URL:

http://120.192.64.13/cdn/pcfile/20181106/17/24/IQIYIUpSetup_4_11.exe

Full analysis: https://app.any.run/tasks/9566e1da-df15-4840-ad43-c5b677446828
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: June 19, 2019, 09:34:59
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

62356762FE56B04481F17F76737CF003

SHA1:

777F8ECB41724519E69F1ED8A754BB99E2CFCA42

SHA256:

039263BCDFFFF2E10EC9DFA09AAE5FB6DF0EA79E8642CB30F4C1E5F732878DBD

SSDEEP:

3:N1KvhXyWLKV8K5M3kAQMn:CdimzJ3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Downloads executable files from the Internet

      • chrome.exe (PID: 2140)

    • Application was dropped or rewritten from another process

      • IQIYIUpSetup_4_11.exe (PID: 1244)
      • IQIYIUpSetup_4_11.exe (PID: 2124)
      • QiyiUpdate.exe (PID: 3856)
      • QYUploader.exe (PID: 284)
      • QYUploader.exe (PID: 1204)

    • Downloads executable files from IP

      • chrome.exe (PID: 2140)

    • Adds new firewall rule via NETSH.EXE

      • IQIYIUpSetup_4_11.exe (PID: 2124)

    • Changes settings of System certificates

      • dxdiag.exe (PID: 2820)

    • Loads dropped or rewritten executable

      • QiyiUpdate.exe (PID: 3856)
      • QYUploader.exe (PID: 284)
      • QYUploader.exe (PID: 1204)

    • Loads the Task Scheduler COM API

      • IQIYIUpSetup_4_11.exe (PID: 2124)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 2140)
      • IQIYIUpSetup_4_11.exe (PID: 2124)

    • Creates a software uninstall entry

      • IQIYIUpSetup_4_11.exe (PID: 2124)

    • Executed via Task Scheduler

      • QYUploader.exe (PID: 284)

    • Changes IE settings (feature browser emulation)

      • IQIYIUpSetup_4_11.exe (PID: 2124)

    • Creates files in the user directory

      • IQIYIUpSetup_4_11.exe (PID: 2124)
      • QYUploader.exe (PID: 284)
      • QYUploader.exe (PID: 1204)

    • Creates files in the program directory

      • QYUploader.exe (PID: 284)
      • IQIYIUpSetup_4_11.exe (PID: 2124)

    • Creates COM task schedule object

      • dxdiag.exe (PID: 2820)

    • Creates files in the Windows directory

      • dxdiag.exe (PID: 2820)

    • Adds / modifies Windows certificates

      • dxdiag.exe (PID: 2820)

    • Uses NETSH.EXE for network configuration

      • IQIYIUpSetup_4_11.exe (PID: 2124)

    • Reads Internet Cache Settings

      • QYUploader.exe (PID: 1204)

  • INFO

    • Application launched itself

      • chrome.exe (PID: 2140)

    • Reads Internet Cache Settings

      • chrome.exe (PID: 2140)

    • Application was crashed

      • QiyiUpdate.exe (PID: 3856)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
55
Monitored processes
16
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start drop and start start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs iqiyiupsetup_4_11.exe no specs iqiyiupsetup_4_11.exe netsh.exe no specs qyuploader.exe dxdiag.exe qiyiupdate.exe qyuploader.exe chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
284"C:\Program Files\IQIYI Video\Uploader\bin\QYUploader.exe" C:\Program Files\IQIYI Video\Uploader\bin\QYUploader.exe
taskeng.exe
User:
admin
Company:
爱奇艺
Integrity Level:
MEDIUM
Description:
爱奇艺视频助手
Exit code:
0
Version:
7.6.0.12
Modules
Images
c:\program files\iqiyi video\uploader\bin\qyuploader.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\iqiyi video\uploader\bin\vhutils.dll
c:\program files\iqiyi video\uploader\bin\asynchttp.dll
c:\program files\iqiyi video\uploader\bin\gbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\psapi.dll
356"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=940,10475201787745855185,11569598025373852412,131072 --enable-features=PasswordImport --lang=en-US --no-sandbox --service-request-channel-token=13480301060567294948 --mojo-platform-channel-handle=1844 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
73.0.3683.75
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\73.0.3683.75\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
392"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=940,10475201787745855185,11569598025373852412,131072 --enable-features=PasswordImport --service-pipe-token=18005679549821982615 --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=18005679549821982615 --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2336 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
73.0.3683.75
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\73.0.3683.75\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1132"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=940,10475201787745855185,11569598025373852412,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAACAAwAAAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=15920027177994419801 --mojo-platform-channel-handle=972 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
73.0.3683.75
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\73.0.3683.75\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1204"C:\Program Files\IQIYI Video\Uploader\bin\QYUploader.exe" updateC:\Program Files\IQIYI Video\Uploader\bin\QYUploader.exe
QiyiUpdate.exe
User:
admin
Company:
爱奇艺
Integrity Level:
MEDIUM
Description:
爱奇艺视频助手
Exit code:
0
Version:
7.6.0.12
Modules
Images
c:\program files\iqiyi video\uploader\bin\qyuploader.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\iqiyi video\uploader\bin\vhutils.dll
c:\program files\iqiyi video\uploader\bin\asynchttp.dll
c:\program files\iqiyi video\uploader\bin\gbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\psapi.dll
1244"C:\Users\admin\Downloads\IQIYIUpSetup_4_11.exe" C:\Users\admin\Downloads\IQIYIUpSetup_4_11.exe—chrome.exe
User:
admin
Company:
爱奇艺
Integrity Level:
MEDIUM
Description:
爱奇艺视频助手
Exit code:
3221226540
Version:
7.6.0.12
Modules
Images
c:\users\admin\downloads\iqiyiupsetup_4_11.exe
c:\systemroot\system32\ntdll.dll
2052"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=940,10475201787745855185,11569598025373852412,131072 --enable-features=PasswordImport --service-pipe-token=9769889835570430814 --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=9769889835570430814 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1900 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
73.0.3683.75
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\73.0.3683.75\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2124"C:\Users\admin\Downloads\IQIYIUpSetup_4_11.exe" C:\Users\admin\Downloads\IQIYIUpSetup_4_11.exe
chrome.exe
User:
admin
Company:
爱奇艺
Integrity Level:
HIGH
Description:
爱奇艺视频助手
Exit code:
0
Version:
7.6.0.12
Modules
Images
c:\users\admin\downloads\iqiyiupsetup_4_11.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\opengl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
2140"C:\Program Files\Google\Chrome\Application\chrome.exe" http://120.192.64.13/cdn/pcfile/20181106/17/24/IQIYIUpSetup_4_11.exeC:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
73.0.3683.75
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\73.0.3683.75\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2188"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=940,10475201787745855185,11569598025373852412,131072 --enable-features=PasswordImport --service-pipe-token=15224294843315945074 --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=15224294843315945074 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2024 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
73.0.3683.75
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\73.0.3683.75\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
Total events
1 921
Read events
1 536
Write events
366
Delete events
19

Modification events

(PID) Process:(2140) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(2140) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(2140) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(2140) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(2140) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(2140) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(2140) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(2140) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:3488-13197474229333984
Value:
0
(PID) Process:(2140) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(2140) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:2140-13205410520447375
Value:
259
Executable files
102
Suspicious files
94
Text files
496
Unknown types
4

Dropped files

PID
Process
Filename
Type
2140chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\index —
MD5:—
SHA256:—
2140chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_0 —
MD5:—
SHA256:—
2140chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_1 —
MD5:—
SHA256:—
2140chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_2 —
MD5:—
SHA256:—
2140chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_3 —
MD5:—
SHA256:—
2140chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\be0bf042-d975-4941-bb34-ccf25ace48be.tmp —
MD5:—
SHA256:—
2140chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\index —
MD5:—
SHA256:—
2140chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000018.dbtmp —
MD5:—
SHA256:—
2140chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_0 —
MD5:—
SHA256:—
2140chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1 —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
18
DNS requests
13
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1204
QYUploader.exe
GET
200
36.110.220.15:80
http://msg.qy.net/v5/pcclient/cid_recal?&p1=201_11_114&os=6.1&rn=1560936958&mv=&reason=4&cid=kjkaasqev4hcunfcsmvbdwkglhnzyk4m&cid_old=&mac=5254004a04af&lhdd=C4BA-3647&hdd=
CN
—
—
suspicious
1204
QYUploader.exe
GET
200
36.110.220.15:80
http://msg.qy.net/v5/pcclient/cid_recal?&p1=201_11_114&os=6.1&rn=1560936957&mv=&reason=4&cid=kjkaasqev4hcunfcsmvbdwkglhnzyk4m&cid_old=&mac=5254004a04af&lhdd=C4BA-3647&hdd=
CN
—
—
suspicious
1204
QYUploader.exe
GET
200
36.110.220.15:80
http://msg.qy.net/b?aduid=14f4c950464c4da58518356731b67012&c1=0&channelid=411&ctm=1214562&e=1214562&macid=kjkaasqev4hcunfcsmvbdwkglhnzyk4m&nu=&p=11&p1=116&pf=1&pu=&r=1&result=ok&rn=00000001560936960&s1=1&se=1211875&starttype=0&t=3&td=437&u=471b19fe0d764980803c162a70fd6219&v=7.6.0.12
CN
—
—
suspicious
2124
IQIYIUpSetup_4_11.exe
GET
200
36.110.220.15:80
http://msg.qy.net/b?t=6&pf=1&p=11&p1=116&c1=0&result=ok&s1=1&channelid=411&u=471b19fe0d764980803c162a70fd6219&v=7.6.0.12&rn=00000001560936971&e=471b19fe0d764980803c162a70fd6219&r=0&installtype=1&se=&pProcess=chrome.exe&attach=&value=
CN
—
—
suspicious
1204
QYUploader.exe
GET
—
104.108.67.239:80
http://static.iqiyi.com/ext/common/qisu2/Browser.xml
NL
—
—
suspicious
2140
chrome.exe
GET
200
120.192.64.13:80
http://120.192.64.13/cdn/pcfile/20181106/17/24/IQIYIUpSetup_4_11.exe
CN
executable
22.8 Mb
suspicious
3856
QiyiUpdate.exe
GET
200
36.110.209.200:80
http://dl.static.iqiyi.com/product/QYUploader/update.ini
CN
text
244 b
suspicious
1204
QYUploader.exe
GET
200
36.110.209.200:80
http://dl.static.iqiyi.com/product/QYUploader/upload_config.json
CN
text
61 b
suspicious
2820
dxdiag.exe
GET
200
205.185.216.42:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
56.2 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2140
chrome.exe
216.58.205.227:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
2140
chrome.exe
120.192.64.13:80
—
Shandong Mobile Communication Company Limited
CN
suspicious
2140
chrome.exe
172.217.22.77:443
accounts.google.com
Google Inc.
US
whitelisted
2140
chrome.exe
172.217.16.164:443
www.google.com
Google Inc.
US
whitelisted
2140
chrome.exe
172.217.22.35:443
ssl.gstatic.com
Google Inc.
US
whitelisted
2140
chrome.exe
172.217.18.110:443
sb-ssl.google.com
Google Inc.
US
whitelisted
1204
QYUploader.exe
36.110.220.15:80
msg.qy.net
IDC, China Telecommunications Corporation
CN
malicious
3856
QiyiUpdate.exe
36.110.209.200:80
dl.static.iqiyi.com
IDC, China Telecommunications Corporation
CN
suspicious
1204
QYUploader.exe
36.110.209.200:80
dl.static.iqiyi.com
IDC, China Telecommunications Corporation
CN
suspicious
1204
QYUploader.exe
123.125.111.69:443
openapi.iqiyi.com
China Unicom Beijing Province Network
CN
unknown

