URL:

http://download.bjca.org.cn/download/yzt/BJCAClientV3.8.101.0052.exe

Full analysis: https://app.any.run/tasks/ac1c447e-7311-479d-ad87-27bbdaa53df1
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: November 22, 2023, 16:24:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
SHA1:

4275F12EBE123565CA5E2B27A984812B717B88F7

SHA256:

2ABA202107898C671F3202315A1B94EC1D353E9F60EC9387FE461FC520EF554A

SSDEEP:

3:N1KaKElvs7La4uRKCJfMd6X0C:Ca5v2La1FRZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • BJCAClientV3.8.101.0052.exe (PID: 3712)
      • CertAppEnv_SetupV3.8.101.0052.exe (PID: 3620)
      • BJCAUpdateSetup.exe (PID: 1416)
      • BJCAUpdate.exe (PID: 2396)
      • PubLib_Setup.exe (PID: 2708)

    • Registers / Runs the DLL via REGSVR32.EXE

      • CertAppEnv_SetupV3.8.101.0052.exe (PID: 3620)

    • Creates a writable file in the system directory

      • CertAppEnv_SetupV3.8.101.0052.exe (PID: 3620)

    • The DLL Hijacking

      • regsvr32.exe (PID: 2164)
      • regsvr32.exe (PID: 2088)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • CertAppEnv_SetupV3.8.101.0052.exe (PID: 3620)
      • PubLib_Setup.exe (PID: 2708)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • CertAppEnv_SetupV3.8.101.0052.exe (PID: 3620)
      • PubLib_Setup.exe (PID: 2708)

    • Starts SC.EXE for service management

      • UtilTool.exe (PID: 3704)
      • UtilTool.exe (PID: 3740)
      • UtilTool.exe (PID: 1032)
      • UtilTool.exe (PID: 588)
      • UtilTool.exe (PID: 2376)
      • UtilTool.exe (PID: 2312)
      • UtilTool.exe (PID: 2184)

    • Executes as Windows Service

      • XTXSvrMonitor.exe (PID: 2620)
      • XTXCoreSvr.exe (PID: 2392)
      • XTXCoreSvr.exe (PID: 1248)

    • Adds/modifies Windows certificates

      • CertAppEnv_SetupV3.8.101.0052.exe (PID: 3620)

    • Starts itself from another location

      • BJCAUpdate.exe (PID: 2396)

    • Creates a software uninstall entry

      • CertAppEnv_SetupV3.8.101.0052.exe (PID: 3620)

    • Creates/Modifies COM task schedule object

      • BJCAUpdate.exe (PID: 1004)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 2100)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 2100)

    • Application launched itself

      • XTXCoreSvr.exe (PID: 1248)

    • Reads the Internet Settings

      • BjcaCertAide.exe (PID: 2804)

  • INFO

    • Reads the computer name

      • wmpnscfg.exe (PID: 3412)
      • BJCAClientV3.8.101.0052.exe (PID: 3712)
      • CertAppEnv_SetupV3.8.101.0052.exe (PID: 3620)
      • XTXCoreSvr.exe (PID: 1276)
      • XTXSvrMonitor.exe (PID: 1036)
      • XTXCoreSvr.exe (PID: 2392)
      • XTXSvrMonitor.exe (PID: 2620)
      • XTXSvrMonitor.exe (PID: 2688)
      • BJCAScheduleJob.exe (PID: 2788)
      • BJCAUpdate.exe (PID: 2396)
      • BJCAUpdate.exe (PID: 2412)
      • msiexec.exe (PID: 2100)
      • BJCAUpdate.exe (PID: 1004)
      • PubLib_Setup.exe (PID: 2708)
      • BjcaCertAide.exe (PID: 2804)
      • XTXCoreSvr.exe (PID: 1248)
      • XTXCoreSvr.exe (PID: 3048)

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 3196)
      • iexplore.exe (PID: 3440)

    • Application launched itself

      • iexplore.exe (PID: 3440)
      • iexplore.exe (PID: 1432)
      • iexplore.exe (PID: 3088)

