URL:

http://down.shusw.com/jpwb/gf/setup_jpxz001.exe

Full analysis: https://app.any.run/tasks/81e4a49b-44d1-451f-9f87-8cccddc5a230
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: December 19, 2019, 02:51:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
adware
pup
pua
softcnapp
Indicators:
MD5:

40D5CD2479192ACD764DB933123FD6A9

SHA1:

C9A28E79E11EF0D7CD7DD541B3A4CF33050654AF

SHA256:

2691F81EF6346ED360B6F2DF36F7DF564B9F4E202707D3F4C2F3803BAE2DD361

SSDEEP:

3:N1KaKBNQWSLKKgH0RfHVVS4An:Ca04KTURN0Nn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • setup_jpxz001.exe (PID: 1724)
      • JPMutual.exe (PID: 2340)
      • setup_jpxz001.exe (PID: 2440)
      • JPMutual.exe (PID: 2452)
      • JPWizard.exe (PID: 1448)
      • JPMBManager.exe (PID: 3724)
      • JPPower32.exe (PID: 1520)
      • JPPower32.exe (PID: 2252)
      • JPPower32.exe (PID: 2748)
      • JPMBManager.exe (PID: 688)
      • JPWizard.exe (PID: 292)
      • JPImeManager.exe (PID: 3324)
      • JPMBManager.exe (PID: 2684)
      • JPCloud.exe (PID: 2924)
      • JPCloud.exe (PID: 4044)
      • JPWizard.exe (PID: 3392)
      • JPCloud.exe (PID: 3784)
      • JPImeManager.exe (PID: 3768)

    • Downloads executable files from the Internet

      • iexplore.exe (PID: 3772)

    • Loads dropped or rewritten executable

      • JPMBManager.exe (PID: 3724)
      • JPWizard.exe (PID: 1448)
      • JPPower32.exe (PID: 1520)
      • JPMutual.exe (PID: 2340)
      • JPMBManager.exe (PID: 688)
      • JPWizard.exe (PID: 292)
      • JPImeManager.exe (PID: 3324)
      • JPMBManager.exe (PID: 2684)
      • JPImeManager.exe (PID: 3768)
      • JPWizard.exe (PID: 3392)

    • Changes the autorun value in the registry

      • JPMutual.exe (PID: 2340)

    • SOFTCNAPP was detected

      • JPMutual.exe (PID: 2340)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 532)
      • setup_jpxz001.exe (PID: 2440)
      • iexplore.exe (PID: 3772)
      • JPPower32.exe (PID: 1520)
      • JPMutual.exe (PID: 2340)

    • Creates files in the program directory

      • setup_jpxz001.exe (PID: 2440)
      • JPMutual.exe (PID: 2452)
      • JPMBManager.exe (PID: 3724)
      • JPWizard.exe (PID: 1448)
      • JPMutual.exe (PID: 2340)
      • JPMBManager.exe (PID: 688)
      • JPImeManager.exe (PID: 3324)
      • JPMBManager.exe (PID: 2684)
      • JPImeManager.exe (PID: 3768)

    • Creates a software uninstall entry

      • JPMutual.exe (PID: 2340)

    • Creates files in the Windows directory

      • JPPower32.exe (PID: 1520)

    • Modifies the open verb of a shell class

      • JPMutual.exe (PID: 2340)

    • Low-level read access rights to disk partition

      • JPMutual.exe (PID: 2340)
      • setup_jpxz001.exe (PID: 2440)

  • INFO

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3772)
      • iexplore.exe (PID: 532)

    • Changes internet zones settings

      • iexplore.exe (PID: 532)

    • Application launched itself

      • iexplore.exe (PID: 532)

    • Manual execution by user

      • setup_jpxz001.exe (PID: 1724)
      • setup_jpxz001.exe (PID: 2440)
      • JPCloud.exe (PID: 3784)
      • taskmgr.exe (PID: 792)
      • JPCloud.exe (PID: 2924)
      • JPWizard.exe (PID: 3392)
      • JPCloud.exe (PID: 4044)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
63
Monitored processes
21
Malicious processes
8
Suspicious processes
4

