PID: 2212)
      • instup.exe (PID: 1004)
      • AvEmUpdate.exe (PID: 2024)
      • AvEmUpdate.exe (PID: 2688)
      • AvEmUpdate.exe (PID: 2756)
      • avBugReport.exe (PID: 3708)
      • avBugReport.exe (PID: 3460)

    • Changes settings of System certificates

      • CCleaner.exe (PID: 524)
      • ccleaner.exe (PID: 1992)
      • SetupInf.exe (PID: 3092)

    • Application was dropped or rewritten from another process

      • ccupdate588_free.exe (PID: 4024)
      • CCUpdate.exe (PID: 3148)
      • CCleaner.exe (PID: 3544)
      • ccleaner.exe (PID: 3816)
      • ccleaner.exe (PID: 1992)
      • Microstub.exe (PID: 3412)
      • CCUpdate.exe (PID: 2716)
      • avg_antivirus_free_setup.exe (PID: 3200)
      • instup.exe (PID: 2212)
      • instup.exe (PID: 1004)
      • sbr.exe (PID: 3156)
      • SetupInf.exe (PID: 1260)
      • SetupInf.exe (PID: 3484)
      • SetupInf.exe (PID: 1144)
      • SetupInf.exe (PID: 2380)
      • AvEmUpdate.exe (PID: 2180)
      • AvEmUpdate.exe (PID: 2024)
      • AvEmUpdate.exe (PID: 2688)
      • AvEmUpdate.exe (PID: 2756)
      • avBugReport.exe (PID: 3460)
      • avBugReport.exe (PID: 3708)
      • SetupInf.exe (PID: 4072)
      • SetupInf.exe (PID: 3092)

    • Changes the autorun value in the registry

      • instup.exe (PID: 1004)

  • SUSPICIOUS

    • Checks supported languages

      • Sality.gen.55a00c72391b2e89c4500.exe (PID: 2256)
      • CCleaner.exe (PID: 3676)
      • CCleaner.exe (PID: 524)
      • ccupdate588_free.exe (PID: 4024)
      • CCleaner.exe (PID: 3544)
      • CCUpdate.exe (PID: 3148)
      • ccleaner.exe (PID: 3816)
      • ccleaner.exe (PID: 1992)
      • Microstub.exe (PID: 3412)
      • CCUpdate.exe (PID: 2716)
      • avg_antivirus_free_setup.exe (PID: 3200)
      • instup.exe (PID: 2212)
      • instup.exe (PID: 1004)
      • sbr.exe (PID: 3156)
      • AdobeARM.exe (PID: 3456)
      • Reader_sl.exe (PID: 3588)
      • SetupInf.exe (PID: 1260)
      • SetupInf.exe (PID: 3484)
      • SetupInf.exe (PID: 1144)
      • SetupInf.exe (PID: 2380)
      • AvEmUpdate.exe (PID: 2180)
      • AvEmUpdate.exe (PID: 2024)
      • AvEmUpdate.exe (PID: 2688)
      • AvEmUpdate.exe (PID: 2756)
      • avBugReport.exe (PID: 3460)
      • avBugReport.exe (PID: 3708)
      • SetupInf.exe (PID: 4072)
      • SetupInf.exe (PID: 3092)
      • DrvInst.exe (PID: 2736)

    • Reads the computer name

      • CCleaner.exe (PID: 524)
      • Sality.gen.55a00c72391b2e89c4500.exe (PID: 2256)
      • CCleaner.exe (PID: 3676)
      • ccupdate588_free.exe (PID: 4024)
      • CCUpdate.exe (PID: 3148)
      • CCleaner.exe (PID: 3544)
      • ccleaner.exe (PID: 3816)
      • ccleaner.exe (PID: 1992)
      • Microstub.exe (PID: 3412)
      • CCUpdate.exe (PID: 2716)
      • avg_antivirus_free_setup.exe (PID: 3200)
      • instup.exe (PID: 2212)
      • instup.exe (PID: 1004)
      • AdobeARM.exe (PID: 3456)
      • SetupInf.exe (PID: 1260)
      • SetupInf.exe (PID: 3484)
      • SetupInf.exe (PID: 1144)
      • SetupInf.exe (PID: 2380)
      • AvEmUpdate.exe (PID: 2180)
      • AvEmUpdate.exe (PID: 2024)
      • AvEmUpdate.exe (PID: 2688)
      • AvEmUpdate.exe (PID: 2756)
      • avBugReport.exe (PID: 3460)
      • avBugReport.exe (PID: 3708)
      • SetupInf.exe (PID: 4072)
      • SetupInf.exe (PID: 3092)
      • DrvInst.exe (PID: 2736)

