File name:

01621740_3.exe

Full analysis: https://app.any.run/tasks/a3b43c56-6c96-4b85-9476-fd7257e14a6f
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: October 26, 2019, 01:57:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adware
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

158EE8EB74A75167EE353231B553AD5D

SHA1:

13D40BE8581745FF3B20E8380780B0524CE85336

SHA256:

508A39B80D0922B33C34C65EDCA2899BD29E377E21FF871B6DB1061DD71AAB9A

SSDEEP:

393216:hleNOuGa8AgUDg0VpE3xmm8mPsUTm2t+j9vg/MjqJt7c/eR1W:PeNOv36D43xlkU6w+jBGMuJ1csI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads the Task Scheduler COM API

      • 01621740_3.exe (PID: 3736)

    • Connects to CnC server

      • 01621740_3.exe (PID: 2432)
      • 01621740_3.exe (PID: 3736)
      • XYReport.exe (PID: 2188)
      • xymn.exe (PID: 1036)
      • XYReport.exe (PID: 3304)
      • XYReport.exe (PID: 3356)

    • Registers / Runs the DLL via REGSVR32.EXE

      • 01621740_3.exe (PID: 3736)

    • Application was dropped or rewritten from another process

      • xiaoyu.exe (PID: 1800)
      • xiaoyu.exe (PID: 2116)
      • xiaoyu.exe (PID: 1268)
      • XYReport.exe (PID: 2188)
      • skinbox.exe (PID: 4088)
      • skinbox.exe (PID: 2480)
      • remind.exe (PID: 2840)
      • skinbox.exe (PID: 912)
      • skinbox.exe (PID: 2816)
      • remind.exe (PID: 272)
      • skinbox.exe (PID: 3224)
      • remind.exe (PID: 2576)
      • remind.exe (PID: 2096)
      • remind.exe (PID: 3884)
      • colorpicker.exe (PID: 1028)
      • colorpicker.exe (PID: 2412)
      • colorpicker.exe (PID: 3916)
      • colorpicker.exe (PID: 1756)
      • colorpicker.exe (PID: 3696)
      • xymn.exe (PID: 1036)
      • xyurlreport.exe (PID: 2444)
      • xytpopoth.exe (PID: 2868)
      • xytipsxhVV12.exe (PID: 408)
      • xyurlreport.exe (PID: 2520)
      • bqpb.exe (PID: 1504)
      • bqtp.exe (PID: 884)
      • bqtp.exe (PID: 4000)
      • xytipsxytt.exe (PID: 2328)
      • xytipsxytt.exe (PID: 1328)
      • bqtp.exe (PID: 504)
      • bqtp.exe (PID: 2556)
      • XYReport.exe (PID: 3304)
      • skinbox.exe (PID: 1880)
      • remind.exe (PID: 2520)
      • skinbox.exe (PID: 4056)
      • skinbox.exe (PID: 3732)
      • remind.exe (PID: 2712)
      • remind.exe (PID: 284)
      • skinbox.exe (PID: 2708)
      • skinbox.exe (PID: 3096)
      • colorpicker.exe (PID: 2240)
      • remind.exe (PID: 3076)
      • colorpicker.exe (PID: 2604)
      • remind.exe (PID: 1876)
      • colorpicker.exe (PID: 3448)
      • colorpicker.exe (PID: 2932)
      • colorpicker.exe (PID: 2780)
      • XYUpdate.exe (PID: 2600)
      • XYReport.exe (PID: 3356)
      • xyurlreport.exe (PID: 2280)
      • skinbox.exe (PID: 2152)
      • skinbox.exe (PID: 2528)
      • skinbox.exe (PID: 2924)
      • skinbox.exe (PID: 3856)
      • xyurlreport.exe (PID: 3272)
      • skinbox.exe (PID: 1016)
      • remind.exe (PID: 3688)
      • remind.exe (PID: 2856)
      • remind.exe (PID: 3532)
      • colorpicker.exe (PID: 3352)
      • remind.exe (PID: 3136)
      • colorpicker.exe (PID: 3600)
      • remind.exe (PID: 3384)
      • xyurlreport.exe (PID: 3344)
      • xytipsxytt.exe (PID: 4020)
      • colorpicker.exe (PID: 3528)
      • colorpicker.exe (PID: 956)
      • xytipsxytt.exe (PID: 2380)
      • colorpicker.exe (PID: 776)
      • bqtp.exe (PID: 2888)
      • bqtp.exe (PID: 3400)
      • XYReport.exe (PID: 3888)
      • xyurlreport.exe (PID: 1648)
      • xytipsxytt.exe (PID: 2832)
      • xytipsxytt.exe (PID: 1792)
      • xyurlreport.exe (PID: 3456)
      • bqtp.exe (PID: 2080)
      • xytipsxytt.exe (PID: 2916)
      • xytipsxytt.exe (PID: 3388)
      • bqtp.exe (PID: 2648)
      • bqtp.exe (PID: 2368)
      • xytipsxytt.exe (PID: 3764)
      • xytipsxytt.exe (PID: 3984)
      • bqtp.exe (PID: 3864)
      • bqtp.exe (PID: 3256)
      • XYUpdate.exe (PID: 1820)
      • xytipsxytt.exe (PID: 3604)
      • bqtp.exe (PID: 1244)
      • xyurlreport.exe (PID: 3756)
      • xytipsxytt.exe (PID: 3516)
      • bqtp.exe (PID: 1728)
      • bqtp.exe (PID: 3928)
      • xytipsxytt.exe (PID: 184)
      • xytipsxytt.exe (PID: 1536)
      • bqtp.exe (PID: 2428)
      • bqtp.exe (PID: 3028)

