URL:

http://25689.xc.mieseng.com/xiaz/WindowsServer2008R2@674_4909.exe

Full analysis: https://app.any.run/tasks/d811fa61-1f7c-45e4-be3e-e62a2bd20497
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: December 06, 2018, 01:50:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
adware
trojan
Indicators:
MD5:

F46930852E3CC70EE8F88F6E3820B74F

SHA1:

D5F419D3B6B4E7C2A364BF915205823B2552C31E

SHA256:

17A0FE0E839374123875F3B2D185D14FBD855C998E021A834518FACBC51A71AC

SSDEEP:

3:N1K1dd3dtM2pMAS2E/dnP4An:CXd3IAMASHVP4An

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • WindowsServer2008R2@674_4909[1].exe (PID: 3400)
      • WindowsServer2008R2@674_4909[1].exe (PID: 2496)
      • ldsgamemaster.exe (PID: 3544)
      • LDSGameMasterInstRoad_211601.exe (PID: 3072)
      • Inst3__3112425__3f7372633d6c6d266c733d6e31343463316364383939__68616f2e3336302e636e__0c70.exe (PID: 2336)
      • FunInstaller_PS_0107704.exe (PID: 2636)
      • SoftMgrInst.exe (PID: 2888)
      • mkshortcut.exe (PID: 2844)
      • QyUpdate.exe (PID: 3064)
      • QiyiService.exe (PID: 252)
      • QiyiService.exe (PID: 3976)
      • QiyiDACL.exe (PID: 3920)
      • QiyiDACL.exe (PID: 1832)
      • QyClient.exe (PID: 3892)
      • QyFragment.exe (PID: 2868)
      • QyFragment.exe (PID: 3916)
      • QyFragment.exe (PID: 1996)
      • QyFragment.exe (PID: 2372)
      • QyPlayer.exe (PID: 3604)
      • QyFragment.exe (PID: 2572)
      • zoolsnBhBnHqD12.exe (PID: 2260)
      • QyFragment.exe (PID: 2224)
      • QyKernel.exe (PID: 2424)
      • 360se.exe (PID: 556)
      • AlphaseMiniStart.exe (PID: 1740)
      • AlphaUpdateCheck.exe (PID: 1356)
      • AlphaseX.exe (PID: 2096)

    • Downloads executable files from the Internet

      • iexplore.exe (PID: 3024)
      • WindowsServer2008R2@674_4909[1].exe (PID: 3400)
      • cAgXkQhHpPfGoTmU.exe (PID: 3284)

    • Connects to CnC server

      • WindowsServer2008R2@674_4909[1].exe (PID: 3400)
      • FunInstaller_PS_0107704.exe (PID: 2636)

    • Loads dropped or rewritten executable

      • LDSGameMasterInstRoad_211601.exe (PID: 3072)
      • ldsgamemaster.exe (PID: 3544)
      • SoftMgrInst.exe (PID: 2888)
      • regsvr32.exe (PID: 3180)
      • FunInstaller_PS_0107704.exe (PID: 2636)
      • rundll32.exe (PID: 3884)
      • IQIYIsetup_baizhu@kb014.exe (PID: 3052)
      • cAgXkQhHpPfGoTmU.exe (PID: 3284)
      • QiyiDACL.exe (PID: 3920)
      • QiyiDACL.exe (PID: 1832)
      • QiyiService.exe (PID: 3976)
      • QiyiService.exe (PID: 252)
      • Inst3__3112425__3f7372633d6c6d266c733d6e31343463316364383939__68616f2e3336302e636e__0c70.exe (PID: 2336)
      • QyFragment.exe (PID: 2868)
      • QyKernel.exe (PID: 2424)
      • QyPlayer.exe (PID: 3604)
      • QyClient.exe (PID: 3892)
      • QyFragment.exe (PID: 3916)
      • QyFragment.exe (PID: 2372)
      • QyFragment.exe (PID: 1996)
      • QyFragment.exe (PID: 2572)
      • QyFragment.exe (PID: 2224)
      • explorer.exe (PID: 2028)
      • DllHost.exe (PID: 1664)
      • ASE@8717.exe (PID: 2064)
      • QyUpdate.exe (PID: 3064)
      • 360se.exe (PID: 556)
      • DllHost.exe (PID: 3020)
      • AlphaseMiniStart.exe (PID: 1740)
      • AlphaseX.exe (PID: 2096)
      • AlphaUpdateCheck.exe (PID: 1356)
      • rundll32.exe (PID: 2524)
      • DllHost.exe (PID: 2956)

