| File name: | syzs_200206810.exe |
| Full analysis: | https://app.any.run/tasks/03af7b7c-1630-4cf6-b5de-ce0687d90f59 |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | November 13, 2020, 19:32:43 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | BD6D97C5001CE6DCAE462C90FCAFE157 |
| SHA1: | 51B54C3BEA0A214E595DEB08808E490B64F76212 |
| SHA256: | 34C90F0E74E61BB749313DB697BE63F3C287988D26124768399C69F0A54EAEBE |
| SSDEEP: | 49152:O/J0RFLqksCJ+kIuj6BiMIearBgarOV+yuA4j8k8+S9PQwBiYTmYHnEmJNSrXiwU:O/0NPXvCfkVSbBErpqB |
MALICIOUS
Loads dropped or rewritten executable
- syzs_200206810.exe (PID: 1804)
- QMEmulatorService.exe (PID: 2836)
- AppMarket.exe (PID: 3904)
- TBSWebRenderer.exe (PID: 444)
- GameDownload.exe (PID: 1384)
Adds new firewall rule via NETSH.EXE
- Tinst.exe (PID: 1456)
Application was dropped or rewritten from another process
- QMEmulatorService.exe (PID: 2836)
- AppMarket.exe (PID: 3904)
- syzs_dl_svr.exe (PID: 2132)
- TBSWebRenderer.exe (PID: 444)
- Tinst.exe (PID: 1456)
- GameDownload.exe (PID: 1384)
Actions looks like stealing of personal data
- AppMarket.exe (PID: 3904)
Changes settings of System certificates
- AppMarket.exe (PID: 3904)
Downloads executable files from the Internet
- syzs_200206810.exe (PID: 1804)
SUSPICIOUS
Executable content was dropped or overwritten
- syzs_200206810.exe (PID: 1804)
- Market.exe (PID: 2496)
- Tinst.exe (PID: 1456)
- GameDownload.exe (PID: 1384)
Creates files in the user directory
- syzs_200206810.exe (PID: 1804)
- GameDownload.exe (PID: 1384)
- AppMarket.exe (PID: 3904)
Creates files in the program directory
- QMEmulatorService.exe (PID: 2836)
- syzs_200206810.exe (PID: 1804)
- AppMarket.exe (PID: 3904)
- syzs_dl_svr.exe (PID: 2132)
- Tinst.exe (PID: 1456)
Low-level read access rights to disk partition
- syzs_200206810.exe (PID: 1804)
- QMEmulatorService.exe (PID: 2836)
- AppMarket.exe (PID: 3904)
- GameDownload.exe (PID: 1384)
Executed as Windows Service
- QMEmulatorService.exe (PID: 2836)
Modifies the open verb of a shell class
- Tinst.exe (PID: 1456)
- syzs_200206810.exe (PID: 1804)
Creates a software uninstall entry
- Tinst.exe (PID: 1456)
Uses NETSH.EXE for network configuration
- Tinst.exe (PID: 1456)
Creates files in the Windows directory
- QMEmulatorService.exe (PID: 2836)
Adds / modifies Windows certificates
- AppMarket.exe (PID: 3904)
Reads Internet Cache Settings
- GameDownload.exe (PID: 1384)
INFO
Reads the hosts file
- AppMarket.exe (PID: 3904)
- GameDownload.exe (PID: 1384)
Reads settings of System Certificates
- AppMarket.exe (PID: 3904)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win64 Executable (generic) (18) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (2.9) |
| .exe | | | Generic Win/DOS Executable (1.3) |
| .exe | | | DOS Executable Generic (1.3) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2020:10:29 09:17:49+01:00 |
| PEType: | PE32 |
| LinkerVersion: | 14 |
| CodeSize: | 1879552 |
| InitializedDataSize: | 986112 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x173031 |
| OSVersion: | 5.1 |
| ImageVersion: | - |
| SubsystemVersion: | 5.1 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.1 |
| ProductVersionNumber: | 1.0.0.1 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Windows, Latin1 |
| CompanyName: | Tencent |
| FileDescription: | Tencent Game Downloader |
| FileVersion: | 1, 0, 0, 1 |
| InternalName: | TGBDownloader.exe |