    • Loads dropped or rewritten executable

      • xiaoyu.exe (PID: 2116)
      • xiaoyu.exe (PID: 1800)
      • xiaoyu.exe (PID: 1268)
      • regsvr32.exe (PID: 2472)
      • regsvr32.exe (PID: 1948)
      • svchost.exe (PID: 864)
      • explorer.exe (PID: 352)
      • svchost.exe (PID: 1048)
      • xytpopoth.exe (PID: 2868)
      • xytipsxhVV12.exe (PID: 408)
      • XYUpdate.exe (PID: 2600)
      • xytipsxytt.exe (PID: 4020)
      • XYUpdate.exe (PID: 1820)

    • Changes the autorun value in the registry

      • xiaoyu.exe (PID: 2116)

    • Downloads executable files from the Internet

      • skinbox.exe (PID: 4088)
      • skinbox.exe (PID: 2816)
      • remind.exe (PID: 272)
      • remind.exe (PID: 2576)
      • colorpicker.exe (PID: 1756)
      • remind.exe (PID: 2840)
      • colorpicker.exe (PID: 2412)

    • Changes settings of System certificates

      • xytpopoth.exe (PID: 2868)

    • Application was injected by another process

      • xytipsxytt.exe (PID: 2380)

    • Runs injected code in another process

      • remind.exe (PID: 2712)

    • Known privilege escalation attack

      • DllHost.exe (PID: 2472)

  • SUSPICIOUS

    • Application launched itself

      • 01621740_3.exe (PID: 2432)

    • Low-level read access rights to disk partition

      • 01621740_3.exe (PID: 3736)
      • XYReport.exe (PID: 2188)
      • skinbox.exe (PID: 2816)
      • colorpicker.exe (PID: 1028)
      • remind.exe (PID: 2840)
      • remind.exe (PID: 2096)
      • remind.exe (PID: 2576)
      • colorpicker.exe (PID: 1756)
      • colorpicker.exe (PID: 3916)
      • skinbox.exe (PID: 912)
      • xymn.exe (PID: 1036)
      • xyurlreport.exe (PID: 2444)
      • xytpopoth.exe (PID: 2868)
      • xytipsxhVV12.exe (PID: 408)
      • bqpb.exe (PID: 1504)
      • bqtp.exe (PID: 4000)
      • bqtp.exe (PID: 884)
      • bqtp.exe (PID: 2556)
      • XYReport.exe (PID: 3304)
      • bqtp.exe (PID: 504)
      • skinbox.exe (PID: 2708)
      • skinbox.exe (PID: 1880)
      • skinbox.exe (PID: 3096)
      • remind.exe (PID: 2520)
      • skinbox.exe (PID: 3732)
      • skinbox.exe (PID: 4056)
      • remind.exe (PID: 1876)
      • remind.exe (PID: 2712)
      • remind.exe (PID: 3076)
      • XYReport.exe (PID: 3356)
      • remind.exe (PID: 284)
      • colorpicker.exe (PID: 3448)
      • colorpicker.exe (PID: 2240)
      • colorpicker.exe (PID: 2932)
      • colorpicker.exe (PID: 2780)
      • bqtp.exe (PID: 3400)
      • xytipsxytt.exe (PID: 4020)
      • bqtp.exe (PID: 2888)
      • bqtp.exe (PID: 2080)
      • bqtp.exe (PID: 1244)
      • bqtp.exe (PID: 3256)
      • bqtp.exe (PID: 3864)

    • Executable content was dropped or overwritten

      • 01621740_3.exe (PID: 3736)
      • remind.exe (PID: 272)
      • skinbox.exe (PID: 4088)
      • skinbox.exe (PID: 2816)
      • remind.exe (PID: 2576)
      • colorpicker.exe (PID: 1756)
      • remind.exe (PID: 2840)
      • colorpicker.exe (PID: 2412)

    • Creates a software uninstall entry

      • 01621740_3.exe (PID: 3736)

    • Creates files in the user directory

      • 01621740_3.exe (PID: 3736)
      • xiaoyu.exe (PID: 1800)
      • xiaoyu.exe (PID: 2116)
      • remind.exe (PID: 2576)
      • xiaoyu.exe (PID: 1268)
      • colorpicker.exe (PID: 2412)
      • skinbox.exe (PID: 4088)
      • remind.exe (PID: 272)
      • skinbox.exe (PID: 2816)
      • colorpicker.exe (PID: 1028)
      • remind.exe (PID: 2096)
      • colorpicker.exe (PID: 3696)
      • skinbox.exe (PID: 2480)
      • skinbox.exe (PID: 912)
      • colorpicker.exe (PID: 3916)
      • colorpicker.exe (PID: 1756)
      • remind.exe (PID: 3884)
      • remind.exe (PID: 2840)
      • skinbox.exe (PID: 3224)
      • xytpopoth.exe (PID: 2868)
      • xymn.exe (PID: 1036)
      • bqpb.exe (PID: 1504)

