General Info

File name

GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exe

Full analysis
https://app.any.run/tasks/ecad9455-33bf-4d91-8668-6c1fd40b576d
Verdict
Malicious activity
Analysis date
6/12/2019, 13:29:29
OS:
Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:

MIME:
application/x-dosexec
File info:
PE32 executable (GUI) Intel 80386, for MS Windows
MD5

a013a0ae51952e019e5dc12ad58e12ef

SHA1

9bc50bf78b77f4ed290fafcfc9f22c18d1642ae7

SHA256

2114dd0f39c05b33c09fc4e3e707d3790c795491f81b2829252e40b453fda716

SSDEEP

196608:abCqmSlkqlUgN7AktVweDO+oPG5eWWi/zio/i:YO2O+o+wWrX/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distored by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Software environment set and analysis options

Launch configuration

Task duration
60 seconds
Additional time used
none
Fakenet option
off
Heavy Evaision option
off
MITM proxy
off
Route via Tor
off
Network geolocation
off
Privacy
Public submission
Autoconfirmation of UAC
on

Software preset

  • Internet Explorer 8.0.7601.17514
  • Adobe Acrobat Reader DC MUI (15.023.20070)
  • Adobe Flash Player 26 ActiveX (26.0.0.131)
  • Adobe Flash Player 26 NPAPI (26.0.0.131)
  • Adobe Flash Player 26 PPAPI (26.0.0.131)
  • Adobe Refresh Manager (1.8.0)
  • CCleaner (5.35)
  • FileZilla Client 3.36.0 (3.36.0)
  • Google Chrome (73.0.3683.75)
  • Google Update Helper (1.3.33.23)
  • Java 8 Update 92 (8.0.920.14)
  • Java Auto Updater (2.8.92.14)
  • Microsoft .NET Framework 4.6.1 (4.6.01055)
  • Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Professional 2010 (14.0.6029.1000)
  • Microsoft Office Proof (English) 2010 (14.0.6029.1000)
  • Microsoft Office Proof (French) 2010 (14.0.6029.1000)
  • Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
  • Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
  • Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Single Image 2010 (14.0.6029.1000)
  • Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
  • Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
  • Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
  • Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
  • Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
  • Microsoft Visual C++ 2017 Redistributable (x86) - 14.15.26706 (14.15.26706.0)
  • Microsoft Visual C++ 2017 x86 Additional Runtime - 14.15.26706 (14.15.26706)
  • Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.15.26706 (14.15.26706)
  • Mozilla Firefox 65.0.2 (x86 en-US) (65.0.2)
  • Notepad++ (32-bit x86) (7.5.1)
  • Opera 12.15 (12.15.1748)
  • Skype version 8.29 (8.29)
  • VLC media player (2.2.6)
  • WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

  • Client LanguagePack Package
  • Client Refresh LanguagePack Package
  • CodecPack Basic Package
  • Foundation Package
  • IE Troubleshooters Package
  • InternetExplorer Optional Package
  • KB2534111
  • KB2999226
  • KB976902
  • LocalPack AU Package
  • LocalPack CA Package
  • LocalPack GB Package
  • LocalPack US Package
  • LocalPack ZA Package
  • ProfessionalEdition
  • UltimateEdition

Behavior activities

MALICIOUS SUSPICIOUS INFO
Loads dropped or rewritten executable
  • TenioDL.exe (PID: 2916)
  • GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exe (PID: 3824)
Application was dropped or rewritten from another process
  • TenioDL.exe (PID: 2916)
Creates files in the user directory
  • GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exe (PID: 3824)
  • TenioDL.exe (PID: 2916)
Uses ICACLS.EXE to modify access control list
  • TenioDL.exe (PID: 2916)
Executable content was dropped or overwritten
  • GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exe (PID: 3824)
Low-level read access rights to disk partition
  • GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exe (PID: 3824)

