home

clinfo.exe

LLC

The application clinfo.exe by LLC has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat.
Publisher:
LLC   (signed and verified)

MD5:
195e67e5ba96d57c41e19738d7dec3b8

SHA-1:
6c17137b6af4e39b7021dabee418d7a9f2085da1

SHA-256:
e133e29ae5589a11d22abdf5e2d819c805e69285517b0ca004fb7b046c0bfb5b

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
2/25/2025 11:45:15 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Amonitize (M)
16.3.7.9

File size:
54.8 KB (56,080 bytes)

File type:
Executable application (Win64 EXE)

Common path:
C:\users\{user}\appdata\roaming\cpuminer\ethminer\clinfo.exe

Digital Signature
Signed by:
LLC

Authority:
COMODO CA Limited

Valid from:
5/6/2015 7:00:00 PM

Valid to:
5/6/2016 6:59:59 PM

Subject:
CN="LLC ""YOPTA SOFT""", O="LLC ""YOPTA SOFT""", STREET="str.Tsytadelna, 7", L=Kiev, S=Kiev, PostalCode=01015, C=UA

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
1CAFDF1C4C426FC3DD811D48793D99C9

File PE Metadata
OS version:
4.0

OS bitness:
Win64

Subsystem:
Windows Console

Linker version:
2.24

CTPH (ssdeep):
1536:TZpDQaxcBobxEEay/fRUC3PB3mYF2i70o:TZp5+QxEEay/fRUC/RmYl

Entry address:
0x14D0

Entry point:
48, 83, EC, 28, C7, 05, 82, DB, 00, 00, 00, 00, 00, 00, E8, 7D, 18, 00, 00, E8, 98, FC, FF, FF, 90, 90, 48, 83, C4, 28, C3, 90, 48, 8B, 44, 24, 28, 48, FF, E0, 41, 55, 41, 54, 55, 57, 56, 53, 48, 83, EC, 48, 48, 8D, 35, 35, 7B, 00, 00, 31, DB, 48, 8B, AC, 24, A0, 00, 00, 00, 4D, 8B, 28, 48, 8D, 7C, 24, 20, 49, 89, CC, B9, 08, 00, 00, 00, F3, A5, 48, 8D, 74, 24, 20, 48, 8D, 7E, 08, 4C, 85, 2C, 1E, 74, 0B, 4C, 8B, 04, 1F, 4C, 89, E1, FF, D5, 31, D2, 48, 83, C3, 10, 48, 83, FB, 20, 75, E5, 48, 85, D2, 74, 1C...
 
[+]

Entropy:
6.3460

Code size:
29 KB (29,696 bytes)

Remove clinfo.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.