    • Creates files in the Windows directory

      • svchost.exe (PID: 864)

    • Creates COM task schedule object

      • regsvr32.exe (PID: 2472)

    • Creates or modifies windows services

      • regsvr32.exe (PID: 1948)

    • Changes IE settings (feature browser emulation)

      • xymn.exe (PID: 1036)
      • xytpopoth.exe (PID: 2868)
      • xytipsxhVV12.exe (PID: 408)
      • bqpb.exe (PID: 1504)
      • xytipsxytt.exe (PID: 4020)

    • Reads the cookies of Google Chrome

      • xyurlreport.exe (PID: 2444)

    • Reads internet explorer settings

      • xytpopoth.exe (PID: 2868)
      • xymn.exe (PID: 1036)
      • xytipsxhVV12.exe (PID: 408)
      • xytipsxytt.exe (PID: 4020)

    • Reads Internet Cache Settings

      • xytipsxhVV12.exe (PID: 408)
      • xytpopoth.exe (PID: 2868)
      • explorer.exe (PID: 352)
      • bqtp.exe (PID: 2888)

    • Adds / modifies Windows certificates

      • xytpopoth.exe (PID: 2868)

    • Executed via COM

      • DllHost.exe (PID: 2472)

  • INFO

    • Reads settings of System Certificates

      • xytpopoth.exe (PID: 2868)
      • xymn.exe (PID: 1036)

    • Dropped object may contain Bitcoin addresses

      • xymn.exe (PID: 1036)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:09:03 08:31:38+02:00
PEType: PE32
LinkerVersion: 14
CodeSize: 1988096
InitializedDataSize: 4833792
UninitializedDataSize: -
EntryPoint: 0xc25c1
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 3.1.0.2
ProductVersionNumber: 3.1.0.2
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Unknown (0)
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: -
CompanyName: 上海展盟网络科技有限公司
FileDescription: 小鱼便签安装程序
InternalName: Install.exe
LegalCopyright: Copyright © 2019 上海展盟网络科技有限公司 All Rights Reserved
OriginalFileName: Install.exe
ProductName: 小鱼便签
CompanyShortName: 上海展盟网络科技有限公司
ProductShortName: 小鱼便签
FileVersion: 3.1.0.2
ProductVersion: 3.1.0.2

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 03-Sep-2019 06:31:38
Detected languages:
  • Chinese - PRC
  • English - United States
TLS Callbacks: 1 callback(s) detected.
Comments: -
CompanyName: 上海展盟网络科技有限公司
FileDescription: 小鱼便签安装程序
InternalName: Install.exe
LegalCopyright: Copyright © 2019 上海展盟网络科技有限公司 All Rights Reserved
OriginalFilename: Install.exe
ProductName: 小鱼便签
CompanyShortName: 上海展盟网络科技有限公司
ProductShortName: 小鱼便签
FileVersion: 3.1.0.2
ProductVersion: 3.1.0.2

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000050

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 8
Time date stamp: 03-Sep-2019 06:31:38
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x001E543B
0x001E5600
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.66242
.rdata
0x001E7000
0x00058FC0
0x00059000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.80186
.data
0x00240000
0x00400C98
0x003E7600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.92233
.gfids
0x00641000
0x000004F4
0x00000600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.49171
.tls
0x00642000
0x00000002
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x00643000
0x00046D54
0x00046E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.01992
.reloc
0x0068A000
0x0001458C
0x00014600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.68344
.ress
0x0069F000
0x007D37D8
0x007D3800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.99983

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.3298
822
Latin 1 / Western European
English - United States
RT_MANIFEST
2
6.3693
9640
Latin 1 / Western European
Chinese - PRC
RT_ICON
3
6.20932
4264
Latin 1 / Western European
Chinese - PRC
RT_ICON
4
6.50074
2440
Latin 1 / Western European
Chinese - PRC
RT_ICON
5
6.14287
1128
Latin 1 / Western European
Chinese - PRC
RT_ICON
107
2.58916
76
Latin 1 / Western European
Chinese - PRC
RT_GROUP_ICON

Imports

ADVAPI32.dll
CRYPT32.dll
GDI32.dll
IMM32.dll
IPHLPAPI.DLL
KERNEL32.dll
MSIMG32.dll
OLEAUT32.dll
SHELL32.dll (delay-loaded)
SHLWAPI.dll

Exports

Title
Ordinal
Address
GetHandleVerifier
1
0x000277E0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
147
Monitored processes
106
Malicious processes
22
Suspicious processes
35