| LegalCopyright: | Copyright ? 2020 Tencent. All Rights Reserved. |
| OriginalFileName: | TGBDownloader.exe |
| ProductName: | Tencent Game Downloader |
| ProductVersion: | 1, 0, 0, 1 |
Summary
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 29-Oct-2020 08:17:49 |
| Detected languages: |
|
| Debug artifacts: |
|
| CompanyName: | Tencent |
| FileDescription: | Tencent Game Downloader |
| FileVersion: | 1, 0, 0, 1 |
| InternalName: | TGBDownloader.exe |
| LegalCopyright: | Copyright ? 2020 Tencent. All Rights Reserved. |
| OriginalFilename: | TGBDownloader.exe |
| ProductName: | Tencent Game Downloader |
| ProductVersion: | 1, 0, 0, 1 |
DOS Header
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0090 |
| Pages in file: | 0x0003 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x0000 |
| Max extra paragraphs: | 0xFFFF |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x00B8 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x0000 |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x00000138 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 8 |
| Time date stamp: | 29-Oct-2020 08:17:49 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
.text | 0x00001000 | 0x001CACBA | 0x001CAE00 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.6928 |
.rdata | 0x001CC000 | 0x00066A18 | 0x00066C00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.43255 |
.data | 0x00233000 | 0x0000ABC4 | 0x00008400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.7602 |
.gfids | 0x0023E000 | 0x00001100 | 0x00001200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 3.96325 |
.tls | 0x00240000 | 0x00000009 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0.0203931 |
.QMGuid | 0x00241000 | 0x00000014 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_WRITE | 0 |
.rsrc | 0x00242000 | 0x00067A20 | 0x00067C00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 7.07374 |
.reloc | 0x002AA000 | 0x00016130 | 0x00016200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 6.59357 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 5.06216 | 651 | UNKNOWN | English - United States | RT_MANIFEST |
7 | 2.32128 | 84 | UNKNOWN | Chinese - PRC | RT_STRING |
107 | 1.98048 | 20 | UNKNOWN | Chinese - PRC | RT_GROUP_ICON |
109 | 3.24529 | 80 | UNKNOWN | Chinese - PRC | RT_MENU |
133 | 7.9864 | 210684 | UNKNOWN | Chinese - PRC | ZIPRES |
134 | 5.10122 | 67646 | UNKNOWN | Chinese - PRC | CUSTOM |
135 | 5.81636 | 76168 | UNKNOWN | Chinese - PRC | CUSTOM |
Imports
ADVAPI32.dll |
COMCTL32.dll |
GDI32.dll |
IMM32.dll |
KERNEL32.dll |
NETAPI32.dll |
PSAPI.DLL |
SHELL32.dll |
SHLWAPI.dll |
USER32.dll |
Exports
Title | Ordinal | Address |
|---|---|---|
??4BeaconClient@@QAEAAV0@$QAV0@@Z | 1 | 0x00049100 |
??4BeaconClient@@QAEAAV0@ABV0@@Z | 2 | 0x00049100 |
?GetCommParamGetter@BeaconClient@@SAABV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$function@$A6A?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ@2@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$function@$A6A?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ@2@@std@@@2@@std@@XZ | 3 | 0x00049C7D |
?GetCommcomParams@BeaconClient@@SAABV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@XZ | 4 | 0x00049C1D |
?GetConfig@BeaconClient@@SAABUBeaconConfig@@XZ | 5 | 0x000498DD |
?InitSDK@BeaconClient@@SAXABUBeaconConfig@@@Z | 6 | 0x0004949B |
?PrepareParams@BeaconClient@@SA?AV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@3@ABV23@_J@Z | 7 | 0x000498E3 |