DNS requests

Domain
IP
Reputation
clientservices.googleapis.com
  • 216.58.205.227
whitelisted
accounts.google.com
  • 172.217.22.77
shared
www.google.com
  • 172.217.16.164
malicious
ssl.gstatic.com
  • 172.217.22.35
whitelisted
sb-ssl.google.com
  • 172.217.18.110
whitelisted
msg.qy.net
  • 36.110.220.15
  • 106.38.219.49
suspicious
dl.static.iqiyi.com
  • 36.110.209.200
  • 36.110.209.201
unknown
iplocation.geo.qiyi.com
  • —
suspicious
openapi.iqiyi.com
  • 123.125.111.69
unknown
cook.iqiyi.com
  • 118.26.32.10
unknown

Threats

PID
Process
Class
Message
2140
chrome.exe
A Network Trojan was detected
ET INFO Executable Download from dotted-quad Host
2140
chrome.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2140
chrome.exe
Potentially Bad Traffic
ET INFO SUSPICIOUS Dotted Quad Host MZ Response
1204
QYUploader.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User-Agent (HttpDownload)
1204
QYUploader.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User-Agent (HttpDownload)
Process
Message
IQIYIUpSetup_4_11.exe
[0619/103547:INFO:Installer.cpp(110)] =begin extract config files...
IQIYIUpSetup_4_11.exe
[0619/103547:INFO:utils.cpp(38)] extracting resource[CONFIG:801] to string
IQIYIUpSetup_4_11.exe
[0619/103547:INFO:utils.cpp(60)] extracting resource[ZIPRES:802] to file: C:\Users\admin\AppData\Roaming\IQIYI Video\QYInstaller\skin.zip
IQIYIUpSetup_4_11.exe
[0619/103547:INFO:Command.cpp(606)] ReadReg(Software\Microsoft\Windows\CurrentVersion\App Paths\QYUploader.exe, Path), returns:
IQIYIUpSetup_4_11.exe
[0619/103547:INFO:Extension.cpp(61)] GetVar(rootDesktopCurUser) returns: C:\Users\admin\Desktop
IQIYIUpSetup_4_11.exe
[0619/103547:INFO:Extension.cpp(61)] GetVar(rootDesktopCommon) returns: C:\Users\Public\Desktop
IQIYIUpSetup_4_11.exe
[0619/103547:INFO:Extension.cpp(61)] GetVar(rootProgramsCurUser) returns: C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
IQIYIUpSetup_4_11.exe
[0619/103547:INFO:Extension.cpp(61)] GetVar(rootProgramsCommon) returns: C:\ProgramData\Microsoft\Windows\Start Menu\Programs
IQIYIUpSetup_4_11.exe
[0619/103547:INFO:Extension.cpp(61)] GetVar(rootAppData) returns: C:\Users\admin\AppData\Roaming
IQIYIUpSetup_4_11.exe
[0619/103547:INFO:Extension.cpp(61)] GetVar(appName) returns: QYUploader
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://120.192.64.13/cdn/pcfile/20181106/17/24/IQIYIUpSetup_4_11.exe