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start 01621740_3.exe 01621740_3.exe regsvr32.exe no specs regsvr32.exe no specs xiaoyu.exe no specs xiaoyu.exe xiaoyu.exe regsvr32.exe no specs regsvr32.exe no specs xyreport.exe svchost.exe svchost.exe explorer.exe skinbox.exe no specs skinbox.exe no specs skinbox.exe skinbox.exe no specs skinbox.exe remind.exe remind.exe remind.exe no specs remind.exe remind.exe no specs colorpicker.exe no specs colorpicker.exe no specs colorpicker.exe no specs colorpicker.exe colorpicker.exe xymn.exe xyurlreport.exe xytpopoth.exe xytipsxhvv12.exe bqpb.exe xyurlreport.exe no specs xytipsxytt.exe no specs xytipsxytt.exe no specs bqtp.exe bqtp.exe no specs bqtp.exe bqtp.exe no specs xyreport.exe skinbox.exe no specs skinbox.exe no specs skinbox.exe no specs skinbox.exe no specs skinbox.exe no specs remind.exe no specs remind.exe no specs remind.exe no specs remind.exe no specs remind.exe no specs colorpicker.exe no specs colorpicker.exe no specs colorpicker.exe no specs colorpicker.exe no specs colorpicker.exe no specs xyreport.exe xyupdate.exe xyurlreport.exe no specs skinbox.exe no specs skinbox.exe no specs skinbox.exe no specs skinbox.exe no specs xyurlreport.exe no specs skinbox.exe no specs remind.exe no specs remind.exe no specs remind.exe no specs remind.exe no specs xyurlreport.exe no specs remind.exe no specs colorpicker.exe no specs colorpicker.exe no specs colorpicker.exe no specs xytipsxytt.exe colorpicker.exe no specs colorpicker.exe no specs xytipsxytt.exe bqtp.exe xyreport.exe no specs bqtp.exe no specs xyurlreport.exe no specs xytipsxytt.exe no specs xyurlreport.exe no specs xytipsxytt.exe no specs bqtp.exe bqtp.exe no specs xyurlreport.exe no specs xytipsxytt.exe no specs xytipsxytt.exe no specs bqtp.exe no specs bqtp.exe no specs xytipsxytt.exe no specs CMSTPLUA no specs xytipsxytt.exe no specs bqtp.exe bqtp.exe no specs xyupdate.exe xytipsxytt.exe no specs xytipsxytt.exe no specs bqtp.exe bqtp.exe no specs xytipsxytt.exe no specs xytipsxytt.exe no specs bqtp.exe bqtp.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
184C:\Users\admin\AppData\Roaming\Xiaoyu\12AB_gwall\xytipsxytt.exe /R0DfCyPgo0HqQFX1QetY/I2/AjSEKJFwVOsoI2eKSzrnupb0AfkTB4Awh6FYqQESdzqfTxJb9JJrHxU8m+hXQJFt2WdgGnVP+YgH2XxZGh63ziEZ/+bSmUjr7MYYPvkHf1lPAsOUuVa/Ok0qbD9ec0wKTC6h6CBKJ1wmP0Ansaf74vlbKGpqCOVEJLceGZLyXa9tUD+bSuW6hw3D1yxldjyejhFRwpf8h61P1gZZR54z65fG1bjsf8u3iB9k5lqMABbzAQTxavOXdO5++rHbSWf19J3O/JP7FO9pmR+Lk7m4zFaxAsjmHQWmXi0cQS/r2UdfLeFr0KAOE+3QcVY/6C2gFZhdX/d2A6mEvJFgL9gJV0GZjGtkvHo2j+o2y8b47g19ahxJi1YcWT7vb2ttw34XDIcQ5U5VmrUMvH/c1ykp4sQr0+kOt/DdNaHIIt0gyaRiWFnc26YdoD07gsIaBEQthgXuCe/94rZoJ52JjHEJrlyrawlsmo+TOCZNwqzIzaLCsl0AyD195ttBtIUI/4bpI7zCfSquTpHf5bV51MJogz5bn08+XbFxfeSU3Twoi9S/vI7oa6WY1VyfKFmHVnhCVFcnTc7fsDM8jvejtWZ8KY=C:\Users\admin\AppData\Roaming\Xiaoyu\12AB_gwall\xytipsxytt.exe—remind.exe
User:
admin
Integrity Level:
MEDIUM
Description:
小贴士
Exit code:
0
Version:
1.0.2.3
Modules
Images
c:\users\admin\appdata\roaming\xiaoyu\12ab_gwall\xytipsxytt.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
272"C:\Users\admin\AppData\Roaming\xiaoyu\remind.exe" -param=eDLeEO7WpbvmB2m0F4X+sXBg0VxBpcbdDN+BHvdMU+SlooOFbdptBzYiF1YCrj0JiBCL829mAx7u+pEishBKDXYAC:\Users\admin\AppData\Roaming\xiaoyu\remind.exe
xiaoyu.exe
User:
admin
Company:
上海展盟网络科技有限公司
Integrity Level:
HIGH
Description:
remind.exe
Exit code:
0
Version:
3.1.0.2
Modules
Images
c:\users\admin\appdata\roaming\xiaoyu\remind.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
284c:\users\admin\appdata\roaming\xiaoyu\remind.exe -param=J0Z6kgD1zknZAicYsqHVd8fzx6Ss2F5TuzzqeMSgKA6YPU6Xt6zXO0MrAQ45ya2aNIjfr2zLkCy2uObLyM0jXJ5b2Jdyc:\users\admin\appdata\roaming\xiaoyu\remind.exe—svchost.exe
User:
admin
Company:
上海展盟网络科技有限公司