    • Registers / Runs the DLL via REGSVR32.EXE

      • FunInstaller_PS_0107704.exe (PID: 2636)

    • Changes settings of System certificates

      • Inst3__3112425__3f7372633d6c6d266c733d6e31343463316364383939__68616f2e3336302e636e__0c70.exe (PID: 2336)

    • Adds new firewall rule via NETSH.EXE

      • IQIYIsetup_baizhu@kb014.exe (PID: 3052)

    • Changes the autorun value in the registry

      • IQIYIsetup_baizhu@kb014.exe (PID: 3052)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 2920)
      • iexplore.exe (PID: 3024)
      • WindowsServer2008R2@674_4909[1].exe (PID: 3400)
      • LDSGameMasterInstRoad_211601.exe (PID: 3072)
      • ldsgamemaster.exe (PID: 3544)
      • Inst3__3112425__3f7372633d6c6d266c733d6e31343463316364383939__68616f2e3336302e636e__0c70.exe (PID: 2336)
      • FunInstaller_PS_0107704.exe (PID: 2636)
      • cAgXkQhHpPfGoTmU.exe (PID: 3284)
      • IQIYIsetup_baizhu@kb014.exe (PID: 3052)
      • ASE@8717.exe (PID: 2064)
      • QyClient.exe (PID: 3892)

    • Reads internet explorer settings

      • WindowsServer2008R2@674_4909[1].exe (PID: 3400)

    • Low-level read access rights to disk partition

      • WindowsServer2008R2@674_4909[1].exe (PID: 3400)
      • LDSGameMasterInstRoad_211601.exe (PID: 3072)
      • ldsgamemaster.exe (PID: 3544)
      • Inst3__3112425__3f7372633d6c6d266c733d6e31343463316364383939__68616f2e3336302e636e__0c70.exe (PID: 2336)
      • cAgXkQhHpPfGoTmU.exe (PID: 3284)

    • Reads Internet Cache Settings

      • LDSGameMasterInstRoad_211601.exe (PID: 3072)
      • WindowsServer2008R2@674_4909[1].exe (PID: 3400)
      • QyFragment.exe (PID: 3916)

    • Creates files in the user directory

      • WindowsServer2008R2@674_4909[1].exe (PID: 3400)
      • FunInstaller_PS_0107704.exe (PID: 2636)
      • IQIYIsetup_baizhu@kb014.exe (PID: 3052)
      • SoftMgrInst.exe (PID: 2888)
      • ASE@8717.exe (PID: 2064)
      • QyFragment.exe (PID: 2868)
      • QyPlayer.exe (PID: 3604)
      • QyFragment.exe (PID: 1996)
      • QyFragment.exe (PID: 2572)
      • QyFragment.exe (PID: 2372)
      • QyClient.exe (PID: 3892)
      • QyFragment.exe (PID: 2224)
      • 360se.exe (PID: 556)
      • cAgXkQhHpPfGoTmU.exe (PID: 3284)

    • Creates files in the program directory

      • WindowsServer2008R2@674_4909[1].exe (PID: 3400)
      • ldsgamemaster.exe (PID: 3544)
      • QyFragment.exe (PID: 2868)
      • QyClient.exe (PID: 3892)
      • QyKernel.exe (PID: 2424)
      • IQIYIsetup_baizhu@kb014.exe (PID: 3052)

    • Starts Internet Explorer

      • explorer.exe (PID: 2028)
      • WindowsServer2008R2@674_4909[1].exe (PID: 3400)

    • Changes tracing settings of the file or console

      • Inst3__3112425__3f7372633d6c6d266c733d6e31343463316364383939__68616f2e3336302e636e__0c70.exe (PID: 2336)