?Quit@BeaconClient@@SAXXZ | 8 | 0x000495E6 |
?Report@BeaconClient@@SAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@3@W4RequestPriority@Beacon@@@Z | 9 | 0x000497A9 |
?SetCommParamGetter@BeaconClient@@SAXABV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$function@$A6A?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ@2@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$function@$A6A?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ@2@@std@@@2@@std@@@Z | 10 | 0x00049C23 |
Total processes
61
Monitored processes
15
Malicious processes
6
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 444 | "C:\Program Files\TxGameAssistant\AppMarket\TBSWebRenderer.exe" --type=renderer --enable-smooth-scrolling --force-device-scale-factor=1.00 --no-sandbox --enable-begin-frame-scheduling --client-id=TGB_Market --primordial-pipe-token=5FDDBE088A8852BDBEBAA61B996BE269 --user-agent-extra="TGBSdk/3.9.0 Tencent AppMarket/3.10.917.80" --lang=en-US --lang=zh-CN --log-file="C:\Program Files\TxGameAssistant\AppMarket\debug.log" --dummy-exception-handler --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --mojo-channel-token=40D2CD5073E359B87B990DCBE393F2B6 --mojo-application-channel-token=5FDDBE088A8852BDBEBAA61B996BE269 --channel="3904.0.782114440\1695139400" --fix-fasa --mojo-platform-channel-handle=2732 /prefetch:1 | C:\Program Files\TxGameAssistant\AppMarket\TBSWebRenderer.exe | AppMarket.exe | ||||||||||||
User: admin Company: Tencent Integrity Level: HIGH Description: TBSWebRenderer Exit code: 0 Version: 3.10.917.80 Modules
| |||||||||||||||
| 692 | "C:\Windows\system32\Netsh.exe" advfirewall firewall add rule name="TUpdate" dir=in program="c:\program files\txgameassistant\appmarket\GF186\TUpdate.exe" action=allow | C:\Windows\system32\Netsh.exe | — | Tinst.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Network Command Shell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1024 | "C:\Windows\system32\Netsh.exe" advfirewall firewall add rule name="AppMarket" dir=in program="c:\program files\txgameassistant\appmarket\AppMarket.exe" action=allow | C:\Windows\system32\Netsh.exe | — | Tinst.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Network Command Shell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1288 | "C:\Windows\system32\Netsh.exe" advfirewall firewall add rule name="bugreport" dir=in program="c:\program files\txgameassistant\appmarket\bugreport.exe" action=allow | C:\Windows\system32\Netsh.exe | — | Tinst.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Network Command Shell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1384 | "C:\Program Files\TxGameAssistant\AppMarket\GameDownload.exe" -component -noupdate -from appmark -notiywnd 393512 -pkg com.tencent.tmgp.pubgmhd -vdiver aow_71 -downspeedlimit 0 -no_install_vdi -no_install_vdi44 -no_install_vbox -install_aow_rootfs -aeparam -engine aow -aeparamend | C:\Program Files\TxGameAssistant\AppMarket\GameDownload.exe | AppMarket.exe | ||||||||||||
User: admin Company: Tencent Integrity Level: HIGH Description: 腾讯手游助手 - 安装程序 Exit code: 0 Version: 3.10.917.80 Modules
| |||||||||||||||
| 1456 | "C:\Temp\TxGameDownload\Component\AppMarket\c0fec54575b23a0e53f3dc774592dfca\Setup\Tinst.exe" -nodesktopIcon | C:\Temp\TxGameDownload\Component\AppMarket\c0fec54575b23a0e53f3dc774592dfca\Setup\Tinst.exe | syzs_200206810.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: TMarketInst Exit code: 0 Version: 3.10.917.80 Modules