    • Executable content was dropped or overwritten

      • CCleaner.exe (PID: 524)
      • Sality.gen.55a00c72391b2e89c4500.exe (PID: 2256)
      • ccupdate588_free.exe (PID: 4024)
      • CCleaner.exe (PID: 3544)
      • ccleaner.exe (PID: 3816)
      • ccleaner.exe (PID: 1992)
      • CCUpdate.exe (PID: 3148)
      • Microstub.exe (PID: 3412)
      • avg_antivirus_free_setup.exe (PID: 3200)
      • instup.exe (PID: 2212)
      • instup.exe (PID: 1004)
      • AdobeARM.exe (PID: 3456)
      • AvEmUpdate.exe (PID: 2024)
      • SetupInf.exe (PID: 3092)
      • DrvInst.exe (PID: 2736)

    • Creates files in the program directory

      • CCleaner.exe (PID: 524)
      • ccupdate588_free.exe (PID: 4024)
      • CCleaner.exe (PID: 3544)
      • ccleaner.exe (PID: 3816)
      • CCUpdate.exe (PID: 3148)
      • ccleaner.exe (PID: 1992)
      • avg_antivirus_free_setup.exe (PID: 3200)
      • instup.exe (PID: 2212)
      • instup.exe (PID: 1004)
      • AdobeARM.exe (PID: 3456)
      • AvEmUpdate.exe (PID: 2180)
      • AvEmUpdate.exe (PID: 2024)
      • avBugReport.exe (PID: 3460)

    • Reads CPU info

      • CCleaner.exe (PID: 524)
      • ccupdate588_free.exe (PID: 4024)
      • CCleaner.exe (PID: 3544)
      • ccleaner.exe (PID: 3816)
      • ccleaner.exe (PID: 1992)
      • avg_antivirus_free_setup.exe (PID: 3200)
      • instup.exe (PID: 2212)
      • instup.exe (PID: 1004)
      • SetupInf.exe (PID: 1260)
      • SetupInf.exe (PID: 3484)
      • SetupInf.exe (PID: 1144)
      • SetupInf.exe (PID: 2380)
      • AvEmUpdate.exe (PID: 2180)
      • AvEmUpdate.exe (PID: 2024)
      • AvEmUpdate.exe (PID: 2688)
      • AvEmUpdate.exe (PID: 2756)
      • avBugReport.exe (PID: 3708)
      • avBugReport.exe (PID: 3460)
      • SetupInf.exe (PID: 4072)
      • SetupInf.exe (PID: 3092)

    • Drops a file that was compiled in debug mode

      • CCleaner.exe (PID: 524)
      • Sality.gen.55a00c72391b2e89c4500.exe (PID: 2256)
      • ccupdate588_free.exe (PID: 4024)
      • CCleaner.exe (PID: 3544)
      • ccleaner.exe (PID: 3816)
      • ccleaner.exe (PID: 1992)
      • CCUpdate.exe (PID: 3148)
      • Microstub.exe (PID: 3412)
      • avg_antivirus_free_setup.exe (PID: 3200)
      • instup.exe (PID: 2212)
      • instup.exe (PID: 1004)
      • AvEmUpdate.exe (PID: 2024)
      • SetupInf.exe (PID: 3092)
      • DrvInst.exe (PID: 2736)

    • Reads Environment values

      • CCleaner.exe (PID: 3676)
      • CCleaner.exe (PID: 524)
      • CCleaner.exe (PID: 3544)
      • ccupdate588_free.exe (PID: 4024)
      • ccleaner.exe (PID: 3816)
      • ccleaner.exe (PID: 1992)
      • instup.exe (PID: 1004)
      • instup.exe (PID: 2212)
      • AvEmUpdate.exe (PID: 2180)
      • AvEmUpdate.exe (PID: 2024)
      • AvEmUpdate.exe (PID: 2688)
      • AvEmUpdate.exe (PID: 2756)
      • vssvc.exe (PID: 2168)