Integrity Level:
HIGH
Description:
remind.exe
Exit code:
0
Version:
3.1.0.2
Modules
Images
c:\users\admin\appdata\roaming\xiaoyu\remind.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
352C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\winanr.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
408C:\Users\admin\AppData\Roaming\Xiaoyu\12AB_gwall\xytipsxhVV12.exe +FZR1Q6AnBvHc2OQxCt/WNq5CUgU/fQT6XRamr4m3yUny8UsaIV27lGtPUZ9N96O5h4ULfRrhBUCWQ1Yj+HfHdd6v1fVDPVnUhD60ZnWxDC1NdIo0s/Pb4eVhFjB5ZpH4LL5ymmJA7dG7895VQIyktR3St9rUPol5xXUzhq/MLP0Z0L+ns4tONQw68nT8xM3ish+XoCCghQRjbf95gugOa5Ip3kUyzhQkNgamAg0qzcecIbt/42ZyXhgopfZhmXxizOGEtvjGeU7XIbvOeQnbZcB7eIWIS+XytC+3Vje5geChoBqPVfi4xWHLvMUQACxEQsLwNBcu4ZDx5I/gZAoKwgl+Xu835Ct84k4TdHldxcRO8baxM5hmEIF9oHApYr7Atz4djWlGpO0C7zttYDGQ+JgrO+vIBcm+cLuWxEDFSyRBVqKeXB1JD70JhrK1pNqQiEgNeT+auOSKK2Eq/DWVX0mrpQ8rVxA0xoWwy8SZpdqGLJ8UWLCr+hGoQnYMVR0my15qoMDsxfOuYkBqUcRzbLa0qGWNO4pCUxRwa7HSf2yh09FdXmBEFlz8bOhkgIsANtInFj4BzJYzydaPny64k2BfTrc0aeSHS5BTnvxv86Mod8BPe2oaAAUFm5ehbS1TIyX/zghPTKqNsPgVSR1vPw=C:\Users\admin\AppData\Roaming\Xiaoyu\12AB_gwall\xytipsxhVV12.exe
remind.exe
User:
admin
Integrity Level:
HIGH
Description:
小贴士
Exit code:
0
Version:
1.0.1.8
Modules
Images
c:\users\admin\appdata\roaming\xiaoyu\12ab_gwall\xytipsxhvv12.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
504C:\Users\admin\AppData\Roaming\xiaoyu\bqtp\bqtp.exe UPeAJVxXg7670tmNr7r10nIenB4o5XVfwZN/TDWT03Dcook+uD+9o+Yi/2E5g/OP65iTs49dB7kqykWcckkgUVQZA86udRlSfDhth1jcIY6nleI337Nb+BLNxCbonqcY+QZbndn5IWeSvdsaqc2MFEOlOxQts6kSkovpjVEltYFO/81d2FAhtqlJI/kVpakveAXisiFH/CX9k+Q/UNKssb818UCBL2Xs4Ht5k6cgBHJZFKs5NEzCn0wckD6K+OLYD2Rw2TjY3nLajEmahFSdMk5dKwQ69Sc=C:\Users\admin\AppData\Roaming\xiaoyu\bqtp\bqtp.exe
colorpicker.exe
User:
admin
Integrity Level:
HIGH
Description:
小贴士
Exit code:
0
Version:
1.2.1.8
Modules
Images
c:\users\admin\appdata\roaming\xiaoyu\bqtp\bqtp.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
776"C:\Users\admin\AppData\Roaming\xiaoyu\colorpicker.exe" -param=J0Z6kgD1zknZAicYsqHVd8fzx6Ss2F5TuzzqeMSgKA6YPU6Xt6zXO0MrAQ45ya2aNIjfr2zLkCy2uObLyM0jXJ5b2JdyC:\Users\admin\AppData\Roaming\xiaoyu\colorpicker.exe—explorer.exe
User:
admin
Company:
上海展盟网络科技有限公司
Integrity Level:
MEDIUM
Description:
colorpicker.exe
Exit code:
0
Version:
3.1.0.2
Modules
Images
c:\users\admin\appdata\roaming\xiaoyu\colorpicker.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
864C:\Windows\system32\svchost.exe -k netsvcsC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
884C:\Users\admin\AppData\Roaming\xiaoyu\bqtp\bqtp.exe OoYNkZXxzyIoWp92xuOvk6zVjolvNNEgq1sNr59BO121HZOruKRNtcyRawKZN81zUE99Ljit5VajU8qlrOci04yqzdMrOFng0h/gVdDb/7kJNM3Qg3MSj1P1xOJY66tkd0kNP1xuGc0EoNRIFm+aChm2jzCBCWZhVqfg4eIfQ71SS1c0VCNPxQgQTvM1/IzQ3XhJQ7e2FWN58MuL92QtPydFMM5dVNdgJDkBR31Ryp885vQDKXdBqSv/EVfPE9wJmmmwTzoFlek7+EbWdIv7UovNXQnWYHWAYriNKGqyMQ34C3DUxEqdfQ7yxtm7RP5Toc8vRd2yONnmhQfv/jMwpBGb1b9GhLOrczy1Dl8QvNf+9IJAHT8nUP9A2hcpje6X2Li7+ZLrrjTtLFJcZPQHXMi2J9ZYsG7NaMcD18O5KnFRUTnIrc5ygg==C:\Users\admin\AppData\Roaming\xiaoyu\bqtp\bqtp.exe—remind.exe
User:
admin
Integrity Level:
HIGH
Description:
小贴士
Exit code:
0
Version:
1.2.1.8
Modules
Images
c:\users\admin\appdata\roaming\xiaoyu\bqtp\bqtp.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
912"C:\Users\admin\AppData\Roaming\xiaoyu\skinbox.exe" -param=eDLeEO7WpbvmB2m0F4X+sXBg0VxBpcbdDN+BHvdMU+SlooOFbdptBzYiF1YCrj0JiBCL829mAx7u+pEishBKDXYAC:\Users\admin\AppData\Roaming\xiaoyu\skinbox.exe—xiaoyu.exe
User:
admin
Company:
上海展盟网络科技有限公司
Integrity Level:
HIGH
Description:
skinbox.exe
Exit code:
0
Version:
3.1.0.2
Modules
Images
c:\users\admin\appdata\roaming\xiaoyu\skinbox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
Total events
3 990
Read events
3 172
Write events
751
Delete events
67