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start iexplore.exe iexplore.exe setup_jpxz001.exe no specs setup_jpxz001.exe #SOFTCNAPP jpmutual.exe jpmutual.exe no specs jpmbmanager.exe no specs jpwizard.exe jppower32.exe jppower32.exe no specs jppower32.exe no specs jpmbmanager.exe no specs jpwizard.exe jpimemanager.exe no specs jpmbmanager.exe no specs jpcloud.exe no specs jpcloud.exe no specs taskmgr.exe no specs jpcloud.exe jpwizard.exe jpimemanager.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
292"C:\Program Files\JiPinInput\2.2.1.1111\JPWizard.exe" C:\Program Files\JiPinInput\2.2.1.1111\JPWizard.exe
setup_jpxz001.exe
User:
admin
Integrity Level:
HIGH
Description:
输入法设置向导
Exit code:
0
Version:
2,2,1,11201
Modules
Images
c:\program files\jipininput\2.2.1.1111\jpwizard.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\jipininput\2.2.1.1111\duilib32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
532"C:\Program Files\Internet Explorer\iexplore.exe" "http://down.shusw.com/jpwb/gf/setup_jpxz001.exe"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
688"C:\Program Files\JiPinInput\2.2.1.1111\JPMBManager.exe" DownloadCellDictMb 2476,6904,6448,6452,6446,6447,6913,2491,4174C:\Program Files\JiPinInput\2.2.1.1111\JPMBManager.exe—JPWizard.exe
User:
admin
Integrity Level:
HIGH
Description:
输入法词库工具
Exit code:
0
Version:
2,2,1,11201
Modules
Images
c:\program files\jipininput\2.2.1.1111\jpmbmanager.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
792"C:\Windows\system32\taskmgr.exe" /4C:\Windows\system32\taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Task Manager
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1448"C:\Program Files\JiPinInput\2.2.1.1111\JPWizard.exe" RunAutoLoadDictC:\Program Files\JiPinInput\2.2.1.1111\JPWizard.exe
JPMutual.exe
User:
admin
Integrity Level:
HIGH
Description:
输入法设置向导
Exit code:
0
Version:
2,2,1,11201
Modules
Images
c:\program files\jipininput\2.2.1.1111\jpwizard.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\jipininput\2.2.1.1111\duilib32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1520"C:\Program Files\JiPinInput\2.2.1.1111\JPPower32.exe" /InstallIME JiPinSrfC:\Program Files\JiPinInput\2.2.1.1111\JPPower32.exe
JPMutual.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Version:
2,2,1,11201
Modules
Images
c:\program files\jipininput\2.2.1.1111\jppower32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1724"C:\Users\admin\Downloads\setup_jpxz001.exe" C:\Users\admin\Downloads\setup_jpxz001.exe—explorer.exe
User:
admin
Company:
www.jpwb.net
Integrity Level:
MEDIUM
Description:
极品输入法
Exit code:
3221226540
Version:
2,2,1,11201
Modules
Images
c:\users\admin\downloads\setup_jpxz001.exe
c:\systemroot\system32\ntdll.dll
2252"C:\Program Files\JiPinInput\2.2.1.1111\JPPower32.exe" /RegApkRelatedC:\Program Files\JiPinInput\2.2.1.1111\JPPower32.exe—JPMutual.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Version:
2,2,1,11201
Modules
Images
c:\program files\jipininput\2.2.1.1111\jppower32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2340"C:\Program Files\JiPinInput\2.2.1.1111\JPMutual.exe" InstallWuBiSpreadOperate jpxz001191219C:\Program Files\JiPinInput\2.2.1.1111\JPMutual.exe
setup_jpxz001.exe
User:
admin
Integrity Level:
HIGH
Description:
输入法交互程序
Exit code:
0
Version:
2,2,1,11201
Modules
Images
c:\program files\jipininput\2.2.1.1111\jpmutual.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2440"C:\Users\admin\Downloads\setup_jpxz001.exe" C:\Users\admin\Downloads\setup_jpxz001.exe
explorer.exe
User:
admin
Company:
www.jpwb.net
Integrity Level:
HIGH
Description:
极品输入法
Exit code:
0
Version:
2,2,1,11201
Modules
Images
c:\users\admin\downloads\setup_jpxz001.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
3 084
Read events
2 016
Write events
1 005
Delete events
63

Modification events

(PID) Process:(532) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(532) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(532) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(532) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(532) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(532) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000092000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(532) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{746D5FA9-220A-11EA-AB41-5254004A04AF}
Value:
0
(PID) Process:(532) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Type
Value:
4
(PID) Process:(532) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Count
Value:
2
(PID) Process:(532) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Time
Value:
E3070C0004001300020033001E000000
Executable files
61
Suspicious files
83
Text files
108
Unknown types
11