| |||||||||||||||
| 1804 | "C:\Users\admin\AppData\Local\Temp\syzs_200206810.exe" | C:\Users\admin\AppData\Local\Temp\syzs_200206810.exe | explorer.exe | ||||||||||||
User: admin Company: Tencent Integrity Level: HIGH Description: Tencent Game Downloader Exit code: 0 Version: 1, 0, 0, 1 Modules
| |||||||||||||||
| 2132 | "C:\Program Files\TxGameAssistant\AppMarket\DL\syzs_dl_svr.exe" --conf-path="C:\Program Files\TxGameAssistant\AppMarket\DL\syzs_dl_svr.cfg" --daemon --log="C:\Program Files\TxGameAssistant\AppMarket\DL\syzs_dl_svr.log" | C:\Program Files\TxGameAssistant\AppMarket\DL\syzs_dl_svr.exe | AppMarket.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 2412 | "C:\Users\admin\AppData\Local\Temp\syzs_200206810.exe" | C:\Users\admin\AppData\Local\Temp\syzs_200206810.exe | — | explorer.exe | |||||||||||
User: admin Company: Tencent Integrity Level: MEDIUM Description: Tencent Game Downloader Exit code: 3221226540 Version: 1, 0, 0, 1 Modules
| |||||||||||||||
| 2496 | "C:\Temp\TxGameDownload\Component\AppMarket\c0fec54575b23a0e53f3dc774592dfca\Market.exe" | C:\Temp\TxGameDownload\Component\AppMarket\c0fec54575b23a0e53f3dc774592dfca\Market.exe | syzs_200206810.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
Total events
964
Read events
574
Write events
390
Delete events
0
Modification events
| (PID) Process: | (1804) syzs_200206810.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication |
| Operation: | write | Name: | Name |
Value: syzs_200206810.exe | |||
| (PID) Process: | (1804) syzs_200206810.exe | Key: | HKEY_CURRENT_USER\Software\Tencent\MobileGamePC\Beacon |
| Operation: | write | Name: | Last_Sid_syzs_200206810.exe |
Value: 618476F9-ADB1-41EE-A6C7-18A2E446C053 | |||
| (PID) Process: | (1804) syzs_200206810.exe | Key: | HKEY_CURRENT_USER\Software\Tencent\MobileGamePC |
| Operation: | write | Name: | TempPath |
Value: C:\Temp\TxGameDownload\Component\ | |||
| (PID) Process: | (1804) syzs_200206810.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Tencent\MobileGamePC |
| Operation: | write | Name: | SupplyId |
Value: 200206810 | |||
| (PID) Process: | (1804) syzs_200206810.exe | Key: | HKEY_CURRENT_USER\Software\Tencent\MobileGamePC |
| Operation: | write | Name: | UserLanguage |
Value: zh_CN | |||
| (PID) Process: | (1804) syzs_200206810.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (1804) syzs_200206810.exe | Key: | HKEY_CURRENT_USER\Software\Tencent\MobileGamePC\GameDownload |
| Operation: | write | Name: | DownloadSpeed |
Value: 0 | |||
| (PID) Process: | (1804) syzs_200206810.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Tencent\MobileGamePC\AppMarket |
| Operation: | write | Name: | InstallPath |
Value: C:\Program Files\TxGameAssistant\AppMarket | |||
| (PID) Process: | (1804) syzs_200206810.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (1804) syzs_200206810.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
Executable files
234
Suspicious files
135
Text files
2 615
Unknown types
23
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1804 | syzs_200206810.exe | C:\test.tmp | — | |
MD5:— | SHA256:— | |||
| 1804 | syzs_200206810.exe | C:\Temp\TxGameDownload\Component\AppMarket\c0fec54575b23a0e53f3dc774592dfca\Market.exe | — | |
MD5:— | SHA256:— | |||
| 2496 | Market.exe | C:\Temp\TxGameDownload\Component\AppMarket\c0fec54575b23a0e53f3dc774592dfca\Setup\AECommonDll.dll | executable | |