    • Searches for installed software

      • CCleaner.exe (PID: 524)
      • ccupdate588_free.exe (PID: 4024)
      • ccleaner.exe (PID: 1992)

    • Creates a directory in Program Files

      • CCleaner.exe (PID: 524)
      • instup.exe (PID: 1004)
      • AvEmUpdate.exe (PID: 2024)

    • Adds / modifies Windows certificates

      • CCleaner.exe (PID: 524)
      • ccleaner.exe (PID: 1992)

    • Reads the date of Windows installation

      • CCleaner.exe (PID: 524)
      • ccleaner.exe (PID: 1992)

    • Creates files in the user directory

      • CCleaner.exe (PID: 524)
      • ccleaner.exe (PID: 1992)

    • Executed via Task Scheduler

      • CCleaner.exe (PID: 524)

    • Drops a file with too old compile date

      • Sality.gen.55a00c72391b2e89c4500.exe (PID: 2256)
      • instup.exe (PID: 1004)

    • Creates a software uninstall entry

      • ccupdate588_free.exe (PID: 4024)
      • instup.exe (PID: 1004)

    • Reads internet explorer settings

      • CCleaner.exe (PID: 524)
      • ccleaner.exe (PID: 1992)

    • Application launched itself

      • ccleaner.exe (PID: 3816)
      • CCUpdate.exe (PID: 3148)
      • AvEmUpdate.exe (PID: 2024)

    • Reads default file associations for system extensions

      • Explorer.EXE (PID: 1656)

    • Creates files in the Windows directory

      • Microstub.exe (PID: 3412)
      • avg_antivirus_free_setup.exe (PID: 3200)
      • instup.exe (PID: 2212)
      • instup.exe (PID: 1004)
      • DrvInst.exe (PID: 2736)

    • Creates or modifies windows services

      • instup.exe (PID: 2212)
      • instup.exe (PID: 1004)

    • Removes files from Windows directory

      • instup.exe (PID: 2212)
      • instup.exe (PID: 1004)
      • DrvInst.exe (PID: 2736)

    • Starts itself from another location

      • instup.exe (PID: 2212)

    • Drops a file with a compile date too recent

      • instup.exe (PID: 1004)
      • RdrCEF.exe (PID: 2476)

    • Creates files in the driver directory

      • instup.exe (PID: 1004)
      • DrvInst.exe (PID: 2736)

    • Changes default file association

      • instup.exe (PID: 1004)

    • Creates/Modifies COM task schedule object

      • instup.exe (PID: 1004)

    • Executed via COM

      • DrvInst.exe (PID: 2736)

    • Executed as Windows Service

      • vssvc.exe (PID: 2168)

  • INFO

    • Manual execution by user

      • CCleaner.exe (PID: 3676)
      • explorer.exe (PID: 2712)
      • AcroRd32.exe (PID: 2928)

    • Reads the hosts file

      • CCleaner.exe (PID: 524)
      • CCleaner.exe (PID: 3544)
      • ccleaner.exe (PID: 3816)
      • ccleaner.exe (PID: 1992)
      • chrome.exe (PID: 3404)
      • chrome.exe (PID: 2144)
      • instup.exe (PID: 2212)
      • instup.exe (PID: 1004)
      • RdrCEF.exe (PID: 2476)

    • Reads settings of System Certificates

      • CCleaner.exe (PID: 524)
      • CCUpdate.exe (PID: 3148)
      • ccupdate588_free.exe (PID: 4024)
      • ccleaner.exe (PID: 1992)
      • Microstub.exe (PID: 3412)
      • chrome.exe (PID: 2144)
      • CCUpdate.exe (PID: 2716)
      • avg_antivirus_free_setup.exe (PID: 3200)
      • instup.exe (PID: 2212)
      • instup.exe (PID: 1004)
      • AcroRd32.exe (PID: 2928)
      • RdrCEF.exe (PID: 2476)
      • AdobeARM.exe (PID: 3456)
      • AvEmUpdate.exe (PID: 2024)
      • AvEmUpdate.exe (PID: 2688)
      • AvEmUpdate.exe (PID: 2756)
      • avBugReport.exe (PID: 3460)
      • avBugReport.exe (PID: 3708)
      • DrvInst.exe (PID: 2736)