Dropped files

PID
Process
Filename
Type
532iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFA4B87CB5FF9C7A3F.TMP —
MD5:—
SHA256:—
532iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico —
MD5:—
SHA256:—
532iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
532iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF9503362EC52690DF.TMP —
MD5:—
SHA256:—
532iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{746D5FA9-220A-11EA-AB41-5254004A04AF}.dat —
MD5:—
SHA256:—
2440setup_jpxz001.exeC:\Users\admin\AppData\Local\Temp\my7zData.7z —
MD5:—
SHA256:—
3772iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.datdat
MD5:—
SHA256:—
532iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{746D5FAA-220A-11EA-AB41-5254004A04AF}.datbinary
MD5:—
SHA256:—
3772iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.datdat
MD5:—
SHA256:—
3772iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\JavaDeployReg.logtext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
10
DNS requests
7
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1448
JPWizard.exe
POST
—
180.150.178.118:80
http://dqxb.sgshurufa.com/cell.php?s=GetCell
CN
—
—
unknown
2340
JPMutual.exe
POST
—
180.150.178.118:80
http://tj.sgshurufa.com/server_OnGetInstallSignCode?UID=9c053e2f1102b7b78eac70e340b23e64&QID=jpxz001191219&SoftID=JiPin&IsOld=0&IsWB=0
CN
—
—
unknown
2440
setup_jpxz001.exe
GET
200
120.132.61.186:80
http://tjv1.sgshurufa.com/statistics/timestamp
CN
text
26 b
malicious
3392
JPWizard.exe
POST
—
180.150.178.118:80
http://dqxb.sgshurufa.com/cell.php?s=GetCell
CN
—
—
unknown
3772
iexplore.exe
GET
200
163.171.132.119:80
http://down.shusw.com/jpwb/gf/setup_jpxz001.exe
US
executable
17.2 Mb
suspicious
2340
JPMutual.exe
GET
200
47.89.39.18:80
http://config.jpwb.net/softdata/jipin.dat
HK
binary
446 b
malicious
532
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
2340
JPMutual.exe
POST
—
180.150.178.118:80
http://tj.sgshurufa.com/server_OnGetInstallSignCode?UID=9c053e2f1102b7b78eac70e340b23e64&QID=jpxz001191219&SoftID=JiPin&IsOld=0&IsWB=0
CN
—
—
unknown
292
JPWizard.exe
POST
—
180.150.178.118:80
http://dqxb.sgshurufa.com/cell.php?s=GetCell
CN
—
—
unknown
2340
JPMutual.exe
POST
—
180.150.178.118:80
http://tj.sgshurufa.com/gswb_install_VUlELDljMDUzZTJmMTEwMmI3Yjc4ZWFjNzBlMzQwYjIzZTY0LFFJRCxqcHh6MDAxMTkxMjE5LFNvZnRJRCxKaVBpbixTb2Z0VmVyLDIuMi4xLjAsSXNPbGQsMCxJc1dCLDAsVGltZSwsU2lnbiwsTWFjSUQsOTU5NVBTNTU2TzhSOTMxTk85NTJTTjY5UDAxTzFTUDUsRGlza0lELERaNTU1NTYsQ3B1SUQsNlMzT1NPU1M1NTUwNTFSOA==
CN
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3772
iexplore.exe
163.171.132.119:80
down.shusw.com
—
US
malicious
532
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2440
setup_jpxz001.exe
120.132.61.186:80
tjv1.sgshurufa.com
China Unicom Beijing Province Network
CN
malicious
1448
JPWizard.exe
180.150.178.118:80
dqxb.sgshurufa.com
China Unicom Beijing Province Network
CN
unknown
2340
JPMutual.exe
180.150.178.118:80
dqxb.sgshurufa.com
China Unicom Beijing Province Network
CN
unknown
2340
JPMutual.exe
47.89.39.18:80
config.jpwb.net
Alibaba (China) Technology Co., Ltd.
HK
malicious
292
JPWizard.exe
180.150.178.118:80
dqxb.sgshurufa.com
China Unicom Beijing Province Network
CN
unknown
3392
JPWizard.exe
180.150.178.118:80
dqxb.sgshurufa.com
China Unicom Beijing Province Network
CN
unknown

DNS requests

Domain
IP
Reputation
down.shusw.com
  • 163.171.132.119
suspicious
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
tjv1.sgshurufa.com
  • 120.132.61.186
malicious
downcell.sgshurufa.com
  • —
unknown
dqxb.sgshurufa.com
  • 180.150.178.118
unknown
config.jpwb.net
  • 47.89.39.18
malicious
tj.sgshurufa.com
  • 180.150.178.118
unknown

Threats

PID
Process
Class
Message
3772
iexplore.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2340
JPMutual.exe
Misc activity
ADWARE [PTsecurity] Softcnapp.J PUP
2340
JPMutual.exe
Misc activity
ADWARE [PTsecurity] PUA.Softcnapp payload
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://down.shusw.com/jpwb/gf/setup_jpxz001.exe