Modification events

(PID) Process:(2432) 01621740_3.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2432) 01621740_3.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(864) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1302019708-1500728564-335382590-1000
Operation:writeName:RefCount
Value:
2
(PID) Process:(864) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1302019708-1500728564-335382590-1000
Operation:writeName:RefCount
Value:
1
(PID) Process:(352) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Operation:writeName:P:\Hfref\nqzva\NccQngn\Ybpny\Grzc\01621740_3.rkr
Value:
00000000000000000100000000000000000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BFFFFFFFFF000000000000000000000000
(PID) Process:(352) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Operation:writeName:HRZR_PGYFRFFVBA
Value:
000000003200000038000000DDE11200090000000D000000CC19050033003000380030003400360042003000410046003400410033003900430042000000460032002D0039003300300035002D003600370044004500300042003200380046004300320033007D005C006500780070006C006F007200650072002E006500780065000000740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C0049006E007400650072006E006500740020004500780070006C006F007200650072005C0051007500690063006B0020004C00610075006E00630068005C0055007300650072002000500069006E006E006500000000000034FF01F832FF01D4E3E1013DA94A7600000000FBFFFF7FF8E3E101987880574F8C6244BB6371042380B1090000000001100211FFFFFFFF000000000000000000000000534275066D42750653427506000000000000000000000000080000002E006C00E72F0A77A48EF37600000000AC032E0000002E00E72F0A77B08EF37603005B019604010000002E005B148D23020000006CE4E101B07F0A7744E5E1010000000058005A0044E5E1010200000010E5E101F2700A7791830A771C8FF37611000000B8453100B045310078192F00F8FD580600E500008F148D23B0E4E10182914A7600E5E101B4E4E10127954A7600000000CC90FF01DCE4E101CD944A76CC90FF0188E5E101408CFF01E1944A7600000000408CFF0188E5E101E4E4E101090000000D000000CC19050033003000380030003400360042003000410046003400410033003900430042000000460032002D0039003300300035002D003600370044004500300042003200380046004300320033007D005C006500780070006C006F007200650072002E006500780065000000740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C0049006E007400650072006E006500740020004500780070006C006F007200650072005C0051007500690063006B0020004C00610075006E00630068005C0055007300650072002000500069006E006E006500000000000034FF01F832FF01D4E3E1013DA94A7600000000FBFFFF7FF8E3E101987880574F8C6244BB6371042380B1090000000001100211FFFFFFFF000000000000000000000000534275066D42750653427506000000000000000000000000080000002E006C00E72F0A77A48EF37600000000AC032E0000002E00E72F0A77B08EF37603005B019604010000002E005B148D23020000006CE4E101B07F0A7744E5E1010000000058005A0044E5E1010200000010E5E101F2700A7791830A771C8FF37611000000B8453100B045310078192F00F8FD580600E500008F148D23B0E4E10182914A7600E5E101B4E4E10127954A7600000000CC90FF01DCE4E101CD944A76CC90FF0188E5E101408CFF01E1944A7600000000408CFF0188E5E101E4E4E101090000000D000000CC19050033003000380030003400360042003000410046003400410033003900430042000000460032002D0039003300300035002D003600370044004500300042003200380046004300320033007D005C006500780070006C006F007200650072002E006500780065000000740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C0049006E007400650072006E006500740020004500780070006C006F007200650072005C0051007500690063006B0020004C00610075006E00630068005C0055007300650072002000500069006E006E006500000000000034FF01F832FF01D4E3E1013DA94A7600000000FBFFFF7FF8E3E101987880574F8C6244BB6371042380B1090000000001100211FFFFFFFF000000000000000000000000534275066D42750653427506000000000000000000000000080000002E006C00E72F0A77A48EF37600000000AC032E0000002E00E72F0A77B08EF37603005B019604010000002E005B148D23020000006CE4E101B07F0A7744E5E1010000000058005A0044E5E1010200000010E5E101F2700A7791830A771C8FF37611000000B8453100B045310078192F00F8FD580600E500008F148D23B0E4E10182914A7600E5E101B4E4E10127954A7600000000CC90FF01DCE4E101CD944A76CC90FF0188E5E101408CFF01E1944A7600000000408CFF0188E5E101E4E4E101
(PID) Process:(3736) 01621740_3.exeKey:HKEY_CURRENT_USER\Software\xiaoyu\install
Operation:writeName:FirstInstallTime
Value:
1AA8B35D00000000
(PID) Process:(3736) 01621740_3.exeKey:HKEY_CURRENT_USER\Software\xiaoyu\install
Operation:writeName:InstallCount
Value:
1
(PID) Process:(3736) 01621740_3.exeKey:HKEY_CURRENT_USER\Software\xiaoyu\install
Operation:writeName:InstallDate
Value:
191026
(PID) Process:(3736) 01621740_3.exeKey:HKEY_CURRENT_USER\Software\xiaoyu\install
Operation:writeName:md5
Value:
158EE8EB74A75167EE353231B553AD5D
Executable files
23
Suspicious files
5
Text files
147
Unknown types
36