    • Checks Windows Trust Settings

      • CCleaner.exe (PID: 524)
      • ccupdate588_free.exe (PID: 4024)
      • ccleaner.exe (PID: 1992)
      • AcroRd32.exe (PID: 2928)
      • AdobeARM.exe (PID: 3456)
      • DrvInst.exe (PID: 2736)

    • Checks supported languages

      • DllHost.exe (PID: 3164)
      • explorer.exe (PID: 3424)
      • chrome.exe (PID: 3404)
      • chrome.exe (PID: 3012)
      • chrome.exe (PID: 1800)
      • chrome.exe (PID: 2540)
      • chrome.exe (PID: 2912)
      • chrome.exe (PID: 612)
      • chrome.exe (PID: 2620)
      • chrome.exe (PID: 2452)
      • chrome.exe (PID: 2628)
      • chrome.exe (PID: 2144)
      • DllHost.exe (PID: 2908)
      • explorer.exe (PID: 2712)
      • AcroRd32.exe (PID: 2928)
      • AcroRd32.exe (PID: 1564)
      • RdrCEF.exe (PID: 2476)
      • RdrCEF.exe (PID: 2236)
      • RdrCEF.exe (PID: 3668)
      • RdrCEF.exe (PID: 2956)
      • RdrCEF.exe (PID: 4056)
      • RdrCEF.exe (PID: 1244)
      • RdrCEF.exe (PID: 560)
      • DllHost.exe (PID: 1088)
      • vssvc.exe (PID: 2168)

    • Reads the computer name

      • DllHost.exe (PID: 3164)
      • chrome.exe (PID: 3404)
      • chrome.exe (PID: 2144)
      • chrome.exe (PID: 2452)
      • chrome.exe (PID: 1800)
      • chrome.exe (PID: 2628)
      • explorer.exe (PID: 2712)
      • DllHost.exe (PID: 2908)
      • AcroRd32.exe (PID: 2928)
      • AcroRd32.exe (PID: 1564)
      • RdrCEF.exe (PID: 2476)
      • DllHost.exe (PID: 1088)
      • vssvc.exe (PID: 2168)

    • Application launched itself

      • chrome.exe (PID: 3404)
      • AcroRd32.exe (PID: 2928)
      • RdrCEF.exe (PID: 2476)

    • Changes settings of System certificates

      • chrome.exe (PID: 2144)
      • DrvInst.exe (PID: 2736)

    • Adds / modifies Windows certificates

      • chrome.exe (PID: 2144)
      • DrvInst.exe (PID: 2736)

    • Dropped object may contain Bitcoin addresses

      • instup.exe (PID: 1004)

    • Searches for installed software

      • AcroRd32.exe (PID: 2928)
      • AcroRd32.exe (PID: 1564)
      • DrvInst.exe (PID: 2736)

    • Reads CPU info

      • AcroRd32.exe (PID: 1564)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

SpecialBuild: -
ProductVersion: 6, 22, 1, 1
ProductName: IEMonitor Application
PrivateBuild: -
OriginalFileName: IEMonitor.EXE
LegalTrademarks: Internet Download Manager
LegalCopyright: Tonec Inc., Copyright © 1999 - 2015
InternalName: IEMonitor
FileVersion: 6, 22, 1, 1
FileDescription: Internet Download Manager agent for click monitoring in IE-based browsers
CompanyName: Tonec Inc.
Comments: Internet Download Manager agent for click monitoring in IE-based browsers
CharacterSet: Unicode
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 6.22.1.1
FileVersionNumber: 6.22.1.1
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0xd9aa
UninitializedDataSize: -
InitializedDataSize: 106496
CodeSize: 167936
LinkerVersion: 6
PEType: PE32
TimeStamp: 2015:02:04 08:20:36+01:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 04-Feb-2015 07:20:36
Detected languages:
  • English - United States
Comments: Internet Download Manager agent for click monitoring in IE-based browsers
CompanyName: Tonec Inc.
FileDescription: Internet Download Manager agent for click monitoring in IE-based browsers
FileVersion: 6, 22, 1, 1
InternalName: IEMonitor
LegalCopyright: Tonec Inc., Copyright © 1999 - 2015
LegalTrademarks: Internet Download Manager
OriginalFilename: IEMonitor.EXE
PrivateBuild: -
ProductName: IEMonitor Application
ProductVersion: 6, 22, 1, 1
SpecialBuild: -