No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Static information

TRiD
.exe
|   Win32 Executable (generic) (3.6%)
.exe
|   Generic Win/DOS Executable (1.6%)
.exe
|   DOS Executable Generic (1.5%)
EXIF
EXE
MachineType:
Intel 386 or later, and compatibles
TimeStamp:
2019:06:04 10:42:43+02:00
PEType:
PE32
LinkerVersion:
14
CodeSize:
1325056
InitializedDataSize:
8377344
UninitializedDataSize:
null
EntryPoint:
0x9e322
OSVersion:
5.1
ImageVersion:
null
SubsystemVersion:
5.1
Subsystem:
Windows GUI
FileVersionNumber:
1.0.10900.123
ProductVersionNumber:
1.0.10900.123
FileFlagsMask:
0x003f
FileFlags:
(none)
FileOS:
Win32
ObjectFileType:
Executable application
FileSubtype:
null
LanguageCode:
English (U.S.)
CharacterSet:
Windows, Latin1
CompanyName:
Tencent
FileDescription:
Tencent Gaming Buddy - Install
FileVersion:
1.0.10900.123
InternalName:
GameDownload
LegalCopyright:
Copyright © 2017 Tencent. All Rights Reserved.
OriginalFileName:
GameDownload.exe
ProductName:
Tencent Gaming Buddy
ProductVersion:
1,0,10900,123
Summary
Architecture:
IMAGE_FILE_MACHINE_I386
Subsystem:
IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date:
04-Jun-2019 08:42:43
Detected languages
Chinese - PRC
English - United States
Debug artifacts
D:\jenkins_Trunk\workspace\RO\qqpcmgr_proj\AndroidEmulator\Output\Binfinal\GameDownload\GameDownload.pdb
CompanyName:
Tencent
FileDescription:
Tencent Gaming Buddy - Install
FileVersion:
1.0.10900.123
InternalName:
GameDownload
LegalCopyright:
Copyright © 2017 Tencent. All Rights Reserved.
OriginalFilename:
GameDownload.exe
ProductName:
Tencent Gaming Buddy
ProductVersion:
1,0,10900,123
DOS Header
Magic number:
MZ
Bytes on last page of file:
0x0090
Pages in file:
0x0003
Relocations:
0x0000
Size of header:
0x0004
Min extra paragraphs:
0x0000
Max extra paragraphs:
0xFFFF
Initial SS value:
0x0000
Initial SP value:
0x00B8
Checksum:
0x0000
Initial IP value:
0x0000
Initial CS value:
0x0000
Overlay number:
0x0000
OEM identifier:
0x0000
OEM information:
0x0000
Address of NE header:
0x00000130
PE Headers
Signature:
PE
Machine:
IMAGE_FILE_MACHINE_I386
Number of sections:
8
Time date stamp:
04-Jun-2019 08:42:43
Pointer to Symbol Table:
0x00000000
Number of symbols:
0
Size of Optional Header:
0x00E0
Characteristics
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
Sections
Name Virtual Address Virtual Size Raw Size Charateristics Entropy
.text 0x00001000 0x00143760 0x00143800 IMAGE_SCN_CNT_CODE,IMAGE_SCN_MEM_EXECUTE,IMAGE_SCN_MEM_READ 6.54513
.rdata 0x00145000 0x0005D44C 0x0005D600 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ 5.02137
.data 0x001A3000 0x000063B4 0x00004600 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE 4.74855
.gfids 0x001AA000 0x000003F4 0x00000400 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ 4.04318
.tls 0x001AB000 0x00000009 0x00000200 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE 0.0203931
.QMGuid 0x001AC000 0x00000014 0x00000200 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_SHARED,IMAGE_SCN_MEM_WRITE 0
.rsrc 0x001AD000 0x007867E0 0x00786800 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ 7.42495
.reloc 0x00934000 0x00012844 0x00012A00 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_DISCARDABLE,IMAGE_SCN_MEM_READ 6.64734
Resources
1