    • Uses RUNDLL32.EXE to load library

      • FunInstaller_PS_0107704.exe (PID: 2636)
      • QyClient.exe (PID: 3892)

    • Creates or modifies windows services

      • rundll32.exe (PID: 3884)

    • Creates COM task schedule object

      • regsvr32.exe (PID: 3180)

    • Adds / modifies Windows certificates

      • Inst3__3112425__3f7372633d6c6d266c733d6e31343463316364383939__68616f2e3336302e636e__0c70.exe (PID: 2336)

    • Connects to unusual port

      • SoftMgrInst.exe (PID: 2888)

    • Modifies the open verb of a shell class

      • IQIYIsetup_baizhu@kb014.exe (PID: 3052)
      • ASE@8717.exe (PID: 2064)
      • 360se.exe (PID: 556)

    • Reads Environment values

      • IQIYIsetup_baizhu@kb014.exe (PID: 3052)

    • Creates files in the Windows directory

      • IQIYIsetup_baizhu@kb014.exe (PID: 3052)

    • Uses NETSH.EXE for network configuration

      • IQIYIsetup_baizhu@kb014.exe (PID: 3052)

    • Changes IE settings (feature browser emulation)

      • IQIYIsetup_baizhu@kb014.exe (PID: 3052)

    • Creates a software uninstall entry

      • IQIYIsetup_baizhu@kb014.exe (PID: 3052)
      • ASE@8717.exe (PID: 2064)
      • FunInstaller_PS_0107704.exe (PID: 2636)
      • cAgXkQhHpPfGoTmU.exe (PID: 3284)

    • Reads the cookies of Google Chrome

      • QyClient.exe (PID: 3892)

    • Reads the cookies of Mozilla Firefox

      • QyClient.exe (PID: 3892)

    • Application launched itself

      • QyFragment.exe (PID: 2572)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 2920)

    • Changes internet zones settings

      • iexplore.exe (PID: 2920)
      • iexplore.exe (PID: 2720)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2920)
      • iexplore.exe (PID: 3024)
      • iexplore.exe (PID: 2992)
      • iexplore.exe (PID: 2720)

    • Creates files in the user directory

      • iexplore.exe (PID: 2992)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2992)

    • Dropped object may contain TOR URL's

      • Inst3__3112425__3f7372633d6c6d266c733d6e31343463316364383939__68616f2e3336302e636e__0c70.exe (PID: 2336)
      • cAgXkQhHpPfGoTmU.exe (PID: 3284)

    • Dropped object may contain Bitcoin addresses

      • IQIYIsetup_baizhu@kb014.exe (PID: 3052)
      • ASE@8717.exe (PID: 2064)
      • QyClient.exe (PID: 3892)
      • cAgXkQhHpPfGoTmU.exe (PID: 3284)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
94
Monitored processes
48
Malicious processes
28
Suspicious processes
4

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start iexplore.exe iexplore.exe windowsserver2008r2@674_4909[1].exe no specs windowsserver2008r2@674_4909[1].exe ldsgamemasterinstroad_211601.exe iexplore.exe iexplore.exe inst3__3112425__3f7372633d6c6d266c733d6e31343463316364383939__68616f2e3336302e636e__0c70.exe ldsgamemaster.exe funinstaller_ps_0107704.exe softmgrinst.exe rundll32.exe no specs rundll32.exe no specs regsvr32.exe no specs rundll32.exe no specs iqiyisetup_baizhu@kb014.exe cagxkqhhppfgotmu.exe qiyidacl.exe no specs zoolsnbhbnhqd12.exe qiyidacl.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs qiyiservice.exe no specs qiyiservice.exe ase@8717.exe mkshortcut.exe no specs qyfragment.exe qyclient.exe qykernel.exe qyplayer.exe qyfragment.exe no specs qyfragment.exe qyfragment.exe qyfragment.exe qyfragment.exe no specs qyupdate.exe explorer.exe Thumbnail Cache Out of Proc Server Thumbnail Cache Out of Proc Server 360se.exe alphaseministart.exe alphaupdatecheck.exe alphasex.exe Thumbnail Cache Out of Proc Server rundll32.exe