MD5:— | SHA256:— | |||
| 2496 | Market.exe | C:\Temp\TxGameDownload\Component\AppMarket\c0fec54575b23a0e53f3dc774592dfca\Setup\AowGame.xml | text | |
MD5:— | SHA256:— | |||
| 1804 | syzs_200206810.exe | C:\Users\admin\AppData\Roaming\Tencent\DeskUpdate\GlobalMgr.db | text | |
MD5:— | SHA256:— | |||
| 2496 | Market.exe | C:\Temp\TxGameDownload\Component\AppMarket\c0fec54575b23a0e53f3dc774592dfca\Setup\api-ms-win-core-errorhandling-l1-1-0.dll | executable | |
MD5:9D74D89F2679C0C5DDB35A1EF30BD182 | SHA256:E207FFC6FEF144E5D393E79DE75F8F20D223F1AC33A011EEB822D30FA2031046 | |||
| 1804 | syzs_200206810.exe | C:\Users\admin\AppData\Local\Tencent\TxGameAssistant\TGBDownloader\dr.dll | executable | |
MD5:2814ACBD607BA47BDBCDF6AC3076EE95 | SHA256:5904A7E4D97EEAC939662C3638A0E145F64FF3DD0198F895C4BF0337595C6A67 | |||
| 2496 | Market.exe | C:\Temp\TxGameDownload\Component\AppMarket\c0fec54575b23a0e53f3dc774592dfca\Setup\api-ms-win-core-heap-l1-1-0.dll | executable | |
MD5:EE5C2FB7BC23BFD06FF32556CC7C3B4D | SHA256:EFC9F0E32BCE971900DDF66A1A9E68DAA3BFB2099A1BA9F24C6EE82DA2CBD6E8 | |||
| 2496 | Market.exe | C:\Temp\TxGameDownload\Component\AppMarket\c0fec54575b23a0e53f3dc774592dfca\Setup\api-ms-win-core-debug-l1-1-0.dll | executable | |
MD5:64978E199A7239D2C911876447A7F05B | SHA256:92B947F1D6236F86ED7E105CFF19E23C13D1968861426511B775905E1D26B47A | |||
| 2496 | Market.exe | C:\Temp\TxGameDownload\Component\AppMarket\c0fec54575b23a0e53f3dc774592dfca\Setup\api-ms-win-core-file-l2-1-0.dll | executable | |
MD5:B9287EB7BCBFDCEC2E8D4198FD266509 | SHA256:096409422ECD1894E4D6289FD2D1C7490BD83DAFF0C1E3D16C36C78BD477B895 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
20
TCP/UDP connections
254
DNS requests
36
Threats
54
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2132 | syzs_dl_svr.exe | GET | — | 84.53.187.62:80 | http://dldir1.qq.com/syzs/syzs_cms/f1da4b859f0fc29f3e2c8a5dc2b3369d.exe | US | — | — | whitelisted |
2132 | syzs_dl_svr.exe | GET | — | 84.53.187.62:80 | http://dldir1.qq.com/syzs/syzs_cms/121d21f6c0ea14aac4abba3f6b263a0f.exe | US | — | — | whitelisted |
— | — | GET | — | 84.53.187.62:80 | http://dldir1.qq.com/syzs/syzs_cms/121d21f6c0ea14aac4abba3f6b263a0f.exe | US | — | — | whitelisted |
— | — | GET | — | 84.53.187.62:80 | http://dldir1.qq.com/syzs/syzs_cms/121d21f6c0ea14aac4abba3f6b263a0f.exe | US | — | — | whitelisted |
— | — | GET | — | 84.53.187.62:80 | http://dldir1.qq.com/syzs/syzs_cms/121d21f6c0ea14aac4abba3f6b263a0f.exe | US | — | — | whitelisted |
— | — | GET | — | 84.53.187.62:80 | http://dldir1.qq.com/syzs/syzs_cms/121d21f6c0ea14aac4abba3f6b263a0f.exe | US | — | — | whitelisted |
3904 | AppMarket.exe | POST | — | 183.62.104.184:80 | http://masterconn.qq.com/q.cgi | CN | — | — | unknown |
3904 | AppMarket.exe | POST | 200 | 203.205.255.78:8080 | http://wup.imtt.qq.com:8080/?encrypt=17&len=1024&v=3&iv=a01051356ffc4abf&id=a690d5f54b43ca535af266c3180769c7&qbkey=17A760557272EF73904A4F70FF08854AF72E70C189778502C3352737301EE6E9C9EDB94A7DBA3CEC142854A6A940445B8F46580DB8F9C862BA01189D7CC1FDC3840BFA88E8D6A7EE8B0FFEC3903D1473097BFDBA75EC8595C0276FFABB73C510B57957296E70A664E0295E52A0BFA71B07F89078BE3E6484C9CBBB9D667A9429 | CN | bs | 160 b | suspicious |
3904 | AppMarket.exe | POST | 200 | 203.205.239.243:80 | http://masterconn.qq.com/q.cgi | CN | pi3 | 218 b | whitelisted |