2

3

4

5

6

7

8

9

10

107

108

110

137

140

141

142

143

IDR_CUSTOM_FOR_EXTRACE_ICON

IDR_QMUI_DAT

Imports
    VERSION.dll

    PSAPI.DLL

    WS2_32.dll

    IMM32.dll

    KERNEL32.dll

    USER32.dll

    GDI32.dll

    ADVAPI32.dll

    SHELL32.dll

    ole32.dll

    OLEAUT32.dll

    SHLWAPI.dll

    imagehlp.dll

    WINMM.dll

    WININET.dll

    COMCTL32.dll

    gdiplus.dll

    urlmon.dll

    IPHLPAPI.DLL

    NETAPI32.dll

    WLDAP32.dll

Exports
    curl_easy_cleanup

    curl_easy_duphandle

    curl_easy_escape

    curl_easy_getinfo

    curl_easy_init

    curl_easy_pause

    curl_easy_perform

    curl_easy_recv

    curl_easy_reset

    curl_easy_send

    curl_easy_setopt

    curl_easy_strerror

    curl_easy_unescape

    curl_escape

    curl_formadd

    curl_formfree

    curl_formget

    curl_free

    curl_getdate

    curl_getenv

    curl_global_cleanup

    curl_global_init

    curl_global_init_mem

    curl_maprintf

    curl_mfprintf

    curl_mprintf

    curl_msnprintf

    curl_msprintf

    curl_multi_add_handle

    curl_multi_assign

    curl_multi_cleanup

    curl_multi_fdset

    curl_multi_info_read

    curl_multi_init

    curl_multi_perform

    curl_multi_remove_handle

    curl_multi_setopt

    curl_multi_socket

    curl_multi_socket_action

    curl_multi_socket_all

    curl_multi_strerror

    curl_multi_timeout

    curl_multi_wait

    curl_mvaprintf

    curl_mvfprintf

    curl_mvprintf

    curl_mvsnprintf

    curl_mvsprintf

    curl_share_cleanup

    curl_share_init

    curl_share_setopt

    curl_share_strerror

    curl_slist_append

    curl_slist_free_all

    curl_strequal

    curl_strnequal

    curl_unescape

Screenshots

Processes

Total processes
39
Monitored processes
4
Malicious processes
1
Suspicious processes
1

Behavior graph

+
drop and start start gamedownload_pubg_mobile_tycs-cj-google-gdn_900202886_1.0.10900.123.exe no specs gamedownload_pubg_mobile_tycs-cj-google-gdn_900202886_1.0.10900.123.exe teniodl.exe icacls.exe no specs
Specs description
Program did not start
Integrity level elevation
Task сontains an error or was rebooted
Process has crashed
Task contains several apps running
Executable file was dropped
Debug information is available
Process was injected
Network attacks were detected
Application downloaded the executable file
Actions similar to stealing personal data
Behavior similar to exploiting the vulnerability
Inspected object has sucpicious PE structure
File is detected by antivirus software
CPU overrun
RAM overrun
Process starts the services
Process was added to the startup
Behavior similar to spam
Low-level access to the HDD
Probably Tor was used
System was rebooted
Connects to the network
Known threat

Process information

Click at the process to see the details.

PID
3068
CMD
"C:\Users\admin\AppData\Local\Temp\GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exe"
Path
C:\Users\admin\AppData\Local\Temp\GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exe
Indicators
No indicators
Parent process
––
User
admin
Integrity Level
MEDIUM
Exit code
3221226540
Version:
Company
Tencent
Description
Tencent Gaming Buddy - Install
Version
1.0.10900.123
Modules
Image
c:\users\admin\appdata\local\temp\gamedownload_pubg_mobile_tycs-cj-google-gdn_900202886_1.0.10900.123.exe
c:\systemroot\system32\ntdll.dll

PID
3824
CMD
"C:\Users\admin\AppData\Local\Temp\GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exe"
Path
C:\Users\admin\AppData\Local\Temp\GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exe
Indicators
Parent process
––
User
admin
Integrity Level
HIGH
Version:
Company
Tencent
Description
Tencent Gaming Buddy - Install
Version
1.0.10900.123
Modules
Image
c:\users\admin\appdata\local\temp\gamedownload_pubg_mobile_tycs-cj-google-gdn_900202886_1.0.10900.123.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\psapi.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msctf.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\imagehlp.dll
c:\windows\system32\winmm.dll
c:\windows\system32\wininet.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\iertutil.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\netapi32.dll
c:\windows\system32\netutils.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\firewallapi.dll
c:\windows\system32\windowscodecs.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\profapi.dll
c:\users\admin\appdata\roaming\tencent\txgameassistant\gamedownload\teniodl.dll
c:\users\admin\appdata\roaming\tencent\txgameassistant\gamedownload\teniodl.exe
c:\windows\system32\apphelp.dll
c:\windows\system32\mswsock.dll
c:\users\admin\appdata\roaming\tencent\txgameassistant\gamedownload\dr.dll
c:\windows\system32\msvcp60.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\napinsp.dll
c:\windows\system32\pnrpnsp.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\winrnr.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\rasadhlp.dll