Process information

PID
CMD
Path
Indicators
Parent process
252"C:\Program Files\IQIYI Video\LStyle\6.6.76.6256\QiyiService.exe" -iC:\Program Files\IQIYI Video\LStyle\6.6.76.6256\QiyiService.exe—IQIYIsetup_baizhu@kb014.exe
User:
admin
Company:
BEIJING QIYI CENTURY SCIENCE&TECHNOLOGY CO.,LTD.
Integrity Level:
HIGH
Description:
爱奇艺视频平台服务
Exit code:
1
Version:
6.5.6.557
Modules
Images
c:\program files\iqiyi video\lstyle\6.6.76.6256\qiyiservice.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\profapi.dll
c:\windows\system32\version.dll
556"C:\Users\admin\AppData\Roaming\360se6\Application\360se.exe" --do-shortcut=0_0_1 --set-homepage-overwrite --silent-install=3_1_1 --have-user-data-dir=trueC:\Users\admin\AppData\Roaming\360se6\Application\360se.exe
explorer.exe
User:
admin
Company:
360.cn
Integrity Level:
MEDIUM
Description:
360安全浏览器
Exit code:
15
Version:
9.1.0.326
Modules
Images
c:\users\admin\appdata\roaming\360se6\application\360se.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\roaming\360se6\application\9.1.0.326\chrome_elf.dll
c:\windows\system32\netapi32.dll
c:\windows\system32\netutils.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\rpcrt4.dll
1356"C:\Users\admin\AppData\Roaming\AlphaSE\AlphaUpdateCheck.exe" AlphaCheckerC:\Users\admin\AppData\Roaming\AlphaSE\AlphaUpdateCheck.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Chrome安全浏览器升级模块
Exit code:
0
Version:
1, 0, 0, 2001
Modules
Images
c:\users\admin\appdata\roaming\alphase\alphaupdatecheck.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\roaming\alphase\aplsafectl.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1664C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}C:\Windows\system32\DllHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1740"C:\Users\admin\AppData\Roaming\AlphaSE\AlphaseMiniStart.exe"C:\Users\admin\AppData\Roaming\AlphaSE\AlphaseMiniStart.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\alphase\alphaseministart.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winspool.drv
1832"C:\Program Files\IQIYI Video\LStyle\6.6.76.6256\QiyiDACL.exe" QiyiUpdate "C:\Program Files\Common Files\IQIYI Video" trueC:\Program Files\IQIYI Video\LStyle\6.6.76.6256\QiyiDACL.exe—IQIYIsetup_baizhu@kb014.exe
User:
admin
Company:
爱奇艺
Integrity Level:
HIGH
Description:
爱奇艺组件
Exit code:
0
Version:
2.0.0.1
Modules
Images
c:\program files\iqiyi video\lstyle\6.6.76.6256\qiyidacl.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
1996C:\Program Files\IQIYI Video\LStyle\6.6.76.6256\QyFragment.exe PipeName=list::QyClient.exe::::list::QyFragment.exe::::,ProductNameInner=listC:\Program Files\IQIYI Video\LStyle\6.6.76.6256\QyFragment.exe
QyClient.exe
User:
admin
Company:
爱奇艺
Integrity Level:
MEDIUM
Description:
爱奇艺视频辅助程序
Exit code:
0
Version:
6.6.76.6256
Modules
Images
c:\program files\iqiyi video\lstyle\6.6.76.6256\qyfragment.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\iqiyi video\lstyle\6.6.76.6256\quilib.dll
c:\program files\iqiyi video\lstyle\6.6.76.6256\gbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\psapi.dll
c:\windows\system32\winmm.dll
2028C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\winanr.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
2064C:\Users\admin\AppData\Local\Temp\gzss\ASE@8717.exe /sC:\Users\admin\AppData\Local\Temp\gzss\ASE@8717.exe
WindowsServer2008R2@674_4909[1].exe
User:
admin
Integrity Level:
HIGH
Description:
Chrome安全浏览器
Exit code:
0
Version:
1, 0, 0, 1
Modules
Images
c:\users\admin\appdata\local\temp\gzss\ase@8717.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winspool.drv
2096"C:\Users\admin\AppData\Roaming\alphase\AlphaseX.exe" C:\Users\admin\AppData\Roaming\alphase\AlphaseX.exe
AlphaUpdateCheck.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\alphase\alphasex.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\roaming\alphase\7zan.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
Total events
17 129
Read events
15 362
Write events
1 739
Delete events
28