    • Checks supported languages

      • wmpnscfg.exe (PID: 3412)
      • BJCAClientV3.8.101.0052.exe (PID: 3712)
      • CertAppEnv_SetupV3.8.101.0052.exe (PID: 3620)
      • UtilTool.exe (PID: 3740)
      • UtilTool.exe (PID: 2376)
      • UtilTool.exe (PID: 1032)
      • WriteCertAideCfg.exe (PID: 1604)
      • UtilTool.exe (PID: 1272)
      • XTXCoreSvr.exe (PID: 1276)
      • UtilTool.exe (PID: 3704)
      • UtilTool.exe (PID: 2312)
      • UtilTool.exe (PID: 2184)
      • XTXCoreSvr.exe (PID: 2392)
      • XTXSvrMonitor.exe (PID: 1036)
      • XTXSvrMonitor.exe (PID: 2688)
      • XTXSvrMonitor.exe (PID: 2620)
      • SetupHelper.exe (PID: 2528)
      • UtilTool.exe (PID: 588)
      • BJCAUpdate.exe (PID: 2396)
      • BJCAUpdateSetup.exe (PID: 1416)
      • BJCAUpdate.exe (PID: 2412)
      • msiexec.exe (PID: 2100)
      • BJCAScheduleJob.exe (PID: 2788)
      • BJCAUpdate.exe (PID: 1004)
      • PubLib_Setup.exe (PID: 2708)
      • BjcaCertAide.exe (PID: 2804)
      • SetupHelper.exe (PID: 2940)
      • XTXCoreSvr.exe (PID: 1248)
      • logrotater.exe (PID: 2908)
      • logrotater.exe (PID: 3096)
      • logrotater.exe (PID: 3268)
      • XTXCoreSvr.exe (PID: 3048)
      • logrotater.exe (PID: 2500)
      • BjcaCertAide.exe (PID: 3796)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3412)
      • explorer.exe (PID: 3632)
      • BjcaCertAide.exe (PID: 3796)

    • Reads the machine GUID from the registry

      • wmpnscfg.exe (PID: 3412)
      • XTXCoreSvr.exe (PID: 1276)
      • XTXCoreSvr.exe (PID: 2392)
      • BJCAUpdate.exe (PID: 2396)
      • msiexec.exe (PID: 2100)
      • BjcaCertAide.exe (PID: 2804)
      • XTXCoreSvr.exe (PID: 1248)
      • XTXCoreSvr.exe (PID: 3048)

    • The process uses the downloaded file

      • iexplore.exe (PID: 3440)

    • Create files in a temporary directory

      • BJCAClientV3.8.101.0052.exe (PID: 3712)
      • CertAppEnv_SetupV3.8.101.0052.exe (PID: 3620)
      • BJCAUpdateSetup.exe (PID: 1416)
      • PubLib_Setup.exe (PID: 2708)
      • BjcaCertAide.exe (PID: 2804)
      • msiexec.exe (PID: 2100)

    • Creates files in the program directory

      • CertAppEnv_SetupV3.8.101.0052.exe (PID: 3620)
      • WriteCertAideCfg.exe (PID: 1604)
      • BJCAUpdate.exe (PID: 2396)
      • BJCAScheduleJob.exe (PID: 2788)
      • PubLib_Setup.exe (PID: 2708)
      • XTXCoreSvr.exe (PID: 1248)

    • Creates files or folders in the user directory

      • BjcaCertAide.exe (PID: 2804)
      • BjcaCertAide.exe (PID: 3796)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
104
Monitored processes
54
Malicious processes
8
Suspicious processes
1