Dropped files

PID
Process
Filename
Type
373601621740_3.exeC:\Users\admin\AppData\Roaming\xiaoyu\skinbox.exeexecutable
MD5:—
SHA256:—
373601621740_3.exeC:\Users\admin\AppData\Roaming\xiaoyu\XYReport.exeexecutable
MD5:—
SHA256:—
373601621740_3.exeC:\Users\admin\AppData\Roaming\xiaoyu\XYUpdate.exeexecutable
MD5:—
SHA256:—
373601621740_3.exeC:\Users\admin\AppData\Roaming\xiaoyu\vip.exeexecutable
MD5:—
SHA256:—
373601621740_3.exeC:\Users\admin\AppData\Roaming\xiaoyu\remind.exeexecutable
MD5:—
SHA256:—
373601621740_3.exeC:\Users\admin\AppData\Roaming\xiaoyu\colorpicker.exeexecutable
MD5:—
SHA256:—
864svchost.exeC:\Windows\appcompat\programs\RecentFileCache.bcftxt
MD5:—
SHA256:—
373601621740_3.exeC:\Users\admin\AppData\Roaming\xiaoyu\UIFeatureEffect.dllexecutable
MD5:—
SHA256:—
373601621740_3.exeC:\Users\admin\AppData\Roaming\xiaoyu\XYChecker.dllexecutable
MD5:—
SHA256:—
373601621740_3.exeC:\Users\admin\AppData\Roaming\xiaoyu\vip1.jpgimage
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
293
TCP/UDP connections
226
DNS requests
49
Threats
261

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3736
01621740_3.exe
GET
200
42.63.21.227:80
http://down1.xiaoyu.shzhanmeng.com/logo/v1.0.0.2/super.gif
CN
image
783 Kb
malicious
2188
XYReport.exe
GET
200
42.63.21.227:80
http://down1.xiaoyu.shzhanmeng.com/report/queryinfo.xml
CN
xml
4.74 Kb
malicious
352
explorer.exe
GET
200
42.63.21.227:80
http://down1.xiaoyu.shzhanmeng.com/logo/v1.0.0.2/ShellExtStrategyDll32.gif
CN
image
138 Kb
malicious
1268
xiaoyu.exe
GET
200
42.63.21.227:80
http://down1.xiaoyu.shzhanmeng.com/xiaoyu2.json
CN
binary
2.01 Kb
malicious
3736
01621740_3.exe
GET
200
42.63.21.227:80
http://down1.xiaoyu.shzhanmeng.com/logo/v1.0.0.2/t2.gif
CN
image
1.77 Kb
malicious
1268
xiaoyu.exe
GET
200
42.63.21.227:80
http://down1.xiaoyu.shzhanmeng.com/logo/v1.0.0.2/super64.gif
CN
image
875 Kb
malicious
352
explorer.exe
GET
200
106.75.70.48:80
http://kyposition.dftoutiao.com/position/get02
CN
text
66 b
unknown
352
explorer.exe
GET
200
42.63.21.227:80
http://down1.xiaoyu.shzhanmeng.com/xiaoyu2.json
CN
binary
2.01 Kb
malicious
1268
xiaoyu.exe
GET
200
42.63.21.227:80
http://down1.xiaoyu.shzhanmeng.com/logo/v1.0.0.2/u.gif
CN
image
4.84 Kb
malicious
3736
01621740_3.exe
GET
200
42.63.21.227:80
http://down1.xiaoyu.shzhanmeng.com/logo/v1.0.0.2/super.gif.MD5
CN
text
32 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2432
01621740_3.exe
106.75.98.136:80
xynote.shzhanmeng.com
China Unicom Beijing Province Network
CN
malicious
3736
01621740_3.exe
106.75.98.136:80
xynote.shzhanmeng.com
China Unicom Beijing Province Network
CN
malicious
3736
01621740_3.exe
42.63.21.227:80
down1.xiaoyu.shzhanmeng.com
CHINA UNICOM China169 Backbone
CN
malicious
1268
xiaoyu.exe
42.63.21.227:80
down1.xiaoyu.shzhanmeng.com
CHINA UNICOM China169 Backbone
CN
malicious
2188
XYReport.exe
106.75.98.136:80
xynote.shzhanmeng.com
China Unicom Beijing Province Network
CN
malicious
352
explorer.exe
106.75.70.48:80
kyposition.dftoutiao.com
China Unicom Beijing Province Network
CN
unknown
352
explorer.exe
42.63.21.227:80
down1.xiaoyu.shzhanmeng.com
CHINA UNICOM China169 Backbone
CN
malicious
2188
XYReport.exe
42.63.21.227:80
down1.xiaoyu.shzhanmeng.com
CHINA UNICOM China169 Backbone
CN
malicious
1268
xiaoyu.exe
101.206.209.105:80
down1.xiaoyu.shzhanmeng.com
CHINA UNICOM China169 Backbone
CN
unknown
2576
remind.exe
42.63.21.227:80
down1.xiaoyu.shzhanmeng.com
CHINA UNICOM China169 Backbone
CN
malicious