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000110

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 4
Time date stamp: 04-Feb-2015 07:20:36
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00028602
0x00029000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
6.58023
.rdata
0x0002A000
0x000099CC
0x0000A000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.55484
.data
0x00034000
0x00008D88
0x00005000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
2.87323
.rsrc
0x0003D000
0x00018000
0x00018000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.51958

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.2986
1422
UNKNOWN
UNKNOWN
RT_MANIFEST
2
5.8336
4264
UNKNOWN
English - United States
RT_ICON
3
6.35549
1128
UNKNOWN
English - United States
RT_ICON
4
3.02695
308
UNKNOWN
English - United States
RT_CURSOR
5
2.74274
180
UNKNOWN
English - United States
RT_CURSOR
102
3.24466
322
UNKNOWN
English - United States
RT_DIALOG
128
2.45849
48
UNKNOWN
English - United States
RT_GROUP_ICON
3841
2.81705
130
UNKNOWN
English - United States
RT_STRING
3842
0.960953
42
UNKNOWN
English - United States
RT_STRING
3843
3.04939
330
UNKNOWN
English - United States
RT_STRING

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
OLEAUT32.dll
OLEPRO32.DLL
USER32.dll
WININET.dll
WINSPOOL.DRV
comdlg32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
100
Monitored processes
59
Malicious processes
20
Suspicious processes
8

Behavior graph

Click at the process to see the details
inject inject inject inject inject inject inject start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start sality.gen.55a00c72391b2e89c4500.exe dwm.exe taskeng.exe DllHost.exe ctfmon.exe explorer.exe ccleaner.exe no specs ccleaner.exe ccupdate588_free.exe ccleaner.exe ccupdate.exe ccleaner.exe explorer.exe no specs ccleaner.exe DllHost.exe microstub.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs ccupdate.exe chrome.exe no specs avg_antivirus_free_setup.exe instup.exe instup.exe sbr.exe no specs explorer.exe no specs Thumbnail Cache Class Factory for Out of Proc Server acrord32.exe acrord32.exe no specs rdrcef.exe rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs DllHost.exe adobearm.exe reader_sl.exe no specs setupinf.exe no specs setupinf.exe no specs setupinf.exe no specs setupinf.exe no specs avemupdate.exe no specs avemupdate.exe avemupdate.exe avemupdate.exe avbugreport.exe avbugreport.exe setupinf.exe no specs setupinf.exe drvinst.exe vssvc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
524"C:\Program Files\CCleaner\CCleaner.exe" /uacC:\Program Files\CCleaner\CCleaner.exe
taskeng.exe
User:
admin
Company:
Piriform Software Ltd
Integrity Level:
HIGH
Description:
CCleaner
Exit code:
0
Version:
5.74.0.8198
Modules
Images
c:\program files\ccleaner\ccleaner.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\nsi.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
560"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1184,2498437591797719170,11821866790411694731,131072 --disable-features=NetworkService,VizDisplayCompositor --disable-gpu-compositing --lang=en-US --disable-pack-loading --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/20.13.20064 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=13250173425563632438 --renderer-client-id=7 --mojo-platform-channel-handle=1564 --allow-no-sandbox-job /prefetch:1C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Exit code:
0
Version:
20.13.20064.405839
Modules
Images
c:\program files\adobe\acrobat reader dc\reader\acrocef\rdrcef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
592"C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Desktop Window Manager
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dwm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\uxtheme.dll
612"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,6325945157079601015,1490797933186893878,131072 --enable-features=PasswordImport --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1812 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
784taskeng.exe {3901DEF8-731D-4EFC-B458-65638CE999E3}C:\Windows\system32\taskeng.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Engine
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskeng.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
852C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}C:\Windows\system32\DllHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1004"C:\Windows\Temp\asw.3e0ca2cfe3dcc601\New_150b0c8f\instup.exe" /sfx /sfxstorage:C:\Windows\Temp\asw.3e0ca2cfe3dcc601 /edition:15 /prod:ais /guid:4b95a74f-ccb5-4b07-a34b-f92e9eb553bc /ga_clientid:ec97d184-ca58-430f-a199-7c3b72a856de /silent /ws /cookie:mmm_ccl_prm_006_126_a /edat_dir:C:\Windows\Temp\asw.1cdff3f7730a3bde /online_installerC:\Windows\Temp\asw.3e0ca2cfe3dcc601\New_150b0c8f\instup.exe
instup.exe
User:
admin
Company:
AVG Technologies CZ, s.r.o.
Integrity Level:
HIGH
Description:
AVG Antivirus Installer
Exit code:
0
Version:
21.11.6809.0
Modules
Images
c:\windows\temp\asw.3e0ca2cfe3dcc601\new_150b0c8f\instup.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\wininet.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\usp10.dll
1088C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}C:\Windows\system32\DllHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\lpk.dll
1120C:\Windows\System32\ctfmon.exe C:\Windows\System32\ctfmon.exe
taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CTF Loader
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ctfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msctfmonitor.dll
c:\windows\system32\msctf.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1144"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgVmm.catC:\Program Files\AVG\Antivirus\SetupInf.exe—instup.exe
User:
admin
Company:
AVG Technologies CZ, s.r.o.
Integrity Level:
HIGH
Description:
AVG Antivirus Installer
Exit code:
0
Version:
21.11.6809.0
Modules
Images
c:\program files\avg\antivirus\setupinf.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
Total events
111 933
Read events
102 678
Write events
9 170
Delete events
85