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe wmpnscfg.exe no specs explorer.exe no specs bjcaclientv3.8.101.0052.exe no specs bjcaclientv3.8.101.0052.exe certappenv_setupv3.8.101.0052.exe no specs utiltool.exe sc.exe no specs utiltool.exe sc.exe no specs utiltool.exe sc.exe no specs utiltool.exe sc.exe no specs writecertaidecfg.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs utiltool.exe xtxcoresvr.exe utiltool.exe sc.exe no specs utiltool.exe sc.exe no specs utiltool.exe sc.exe no specs xtxcoresvr.exe xtxsvrmonitor.exe no specs xtxsvrmonitor.exe no specs xtxsvrmonitor.exe no specs setuphelper.exe no specs bjcaschedulejob.exe no specs bjcaupdatesetup.exe no specs bjcaupdate.exe bjcaupdate.exe msiexec.exe no specs bjcaupdate.exe setuphelper.exe no specs publib_setup.exe no specs bjcacertaide.exe xtxcoresvr.exe logrotater.exe no specs logrotater.exe no specs xtxcoresvr.exe logrotater.exe no specs logrotater.exe no specs bjcacertaide.exe iexplore.exe iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
556"regsvr32" /s "C:\Program Files\BJCAClient\CertAppEnvV3.8.101.0052\Program\XTXSecXV2.dll"C:\Windows\System32\regsvr32.exe—CertAppEnv_SetupV3.8.101.0052.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
588"C:\Program Files\BJCAClient\CertAppEnvV3.8.101.0052\Program\UtilTool.exe" sc config XTXCoreSvr type= interact type= ownC:\Program Files\BJCAClient\CertAppEnvV3.8.101.0052\Program\UtilTool.exe
CertAppEnv_SetupV3.8.101.0052.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\program files\bjcaclient\certappenvv3.8.101.0052\program\utiltool.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
916sc delete XTXSvrMonitor C:\Windows\System32\sc.exe—UtilTool.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1060
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\apphelp.dll
1004"C:\Program Files\BJCA\Update\BJCAUpdate.exe" /regserverC:\Program Files\BJCA\Update\BJCAUpdate.exe
BJCAUpdate.exe
User:
admin
Company:
BJCA.,ltd
Integrity Level:
HIGH
Description:
BJCA Installer
Exit code:
0
Version:
1.3.23.0
Modules
Images
c:\program files\bjca\update\bjcaupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
1032"C:\Program Files\BJCAClient\CertAppEnvV3.8.101.0052\Program\UtilTool.exe" sc delete "XTXCoreSvr"C:\Program Files\BJCAClient\CertAppEnvV3.8.101.0052\Program\UtilTool.exe
CertAppEnv_SetupV3.8.101.0052.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\program files\bjcaclient\certappenvv3.8.101.0052\program\utiltool.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
1036"C:\Program Files\BJCAClient\CertAppEnvV3.8.101.0052\Program\XTXSvrMonitor.exe" -installC:\Program Files\BJCAClient\CertAppEnvV3.8.101.0052\Program\XTXSvrMonitor.exe—CertAppEnv_SetupV3.8.101.0052.exe
User:
admin
Integrity Level:
HIGH
Description:
XTXSvrMonitor
Exit code:
0
Version:
2, 6, 21, 819
Modules
Images
c:\program files\bjcaclient\certappenvv3.8.101.0052\program\xtxsvrmonitor.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
1248"C:\Program Files\BJCAClient\CertAppEnvV3.8.101.0052\Program\XTXCoreSvr.exe" -k runserviceC:\Program Files\BJCAClient\CertAppEnvV3.8.101.0052\Program\XTXCoreSvr.exe
services.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Description:
Plugin for Ajax and Websocket Daemon
Exit code:
0
Version:
3, 6, 823, 129
Modules
Images
c:\program files\bjcaclient\certappenvv3.8.101.0052\program\xtxcoresvr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
1272"C:\Program Files\BJCAClient\CertAppEnvV3.8.101.0052\Program\UtilTool.exe" "C:\Program Files\BJCAClient\CertAppEnvV3.8.101.0052\Program\XTXCoreSvr.exe" -k install -n XTXCoreSvrC:\Program Files\BJCAClient\CertAppEnvV3.8.101.0052\Program\UtilTool.exe
CertAppEnv_SetupV3.8.101.0052.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\program files\bjcaclient\certappenvv3.8.101.0052\program\utiltool.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
1276"C:\Program Files\BJCAClient\CertAppEnvV3.8.101.0052\Program\XTXCoreSvr.exe" -k install -n XTXCoreSvr C:\Program Files\BJCAClient\CertAppEnvV3.8.101.0052\Program\XTXCoreSvr.exe
UtilTool.exe
User:
admin
Integrity Level:
HIGH
Description:
Plugin for Ajax and Websocket Daemon
Exit code:
1
Version:
3, 6, 823, 129
Modules
Images
c:\program files\bjcaclient\certappenvv3.8.101.0052\program\xtxcoresvr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
1348"regsvr32" /s "C:\Program Files\BJCAClient\CertAppEnvV3.8.101.0052\Program\XTXSecX.dll"C:\Windows\System32\regsvr32.exe—CertAppEnv_SetupV3.8.101.0052.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
258 345
Read events
258 021
Write events
297
Delete events
27

Modification events

(PID) Process:(3440) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(3440) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(3440) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(3440) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3440) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3440) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3440) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3440) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000059010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3440) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3440) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
102
Suspicious files
57
Text files
47
Unknown types
0