PID
2916
CMD
C:\Users\admin\AppData\Roaming\Tencent\TxGameAssistant\GameDownload\TenioDL.exe
Path
C:\Users\admin\AppData\Roaming\Tencent\TxGameAssistant\GameDownload\TenioDL.exe
Indicators
Parent process
GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exe
User
admin
Integrity Level
HIGH
Version:
Company
Tencent
Description
腾讯游戏云加速下载引擎(旋风Inside)
Version
2, 0, 15, 26
Modules
Image
c:\users\admin\appdata\roaming\tencent\txgameassistant\gamedownload\teniodl.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\imm32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msctf.dll
c:\users\admin\appdata\roaming\tencent\txgameassistant\gamedownload\teniodl_core.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winmm.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\version.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\users\admin\appdata\roaming\tencent\txgameassistant\gamedownload\p2papp.dll
c:\windows\system32\psapi.dll
c:\windows\system32\profapi.dll
c:\windows\system32\cryptbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\propsys.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\icacls.exe
c:\windows\system32\mswsock.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\napinsp.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\pnrpnsp.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\winrnr.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\rasadhlp.dll

PID
324
CMD
"C:\Windows\System32\icacls.exe" C:\Users\admin\AppData\Roaming\Tencent\Config\ /t /setintegritylevel low
Path
C:\Windows\System32\icacls.exe
Indicators
No indicators
Parent process
TenioDL.exe
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Microsoft Corporation
Description
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\icacls.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll

Registry activity

Total events
80
Read events
73
Write events
7
Delete events
0

Modification events

PID
Process
Operation
Key
Name
Value
3824
GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Tencent\MobileGamePC
SupplyId
900202886
3824
GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exe
write
HKEY_CURRENT_USER\Software\Tencent\MobileGamePC
sf
C:\Temp\TxGameDownload\MobileGamePCShared
2916
TenioDL.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
0
2916
TenioDL.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
1
2916
TenioDL.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\metnsd\clsid
SequenceID
4DE67D61E8274143A65DB60A84392BCC

Files activity

Executable files
5
Suspicious files
0
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
3824
GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exe
C:\Users\admin\AppData\Roaming\Tencent\TxGameAssistant\GameDownload\dr.dll
executable
MD5: 2814acbd607ba47bdbcdf6ac3076ee95
SHA256: 5904a7e4d97eeac939662c3638a0e145f64ff3dd0198f895c4bf0337595c6a67
3824
GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exe
C:\Users\admin\AppData\Roaming\Tencent\TxGameAssistant\GameDownload\p2papp.dll
executable
MD5: b1b101d86c417286e60f471fc8b79bb1
SHA256: 91cfa1769be449dfdfbf6bcc8049ce5c9218df6deaa66a0879528526b204a51a
3824
GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exe
C:\Users\admin\AppData\Roaming\Tencent\TxGameAssistant\GameDownload\TenioDL.dll
executable
MD5: 34431eb1ae2d3ac86e3415d8c3e977a3
SHA256: 8379e09c7a3a51bdb652418781ceed8067e324b656c7d5a307b9a77c899f0806
3824
GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exe
C:\Users\admin\AppData\Roaming\Tencent\TxGameAssistant\GameDownload\TenioDL.exe
executable
MD5: 8fb4e336f4c145eb6e379701c3ac59d1
SHA256: d7a59b5ba3f0fb3906ebaa7a67c76088995a1f37652a2ae9893977c19754d9bf
3824
GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exe
C:\Users\admin\AppData\Roaming\Tencent\TxGameAssistant\GameDownload\TenioDL_core.dll
executable
MD5: 11d65a68132e918bd80e7e0a09029730
SHA256: 36c18dedac0429375c583fcf9420cdc9ace8a38bbac9f33378b5b4d6739da511
2916
TenioDL.exe
C:\Users\admin\AppData\Roaming\Tencent\File\user_game.ini
text
MD5: 1fe38846b57e1b0ba0c8360c0187a240
SHA256: f9282be19744e53e3a28d5d56594f469bc33feb3d2d5e4a3a4263b2aa486472d
2916
TenioDL.exe
C:\Users\admin\AppData\Local\Temp\etilqs_xebGtRIfVyC6BqE
––
MD5:  ––
SHA256:  ––
2916
TenioDL.exe
C:\Users\admin\AppData\Local\Temp\etilqs_YEgQZPVFTAEjyfv
––
MD5:  ––
SHA256:  ––
3824
GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exe
C:\test.tmp
––
MD5:  ––
SHA256:  ––