Modification events

(PID) Process:(2920) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2920) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2920) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2920) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(2920) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2920) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000069000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(2920) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{53560D79-F8F9-11E8-91D7-5254004A04AF}
Value:
0
(PID) Process:(2920) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Type
Value:
4
(PID) Process:(2920) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Count
Value:
3
(PID) Process:(2920) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Time
Value:
E2070C00040006000100320025008602
Executable files
443
Suspicious files
303
Text files
4 714
Unknown types
60

Dropped files

PID
Process
Filename
Type
2920iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\favicon[1].ico —
MD5:—
SHA256:—
2920iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
2920iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF74BC9E095A8E53E2.TMP —
MD5:—
SHA256:—
2920iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF9AFD64881A83CCF5.TMP —
MD5:—
SHA256:—
2920iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{53560D79-F8F9-11E8-91D7-5254004A04AF}.dat —
MD5:—
SHA256:—
3024iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\JavaDeployReg.logtext
MD5:—
SHA256:—
3400WindowsServer2008R2@674_4909[1].exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\z_stat[1].phptext
MD5:—
SHA256:—
3400WindowsServer2008R2@674_4909[1].exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@pieshua[1].txttext
MD5:—
SHA256:—
3024iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\WindowsServer2008R2@674_4909[1].exeexecutable
MD5:—
SHA256:—
2920iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0UU90R59\WindowsServer2008R2@674_4909[1].exeexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
137
TCP/UDP connections
176
DNS requests
56
Threats
39

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3400
WindowsServer2008R2@674_4909[1].exe
GET
—
180.95.171.107:80
http://c.pieshua.com/youxi/index_674_2.htm
CN
—
—
malicious
3072
LDSGameMasterInstRoad_211601.exe
GET
—
104.192.108.21:80
http://dl.ludashi.com/gamemaster/buychannelFull.exe
US
—
—
whitelisted
3072
LDSGameMasterInstRoad_211601.exe
GET
—
104.192.108.21:80
http://dl.ludashi.com/gamemaster/buychannelFull.exe
US
—
—
whitelisted
3024
iexplore.exe
GET
200
120.27.186.114:80
http://25689.xc.mieseng.com/xiaz/WindowsServer2008R2@674_4909.exe
CN
executable
1.28 Mb
suspicious
3400
WindowsServer2008R2@674_4909[1].exe
POST
200
47.107.217.237:80
http://q.pieshua.com/qy/gi
CN
text
29.6 Kb
malicious
3400
WindowsServer2008R2@674_4909[1].exe
GET
200
180.95.171.107:80
http://c.pieshua.com/youxi/index_674_1.htm
CN
html
363 b
malicious
3400
WindowsServer2008R2@674_4909[1].exe
POST
200
47.107.217.237:80
http://q.pieshua.com/qy/gl
CN
text
27.6 Kb
malicious
3400
WindowsServer2008R2@674_4909[1].exe
GET
200
180.95.171.107:80
http://c.pieshua.com/logo/logo-jua.zip
CN
compressed
613 Kb
malicious
3400
WindowsServer2008R2@674_4909[1].exe
GET
200
180.95.171.107:80
http://c.pieshua.com/skin/skin_18091401.zip
CN
compressed
256 Kb
malicious
3400
WindowsServer2008R2@674_4909[1].exe
GET
200
124.172.114.250:80
http://s95.cnzz.com/z_stat.php?id=1257656622&web_id=1257656622
CN
text
11.4 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3400
WindowsServer2008R2@674_4909[1].exe
59.46.4.208:443
s19.cnzz.com
No.31,Jin-rong Street
CN
unknown
3400
WindowsServer2008R2@674_4909[1].exe
203.119.128.195:443
z8.cnzz.com
—
CN
malicious
2920
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3024
iexplore.exe
120.27.186.114:80
25689.xc.mieseng.com
Hangzhou Alibaba Advertising Co.,Ltd.
CN
suspicious
3400
WindowsServer2008R2@674_4909[1].exe
47.107.217.237:80
q.pieshua.com
Hangzhou Alibaba Advertising Co.,Ltd.
CN
suspicious
3400
WindowsServer2008R2@674_4909[1].exe
180.95.171.107:80
c.pieshua.com
CHINA UNICOM China169 Backbone
CN
unknown
3400
WindowsServer2008R2@674_4909[1].exe
124.172.114.250:80
s95.cnzz.com
China Unicom Guangzhou network
CN
unknown
3400
WindowsServer2008R2@674_4909[1].exe
116.207.118.89:443
s22.cnzz.com
No.31,Jin-rong Street
CN
unknown
3400
WindowsServer2008R2@674_4909[1].exe
116.207.118.90:443
s22.cnzz.com
No.31,Jin-rong Street
CN
unknown
3400
WindowsServer2008R2@674_4909[1].exe
104.192.108.21:80
dl.ludashi.com
Beijing Qihu Technology Company Limited
US
malicious