Modification events

(PID) Process:(2256) Sality.gen.55a00c72391b2e89c4500.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Operation:writeName:Hidden
Value:
2
(PID) Process:(2256) Sality.gen.55a00c72391b2e89c4500.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:GlobalUserOffline
Value:
0
(PID) Process:(2256) Sality.gen.55a00c72391b2e89c4500.exeKey:HKEY_CURRENT_USER\Software\Aaspp\-227342143
Operation:writeName:1768776801
Value:
144
(PID) Process:(2256) Sality.gen.55a00c72391b2e89c4500.exeKey:HKEY_CURRENT_USER\Software\Aaspp\-227342143
Operation:writeName:-757413694
Value:
0
(PID) Process:(2256) Sality.gen.55a00c72391b2e89c4500.exeKey:HKEY_CURRENT_USER\Software\Aaspp\-227342143
Operation:writeName:1011363107
Value:
0
(PID) Process:(2256) Sality.gen.55a00c72391b2e89c4500.exeKey:HKEY_CURRENT_USER\Software\Aaspp\-227342143
Operation:writeName:-1514827388
Value:
35
(PID) Process:(2256) Sality.gen.55a00c72391b2e89c4500.exeKey:HKEY_CURRENT_USER\Software\Aaspp\-227342143
Operation:writeName:253949413
Value:
476
(PID) Process:(2256) Sality.gen.55a00c72391b2e89c4500.exeKey:HKEY_CURRENT_USER\Software\Aaspp\-227342143
Operation:writeName:2022726214
Value:
0C00687474703A2F2F7777772E6C656479617A696C696D2E636F6D2F6C6F676F2E67696600687474703A2F2F6B73616E64726166617368696F6E2E636F6D2F6C6F676F2E67696600687474703A2F2F7777772E6C6166796572692E636F6D2F696D616765732F6C6F676F2E67696600687474703A2F2F6B756C7070617375722E636F6D2F6C6F676F2E67696600687474703A2F2F746F616C6C616465706170656C2E636F6D2E61722F696D616765732F6C6F676F2E67696600687474703A2F2F7777772E65636F6C652D7361696E742D73696D6F6E2E6E65742F696E6465785F746F702F6C6F676F2E67696600687474703A2F2F6C617A617265612E726F2F696D616765732F6C6F676F2E67696600687474703A2F2F6B6F6F6E6164616E6365322E636F6D2F696D616765732F6C6F676F2E67696600687474703A2F2F6B75706C752E62656C2E74722F696D616765732F6C6F676F2E67696600687474703A2F2F7777772E6C69646572616E636173706F6C6974696361732E636F6D2E62722F6C6F676F2E67696600687474703A2F2F7777772E6C6567616C62696C676973617961722E636F6D2F696D672F6C6F676F2E67696600687474703A2F2F6C696665636F6D32342E636F2E63632F696D616765732F6C6F676F2E676966
(PID) Process:(2256) Sality.gen.55a00c72391b2e89c4500.exeKey:HKEY_CURRENT_USER\Software\Aaspp\-227342143
Operation:writeName:-503464281
Value:
83AD022F944CCF21DDECD41871254667172BA39F3E949513F4CC29B07060AC534912E5BCB155880C2C4326E6FB83E6FA099D4219F6885291D527824C5507229614A07CE2AF035D97263FF7F26AD2ACC9D5D4395D4B8B3109DC5C0C87B31A1505E6E94E08EF20E71B91B96D3856F531DADFD78A894AD6A6C177136C5657B01661
(PID) Process:(2256) Sality.gen.55a00c72391b2e89c4500.exeKey:HKEY_CURRENT_USER\Software\Aaspp
Operation:writeName:a1_0
Value:
Executable files
548
Suspicious files
376
Text files
302
Unknown types
68