Find more information of the staic content and download it at the full report

Network activity

HTTP(S) requests
0
TCP/UDP connections
12
DNS requests
11
Threats
5

HTTP requests

No HTTP requests.

Connections

PID Process IP ASN CN Reputation
3824 GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exe 125.39.247.36:8000 CHINA UNICOM China169 Backbone CN unknown
3824 GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exe 58.250.137.93:443 China Unicom Guangdong IP network CN malicious
2916 TenioDL.exe 125.39.248.51:8000 CHINA UNICOM China169 Backbone CN unknown
2916 TenioDL.exe 163.177.93.188:8000 China Unicom Shenzen network CN unknown
2916 TenioDL.exe 220.194.106.125:14309 CHINA UNICOM China169 Backbone CN unknown
2916 TenioDL.exe 125.39.248.35:8000 CHINA UNICOM China169 Backbone CN unknown
–– –– 163.177.93.179:8000 China Unicom Shenzen network CN unknown
–– –– 109.169.22.99:29179 iomart Cloud Services Limited. GB unknown
–– –– 125.39.248.39:8000 CHINA UNICOM China169 Backbone CN unknown

DNS requests

Domain IP Reputation
p2pupgrade.gamedl.qq.com 125.39.247.36
125.39.248.35
unknown
masterconn.qq.com 203.205.142.202
unknown
master.etl.desktop.qq.com 58.250.137.93
58.251.106.185
whitelisted
masterconn2.qq.com 123.151.71.34
unknown
stat.gamedl.qq.com 111.161.93.163
111.161.93.164
111.161.93.165
125.39.248.43
125.39.248.44
125.39.248.45
unknown
config.gamedl.qq.com 220.194.106.125
125.39.248.36
unknown
stun.qqlive.qq.com 163.177.93.188
163.177.93.245
220.249.245.24
220.249.245.138
163.177.93.178
unknown
ps2.gamedl.qq.com 125.39.248.51
60.28.190.146
unknown
p2pupdate.gamedl.qq.com 125.39.248.35
125.39.247.36
unknown

Threats

PID Process Class Message
2916 TenioDL.exe Generic Protocol Command Decode ET INFO Session Traversal Utilities for NAT (STUN Binding Request obsolete rfc 3489 CHANGE-REQUEST attribute change IP flag false change port flag false)
2916 TenioDL.exe Generic Protocol Command Decode ET INFO Session Traversal Utilities for NAT (STUN Binding Request obsolete rfc 3489 CHANGE-REQUEST attribute change IP flag true change port flag false)
2916 TenioDL.exe Generic Protocol Command Decode ET INFO Session Traversal Utilities for NAT (STUN Binding Request obsolete rfc 3489 CHANGE-REQUEST attribute change IP flag false change port flag true)
–– –– Generic Protocol Command Decode ET INFO Session Traversal Utilities for NAT (STUN Binding Request obsolete rfc 3489 CHANGE-REQUEST attribute change IP flag false change port flag false)
–– –– Generic Protocol Command Decode ET INFO Session Traversal Utilities for NAT (STUN Binding Request obsolete rfc 3489 CHANGE-REQUEST attribute change IP flag false change port flag false)

Debug output strings

Process Message
GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exe [Downloader] DriverType C: = 3
GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exe [Downloader] DriverType C: = 3
GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exe [Downloader] DriverType C: = 3
GameDownload_PUBG_MOBILE_tycs-cj-google-GDN_900202886_1.0.10900.123.exe [Downloader] DriverType C: = 3