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
25689.xc.mieseng.com
  • 120.27.186.114
  • 114.55.188.114
  • 101.201.62.45
  • 139.224.39.0
suspicious
q.pieshua.com
  • 47.107.217.237
malicious
c.pieshua.com
  • 180.95.171.107
  • 180.95.171.108
  • 180.95.171.109
  • 180.95.171.55
  • 180.95.171.56
  • 180.95.171.57
  • 180.95.171.58
  • 180.95.171.106
malicious
s95.cnzz.com
  • 124.172.114.250
  • 124.172.114.249
whitelisted
s22.cnzz.com
  • 116.207.118.89
  • 116.207.118.90
suspicious
c.cnzz.com
  • 116.207.118.90
  • 116.207.118.89
whitelisted
z1.cnzz.com
  • 203.119.129.114
whitelisted
cnzz.mmstat.com
  • 198.11.132.221
whitelisted
z4.cnzz.com
  • 203.119.206.93
whitelisted

Threats

PID
Process
Class
Message
3024
iexplore.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3024
iexplore.exe
Misc activity
ET INFO EXE - Served Attached HTTP
3400
WindowsServer2008R2@674_4909[1].exe
Misc activity
ADWARE [PTsecurity] PUA:Win32/XingSof
3400
WindowsServer2008R2@674_4909[1].exe
Misc activity
ADWARE [PTsecurity] PUA:Win32/XingSof
3400
WindowsServer2008R2@674_4909[1].exe
A Network Trojan was detected
SC ADWARE not-a-virus:Downloader.Win32.Agent / Win32/Adware.Qjwmonkey
3400
WindowsServer2008R2@674_4909[1].exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3400
WindowsServer2008R2@674_4909[1].exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3072
LDSGameMasterInstRoad_211601.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3400
WindowsServer2008R2@674_4909[1].exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3400
WindowsServer2008R2@674_4909[1].exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
9 ETPRO signatures available at the full report
Process
Message
WindowsServer2008R2@674_4909[1].exe
[0]
WindowsServer2008R2@674_4909[1].exe
[1]
WindowsServer2008R2@674_4909[1].exe
[2]
WindowsServer2008R2@674_4909[1].exe
[4]
WindowsServer2008R2@674_4909[1].exe
[4]
WindowsServer2008R2@674_4909[1].exe
[5]
FunInstaller_PS_0107704.exe
Tried to RegisterCallback without an AtExitManager.
FunInstaller_PS_0107704.exe
Tried to RegisterCallback without an AtExitManager.
FunInstaller_PS_0107704.exe
Tried to RegisterCallback without an AtExitManager.
FunInstaller_PS_0107704.exe
Tried to RegisterCallback without an AtExitManager.
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://25689.xc.mieseng.com/xiaz/WindowsServer2008R2@674_4909.exe