| File name: | 3954ed23ba188e657959509fd418273f83f7fa186dbda190d5284b1aa92ebbff.exe |
| Full analysis: | https://app.any.run/tasks/fc3a41c0-9cc3-4683-a3e3-21d33c66e5fa |
| Verdict: | Malicious activity |
| Threats: | Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security. |
| Analysis date: | May 26, 2025, 10:37:03 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections |
| MD5: | E86362323E0678727024C9733C6D277F |
| SHA1: | 0A5BE35C17001EB2035517870E666610D3460A9D |
| SHA256: | 3954ED23BA188E657959509FD418273F83F7FA186DBDA190D5284B1AA92EBBFF |
| SSDEEP: | 49152:EtNJEvEVXgZ2NAzfCCcgXBRM0H7iObMrm3wYFu9826Rebje0w2m:EtLEvyXgZ2SJ3pRbB3k9gRx04 |
MALICIOUS
Executing a file with an untrusted certificate
- 3954ed23ba188e657959509fd418273f83f7fa186dbda190d5284b1aa92ebbff.exe (PID: 8012)
- 3954ed23ba188e657959509fd418273f83f7fa186dbda190d5284b1aa92ebbff.exe (PID: 7500)
QJWMONKEY mutex has been found
- 3954ed23ba188e657959509fd418273f83f7fa186dbda190d5284b1aa92ebbff.exe (PID: 8012)
SUSPICIOUS
Reads security settings of Internet Explorer
- 3954ed23ba188e657959509fd418273f83f7fa186dbda190d5284b1aa92ebbff.exe (PID: 8012)
INFO
Creates files or folders in the user directory
- 3954ed23ba188e657959509fd418273f83f7fa186dbda190d5284b1aa92ebbff.exe (PID: 8012)
Disables trace logs
- 3954ed23ba188e657959509fd418273f83f7fa186dbda190d5284b1aa92ebbff.exe (PID: 8012)
Checks supported languages
- 3954ed23ba188e657959509fd418273f83f7fa186dbda190d5284b1aa92ebbff.exe (PID: 8012)
Reads the computer name
- 3954ed23ba188e657959509fd418273f83f7fa186dbda190d5284b1aa92ebbff.exe (PID: 8012)
The sample compiled with chinese language support
- 3954ed23ba188e657959509fd418273f83f7fa186dbda190d5284b1aa92ebbff.exe (PID: 8012)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win64 Executable (generic) (18) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (2.9) |
| .exe | | | Generic Win/DOS Executable (1.3) |
| .exe | | | DOS Executable Generic (1.3) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2018:02:24 06:57:34+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 12 |
| CodeSize: | 925696 |
| InitializedDataSize: | 353280 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xbd3d0 |
| OSVersion: | 5.1 |
| ImageVersion: | - |
| SubsystemVersion: | 5.1 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 2.2.1.224 |
| ProductVersionNumber: | 2.2.1.224 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Windows NT 32-bit |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| FileDescription: | 智能下载器 |
| FileVersion: | 2.2.1.224 |
| InternalName: | 智能下载器.exe |
| LegalCopyright: | Copyright (C) 2018 |
| OriginalFileName: | 智能下载器.exe |
| ProductName: | 智能下载器.exe |
| ProductVersion: | 2.2.1.224 |
Total processes
134
Monitored processes
3
Malicious processes
1
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 5772 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7500 | "C:\Users\admin\Desktop\3954ed23ba188e657959509fd418273f83f7fa186dbda190d5284b1aa92ebbff.exe" | C:\Users\admin\Desktop\3954ed23ba188e657959509fd418273f83f7fa186dbda190d5284b1aa92ebbff.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: 智能下载器 Exit code: 3221226540 Version: 2.2.1.224 Modules
| |||||||||||||||
| 8012 | "C:\Users\admin\Desktop\3954ed23ba188e657959509fd418273f83f7fa186dbda190d5284b1aa92ebbff.exe" | C:\Users\admin\Desktop\3954ed23ba188e657959509fd418273f83f7fa186dbda190d5284b1aa92ebbff.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: 智能下载器 Exit code: 1 Version: 2.2.1.224 Modules
| |||||||||||||||
Total events
512
Read events
498
Write events
14
Delete events
0
Modification events
| (PID) Process: | (8012) 3954ed23ba188e657959509fd418273f83f7fa186dbda190d5284b1aa92ebbff.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (8012) 3954ed23ba188e657959509fd418273f83f7fa186dbda190d5284b1aa92ebbff.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32 |
| Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
| (PID) Process: | (8012) 3954ed23ba188e657959509fd418273f83f7fa186dbda190d5284b1aa92ebbff.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32 |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (8012) 3954ed23ba188e657959509fd418273f83f7fa186dbda190d5284b1aa92ebbff.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32 |
| Operation: | write | Name: | FileTracingMask |
Value: | |||
| (PID) Process: | (8012) 3954ed23ba188e657959509fd418273f83f7fa186dbda190d5284b1aa92ebbff.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32 |
| Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
| (PID) Process: | (8012) 3954ed23ba188e657959509fd418273f83f7fa186dbda190d5284b1aa92ebbff.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32 |
| Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
| (PID) Process: | (8012) 3954ed23ba188e657959509fd418273f83f7fa186dbda190d5284b1aa92ebbff.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32 |
| Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing | |||
| (PID) Process: | (8012) 3954ed23ba188e657959509fd418273f83f7fa186dbda190d5284b1aa92ebbff.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (8012) 3954ed23ba188e657959509fd418273f83f7fa186dbda190d5284b1aa92ebbff.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS |
| Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
| (PID) Process: | (8012) 3954ed23ba188e657959509fd418273f83f7fa186dbda190d5284b1aa92ebbff.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
Executable files
0
Suspicious files
0
Text files
1
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 8012 | 3954ed23ba188e657959509fd418273f83f7fa186dbda190d5284b1aa92ebbff.exe | C:\Users\admin\AppData\Roaming\GlobalMgr.db | text | |
MD5:09A30B54BE9D82F13D88DC4B96E5804E | SHA256:2930AA9061EAEFF6EB70BFF2B4FAE8B2EE63DC68132A6135BEBE86B5F9CC1B75 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
20
DNS requests
14
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
4880 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
4880 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.216.77.28:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2104 | svchost.exe | 20.73.194.208:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 20.73.194.208:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 23.216.77.28:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
— | — | 23.35.229.160:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2112 | svchost.exe | 20.73.194.208:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
3216 | svchost.exe | 172.211.123.248:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
6544 | svchost.exe | 20.190.160.67:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 2.17.190.73:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
q.pieshua.com |
| malicious |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |