home

TotalSystemCare.exe

TotalSystemCare

SafeBytes Software Inc.

The application TotalSystemCare.exe by SafeBytes Software has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. It runs as a scheduled task under the Windows Task Scheduler triggered to execute each time a user logs in. While running, it connects to the Internet address server-52-85-167-55.gig50.r.cloudfront.net on port 80 using the HTTP protocol.
Publisher:
SafeBytes Software Inc.  (signed and verified)

Product:
TotalSystemCare

Version:
1.7.0.1

MD5:
db8651eb7faab755236b3aea08103ded

SHA-1:
06d3dbfb8cadbe92396ba4e72b879a4e6ace3d8d

SHA-256:
eecd71b3e3ee1486d2b70d397ccc7ae1904764eb5595a33343c4690376b41388

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
5/27/2024 9:25:15 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
Win32.Generic
16.12.8.19

File size:
2.2 MB (2,335,472 bytes)

Product version:
1.7.0.1

Copyright:
Copyright © 2015 SafeBytes Software Inc. All rights reserved.

Original file name:
TotalSystemCare.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\Program Files\totalsystemcare\totalsystemcare.exe

Digital Signature
Signed by:
SafeBytes Software Inc.

Authority:
Symantec Corporation

Valid from:
10/22/2015 8:00:00 AM

Valid to:
9/11/2017 7:59:59 AM

Subject:
CN=SafeBytes Software Inc., O=SafeBytes Software Inc., L=Mascouche, S=Quebec, C=CA, SERIALNUMBER=8678359, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=CA

Issuer:
CN=Symantec Class 3 Extended Validation Code Signing CA - G2, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
246A1D5D12699D0EB7FE724D899B4CFC

File PE Metadata
Compilation timestamp:
12/8/2016 11:46:21 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

.NET CLR dependent:
Yes

Entry address:
0x23736A

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 02, 00, 00, 00, 8B, 00, 00, 00, AC, 73, 23, 00, AC, 55, 23, 00, 52, 53, 44, 53, 4C, CC, DB, F3, D4, A1, DC, 4C, 98, E1, 73, D1, 21, 53, 4D, 91, 01, 00, 00, 00, 5A, 3A, 5C, 42, 32, 5C, 52, 5C, 74, 65, 6D, 70, 54, 53, 43, 42, 75, 69, 6C, 64, 2D, 32, 30, 31, 36, 31, 32, 30, 38, 30, 37, 34, 34, 30, 33, 5C, 53, 6F...
 
[+]

Entropy:
6.0319

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
2.2 MB (2,315,776 bytes)

Scheduled Task
Task name:
TotalSystemCare.Autostart

Trigger:
Logon (Runs on logon)

Description:
Starts when user logs on.


The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to ec2-54-213-234-16.us-west-2.compute.amazonaws.com  (54.213.234.16:80)

TCP (HTTP SSL):
Connects to ec2-54-83-46-0.compute-1.amazonaws.com  (54.83.46.0:443)

TCP (HTTP):
Connects to ec2-54-84-107-9.compute-1.amazonaws.com  (54.84.107.9:80)

TCP (HTTP):
Connects to portal.actcorp.in  (202.53.8.30:80)

TCP (HTTP):
Connects to server-54-192-3-60.lhr5.r.cloudfront.net  (54.192.3.60:80)

TCP (HTTP):
Connects to server-54-230-95-186.fra2.r.cloudfront.net  (54.230.95.186:80)

TCP (HTTP):
Connects to server-54-192-3-68.lhr5.r.cloudfront.net  (54.192.3.68:80)

TCP (HTTP):
Connects to server-54-192-3-58.lhr5.r.cloudfront.net  (54.192.3.58:80)

TCP (HTTP):
Connects to server-54-192-3-36.lhr5.r.cloudfront.net  (54.192.3.36:80)

TCP (HTTP):
Connects to server-54-192-3-158.lhr5.r.cloudfront.net  (54.192.3.158:80)

TCP (HTTP):
Connects to server-54-192-3-131.lhr5.r.cloudfront.net  (54.192.3.131:80)

TCP (HTTP):
Connects to server-54-192-3-122.lhr5.r.cloudfront.net  (54.192.3.122:80)

TCP (HTTP):
Connects to server-54-192-3-111.lhr5.r.cloudfront.net  (54.192.3.111:80)

TCP (HTTP):
Connects to server-54-192-159-232.sin3.r.cloudfront.net  (54.192.159.232:80)

TCP (HTTP):
Connects to server-54-192-130-239.ams50.r.cloudfront.net  (54.192.130.239:80)

TCP (HTTP):
Connects to server-52-85-63-5.lhr50.r.cloudfront.net  (52.85.63.5:80)

TCP (HTTP):
Connects to server-52-85-63-153.lhr50.r.cloudfront.net  (52.85.63.153:80)

TCP (HTTP):
Connects to server-52-85-63-114.lhr50.r.cloudfront.net  (52.85.63.114:80)

TCP (HTTP):
Connects to a23-55-155-27.deploy.static.akamaitechnologies.com  (23.55.155.27:80)

TCP (HTTP):
Connects to a23-55-149-163.deploy.static.akamaitechnologies.com  (23.55.149.163:80)

Remove TotalSystemCare.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.