Dropped files

PID
Process
Filename
Type
524CCleaner.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\YTIVEB7MYNPR1I704S07.tempbinary
MD5:—
SHA256:—
524CCleaner.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\auto[1].txttext
MD5:—
SHA256:—
524CCleaner.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\APPKUL65.txtini
MD5:—
SHA256:—
524CCleaner.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_ACB084F1532E23E916946A083A45F6BFbinary
MD5:—
SHA256:—
524CCleaner.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5ABbinary
MD5:—
SHA256:—
524CCleaner.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_B514E3306E9B5CC22C1D3DB90570477Abinary
MD5:—
SHA256:—
524CCleaner.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_ACB084F1532E23E916946A083A45F6BFder
MD5:—
SHA256:—
524CCleaner.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ed7a5cc3cca8d52a.customDestinations-msbinary
MD5:—
SHA256:—
524CCleaner.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_B514E3306E9B5CC22C1D3DB90570477Ader
MD5:—
SHA256:—
524CCleaner.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
95
TCP/UDP connections
198
DNS requests
185
Threats
14

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3148
CCUpdate.exe
HEAD
200
2.16.107.89:80
http://emupdate.avcdn.net/files/emupdate/pong.txt
unknown
—
—
whitelisted
524
CCleaner.exe
GET
200
104.18.21.226:80
http://ocsp2.globalsign.com/rootr3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT1nGh%2FJBjWKnkPdZIzB1bqhelHBwQUj%2FBLf6guRSSuTVD6Y5qL3uLdG7wCEHophRq39F1meVBmQbb%2F1x0%3D
US
der
1.40 Kb
whitelisted
524
CCleaner.exe
GET
200
151.101.2.202:80
http://www.ccleaner.com/auto?a=0&p=cc&v=5.74.8198&l=1033&lk=&mk=IJR6-W5SV-5KYR-QBZD-6BY4-RN5Z-WAV9-RVK2-HZ8S&o=6.1W3&au=0&mx=97B7721C4994E2556FF6A439510F665DB45337A341A47E15F4997584423BF714&gd=19ce970b-f6c0-4a09-bae4-274b971730e0
US
text
61 b
whitelisted
524
CCleaner.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
US
der
471 b
whitelisted
524
CCleaner.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D
US
der
471 b
whitelisted
524
CCleaner.exe
GET
200
151.101.2.109:80
http://license.piriform.com/verify/?p=ccpro&c=cc&cv=5.74.8198&l=1033&lk=CJ9T-J7CU-SPNV-GWMB-WBEC&mk=IJR6-W5SV-5KYR-QBZD-6BY4-RN5Z-WAV9-RVK2-HZ8S&mx=97B7721C4994E2556FF6A439510F665DB45337A341A47E15F4997584423BF714&gd=19ce970b-f6c0-4a09-bae4-274b971730e0
US
text
14 b
whitelisted
524
CCleaner.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAonX%2BcE1u7LI9XNW0saTgQ%3D
US
der
471 b
whitelisted
524
CCleaner.exe
GET
200
104.18.20.226:80
http://crl.globalsign.com/ca/gsatlasr3dvtlsca2020.crl
US
binary
225 Kb
whitelisted
524
CCleaner.exe
GET
200
104.18.21.226:80
http://ocsp2.globalsign.com/rootr3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT1nGh%2FJBjWKnkPdZIzB1bqhelHBwQUj%2FBLf6guRSSuTVD6Y5qL3uLdG7wCEHgDGCDPAjbzpoUYuu%2B39wE%3D
US
der
1.40 Kb
whitelisted
524
CCleaner.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/ca/gsatlasr3dvtlsca2020/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQT6XbZiiF%2BR%2FUEno7LSD4H4YmN6gQUQm1XLU8fJnd0pidk9oD6j0ho%2FnwCEAFGrms5JJ34O54lbm4pcLY%3D
US
der
1.42 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
524
CCleaner.exe
2.16.107.121:80
ncc.avast.com
Akamai International B.V.
—
suspicious
524
CCleaner.exe
151.101.2.202:80
www.ccleaner.com
Fastly
US
suspicious
524
CCleaner.exe
5.62.40.203:443
analytics.ff.avast.com
AVAST Software s.r.o.
DE
unknown
524
CCleaner.exe
151.101.2.202:443
www.ccleaner.com
Fastly
US
suspicious
524
CCleaner.exe
67.26.73.254:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious
524
CCleaner.exe
151.101.2.109:443
license.piriform.com
Fastly
US
suspicious
524
CCleaner.exe
67.27.158.126:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
malicious
524
CCleaner.exe
104.18.20.226:80
ocsp2.globalsign.com
Cloudflare Inc
US
shared
524
CCleaner.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
524
CCleaner.exe
5.62.40.172:443
shepherd.ff.avast.com
AVAST Software s.r.o.
DE
suspicious