Dropped files

PID
Process
Filename
Type
3440iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
3440iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:3D21D6A2BB76EB2BECDC807E96487640
SHA256:387D30FA75CD4B4F86F50700ED1FE9891C9C26C620CC7443837622C742CF435E
3440iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:1CAB7BC814A92D41C8D3BD5C9577449D
SHA256:A9826BA2C7389E30F8EE191ED8830004D8E93C056E43AF4421D5A76FAD7C539B
3440iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:0ABDD0AB7568B0940E799CBF403363F4
SHA256:99BC6BE67C8C4E442ABFEA3D79014CDE65177612B0976B8B581B391120F27BEC
3440iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verF09E.tmpxml
MD5:CBD0581678FA40F0EDCBC7C59E0CAD10
SHA256:159BD4343F344A08F6AF3B716B6FA679859C1BD1D7030D26FF5EF0255B86E1D9
3196iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\BJCAClientV3.8.101.0052[1].exeexecutable
MD5:EBE417620B96218D79B4EEE7998E41D7
SHA256:13EC4B4E5BB74C8514C4FE702CC9DD3B937276549147A523C742A13D390A1146
3196iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\BJCAClientV3.8.101.0052.exe.ys4y4gv.partialexecutable
MD5:79A4C1399ED727338EA9DE9FC215E43E
SHA256:30B29B8D69A04F0A4BB5C21A18C1B8993750138B3BD4D9BCD788EE8044496048
3440iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\urlblockindex[1].binbinary
MD5:FA518E3DFAE8CA3A0E495460FD60C791
SHA256:775853600060162C4B4E5F883F9FD5A278E61C471B3EE1826396B6D129499AA7
3440iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\BJCAClientV3.8.101.0052.exe.ys4y4gv.partial:Zone.Identifiertext
MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
3440iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\BJCAClientV3.8.101.0052.exeexecutable
MD5:79A4C1399ED727338EA9DE9FC215E43E
SHA256:30B29B8D69A04F0A4BB5C21A18C1B8993750138B3BD4D9BCD788EE8044496048
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
22
DNS requests
18
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3196
iexplore.exe
GET
200
61.170.77.232:80
http://download.bjca.org.cn/download/yzt/BJCAClientV3.8.101.0052.exe
unknown
executable
22.9 Mb
unknown
3440
iexplore.exe
GET
200
87.248.205.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?884fc2e8cfe94039
unknown
compressed
4.66 Kb
unknown
3440
iexplore.exe
GET
200
87.248.205.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?d3d5aa83afc110f0
unknown
compressed
4.66 Kb
unknown
3440
iexplore.exe
GET
200
87.248.205.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?803fe1dbe68dd6c5
unknown
compressed
4.66 Kb
unknown
3440
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
3440
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D
unknown
binary
471 b
unknown
3440
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
binary
471 b
unknown
3440
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D
unknown
binary
471 b
unknown
1432
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
binary
313 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3196
iexplore.exe
61.170.77.232:80
download.bjca.org.cn
China Telecom Group
CN
unknown
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3440
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
EDGECAST
US
whitelisted
3440
iexplore.exe
87.248.205.0:80
ctldl.windowsupdate.com
LLNW
US
unknown
3440
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3440
iexplore.exe
204.79.197.200:443
ieonline.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
3440
iexplore.exe
23.213.170.81:443
go.microsoft.com
AKAMAI-AS
DE
unknown

DNS requests

Domain
IP
Reputation
download.bjca.org.cn
  • 61.170.77.232
  • 61.170.77.233
  • 61.170.77.230
  • 61.170.77.229
  • 61.170.77.235
  • 61.170.77.236
  • 61.170.77.231
  • 61.170.77.234
unknown
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ctldl.windowsupdate.com
  • 87.248.205.0
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
ieonline.microsoft.com
  • 204.79.197.200
whitelisted
go.microsoft.com
  • 23.213.170.81
whitelisted
www.msn.com
  • 204.79.197.203
whitelisted
www.bjca.org.cn
  • —
unknown
api.bing.com
  • 13.107.5.80
whitelisted

Threats

PID
Process
Class
Message
3196
iexplore.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
Process
Message
UtilTool.exe
sc stop XTXSvrMonitor
UtilTool.exe
sc delete XTXSvrMonitor
UtilTool.exe
sc stop XTXCoreSvr
UtilTool.exe
sc delete XTXCoreSvr
UtilTool.exe
C:\Program Files\BJCAClient\CertAppEnvV3.8.101.0052\Program\XTXCoreSvr.exe -k install -n XTXCoreSvr
XTXCoreSvr.exe
create logfolderPath ...
XTXCoreSvr.exe
GetNamedSecurityInfo Error,errId=0x0
XTXCoreSvr.exe
create logfolderPath ok.
XTXCoreSvr.exe
C:\BJCAROOT\BJCAlog\XTXCoreSvr\
XTXCoreSvr.exe
create folderPawdocsPath ...
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://download.bjca.org.cn/download/yzt/BJCAClientV3.8.101.0052.exe