DNS requests

Domain
IP
Reputation
xynote.shzhanmeng.com
  • 106.75.98.136
malicious
down1.xiaoyu.shzhanmeng.com
  • 42.63.21.227
  • 101.206.209.105
  • 113.207.48.203
  • 121.31.30.143
  • 113.200.16.208
  • 42.63.21.200
  • 113.200.16.191
  • 113.59.43.98
  • 58.144.138.37
  • 157.255.134.80
  • 157.255.134.75
malicious
kyposition.dftoutiao.com
  • 106.75.70.48
unknown
skin.xiaoyu.shzhanmeng.com
  • 58.144.138.37
  • 157.255.134.80
  • 157.255.134.75
  • 42.63.21.227
  • 101.206.209.105
  • 113.207.48.203
  • 121.31.30.143
  • 113.200.16.208
  • 42.63.21.200
  • 113.200.16.191
  • 113.59.43.98
malicious
news.7654.com
  • 157.255.134.75
  • 42.63.21.227
  • 101.206.209.105
  • 113.207.48.203
  • 121.31.30.143
  • 113.200.16.208
  • 42.63.21.200
  • 113.200.16.191
  • 113.59.43.98
  • 58.144.138.37
  • 157.255.134.80
unknown
mediav.shzhanmeng.com
  • 106.75.86.225
unknown
screensavers.shzhanmeng.com
  • 42.63.21.227
  • 101.206.209.105
  • 113.207.48.203
  • 121.31.30.143
  • 113.200.16.208
  • 42.63.21.200
  • 113.200.16.191
  • 113.59.43.98
  • 58.144.138.37
  • 157.255.134.80
  • 157.255.134.75
malicious
report.screensavers.shzhanmeng.com
  • 106.75.17.123
  • 117.50.24.84
malicious
static.mediav.com
  • 104.192.110.245
whitelisted
ads.7654.com
  • 157.255.134.80
  • 157.255.134.75
  • 42.63.21.227
  • 101.206.209.105
  • 113.207.48.203
  • 121.31.30.143
  • 113.200.16.208
  • 42.63.21.200
  • 113.200.16.191
  • 113.59.43.98
  • 58.144.138.37
malicious

Threats

PID
Process
Class
Message
2432
01621740_3.exe
Misc activity
ADWARE [PTsecurity] RiskTool.Win32.KuaiZip.pc
2432
01621740_3.exe
Misc activity
ADWARE [PTsecurity] RiskWare[RiskTool]/Win32.KuaiZip
2432
01621740_3.exe
Misc activity
ADWARE [PTsecurity] RiskTool.Win32.KuaiZip.pc
2432
01621740_3.exe
Misc activity
ADWARE [PTsecurity] RiskWare[RiskTool]/Win32.KuaiZip
3736
01621740_3.exe
Misc activity
ADWARE [PTsecurity] RiskTool.Win32.KuaiZip.pc
3736
01621740_3.exe
Misc activity
ADWARE [PTsecurity] RiskWare[RiskTool]/Win32.KuaiZip
3736
01621740_3.exe
Misc activity
ADWARE [PTsecurity] RiskTool.Win32.KuaiZip.pc
3736
01621740_3.exe
Misc activity
ADWARE [PTsecurity] RiskWare[RiskTool]/Win32.KuaiZip
3736
01621740_3.exe
Misc activity
ADWARE [PTsecurity] RiskTool.Win32.KuaiZip.pc
3736
01621740_3.exe
Misc activity
ADWARE [PTsecurity] RiskWare[RiskTool]/Win32.KuaiZip
85 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
01621740_3.exe