DNS requests

Domain
IP
Reputation
ncc.avast.com
  • 2.16.107.121
  • 2.16.107.99
whitelisted
analytics.ff.avast.com
  • 5.62.40.203
  • 5.62.40.211
  • 5.62.40.212
whitelisted
www.ccleaner.com
  • 151.101.2.202
  • 151.101.66.202
  • 151.101.130.202
  • 151.101.194.202
whitelisted
ipm-provider.ff.avast.com
  • 5.62.45.77
  • 69.94.76.75
  • 69.94.76.70
  • 5.62.38.45
  • 5.62.46.73
  • 5.62.38.203
  • 5.62.44.204
  • 5.62.44.219
  • 5.62.46.138
  • 69.94.76.96
  • 5.62.53.249
  • 5.62.45.67
whitelisted
shepherd.ff.avast.com
  • 5.62.40.172
  • 69.94.69.113
whitelisted
ctldl.windowsupdate.com
  • 67.27.158.126
  • 8.253.207.121
  • 67.27.157.126
  • 67.27.159.126
  • 67.26.73.254
  • 2.16.186.56
  • 2.16.186.81
whitelisted
ocsp2.globalsign.com
  • 104.18.21.226
  • 104.18.20.226
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
license.piriform.com
  • 151.101.2.109
  • 151.101.66.109
  • 151.101.130.109
  • 151.101.194.109
whitelisted
ocsp.globalsign.com
  • 104.18.21.226
  • 104.18.20.226
whitelisted

Threats

PID
Process
Class
Message
524
CCleaner.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
3544
CCleaner.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
3816
ccleaner.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
1992
ccleaner.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
3148
CCUpdate.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3412
Microstub.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
924
svchost.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
2024
AvEmUpdate.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
—
—
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
—
—
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
4 ETPRO signatures available at the full report
Process
Message
CCleaner.exe
Failed to open log file 'C:\Program Files\CCleaner'
CCleaner.exe
startCheckingLicense()
CCleaner.exe
Using Sciter version 4.4.4.4-r8057
CCleaner.exe
OnLanguage - en
CCleaner.exe
OnLanguage - en
CCleaner.exe
observing CurrentIndex changed - 0
CCleaner.exe
observing CurrentIndex changed - Context.FirstTime=true CurrentIndex=0 LastIndex=4
CCleaner.exe
observing currentResultDetails changed - None
CCleaner.exe
SetStrings - Live Region updated: ,
CCleaner.exe
observing currentModeType changed - Preview
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
C:\Users\admin\AppData\Local\Temp\Rar$DRb3472.16976\Sality.gen.55a00c72391b2e89c4500.exe