3904 | AppMarket.exe | POST | 200 | 203.205.239.243:80 | http://masterconn.qq.com/q.cgi | CN | pi3 | 250 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
1804 | syzs_200206810.exe | 58.251.106.185:443 | master.etl.desktop.qq.com | China Unicom Guangdong IP network | CN | malicious |
1804 | syzs_200206810.exe | 203.205.235.218:8081 | oth.eve.mdt.qq.com | — | CN | unknown |
1804 | syzs_200206810.exe | 88.221.235.156:80 | dldir1.qq.com | Akamai International B.V. | — | malicious |
1804 | syzs_200206810.exe | 203.205.235.145:443 | sy.guanjia.qq.com | — | CN | unknown |
1456 | Tinst.exe | 150.109.206.154:443 | imgcache.qq.com | — | US | suspicious |
2836 | QMEmulatorService.exe | 58.251.106.185:443 | master.etl.desktop.qq.com | China Unicom Guangdong IP network | CN | malicious |
3904 | AppMarket.exe | 203.205.235.218:8081 | oth.eve.mdt.qq.com | — | CN | unknown |
3904 | AppMarket.exe | 58.251.106.185:443 | master.etl.desktop.qq.com | China Unicom Guangdong IP network | CN | malicious |
3904 | AppMarket.exe | 203.205.255.78:8080 | wup.imtt.qq.com | — | CN | suspicious |
3904 | AppMarket.exe | 183.62.104.184:8000 | — | China Telecom (Group) | CN | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
master.etl.desktop.qq.com |
| whitelisted |
oth.eve.mdt.qq.com |
| unknown |
sy.guanjia.qq.com |
| whitelisted |
dldir1.qq.com |
| whitelisted |
imgcache.qq.com |
| whitelisted |
masterconn11.qq.com |
| whitelisted |
wup.imtt.qq.com |
| suspicious |
masterconn.qq.com |
| whitelisted |
masterconn2.qq.com |
| unknown |
qbwup.imtt.qq.com |
| suspicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
1804 | syzs_200206810.exe | Generic Protocol Command Decode | SURICATA TLS error message encountered |
1804 | syzs_200206810.exe | Generic Protocol Command Decode | SURICATA Applayer Detect protocol only one direction |
1804 | syzs_200206810.exe | Generic Protocol Command Decode | SURICATA TLS error message encountered |
1804 | syzs_200206810.exe | Generic Protocol Command Decode | SURICATA TLS error message encountered |
1804 | syzs_200206810.exe | Generic Protocol Command Decode | SURICATA Applayer Detect protocol only one direction |
1804 | syzs_200206810.exe | Generic Protocol Command Decode | SURICATA TLS error message encountered |
1804 | syzs_200206810.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
1804 | syzs_200206810.exe | Generic Protocol Command Decode | SURICATA TLS error message encountered |
1804 | syzs_200206810.exe | Generic Protocol Command Decode | SURICATA Applayer Detect protocol only one direction |
1804 | syzs_200206810.exe | Generic Protocol Command Decode | SURICATA TLS error message encountered |
5 ETPRO signatures available at the full report
Process | Message |
|---|---|
syzs_200206810.exe | Standard VGA Graphics Adapter |
AppMarket.exe | Standard VGA Graphics Adapter |
AppMarket.exe | [1113/193425:INFO:exception_record.cc(518)] [QB]Process ID: 3904 Type: 1
|
AppMarket.exe | [Downloader] DriverType C: = 3 |
AppMarket.exe | [Downloader] DriverType C: = 3 |
TBSWebRenderer.exe | [1113/193426:INFO:exception_record.cc(518)] [QB]Process ID: 444 Type: 2
|
AppMarket.exe | [1113/193428:INFO:http_cache_transaction.cc(72)] IgnoreZeroCacheError: 0
|
AppMarket.exe | [1113/193430:INFO:CONSOLE(1)] "no new version", source: https://imgcache.qq.com/syzs/syzsweb/main.html (1)
|
GameDownload.exe | [Downloader] GetLogicalDrives 4
|
GameDownload.exe | [Downloader] DriverType C: = 3
|