File name:

XunLeiWebSetup11.1.7.1334dl.exe

Full analysis: https://app.any.run/tasks/3e08d1b3-8b97-4450-801c-a585d57b7360
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: February 04, 2021, 05:11:38
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
adware
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

F3CA5968F3AF27D8E4935FFE210E3A24

SHA1:

1F03D94227853F1367B936A77013B05A04A3FA22

SHA256:

7AB8911947D1F500B7089B9C114256DEA43EE66BE1FC896A2E0E3C3BA3D99DB4

SSDEEP:

98304:Q7OQkBFDRguJlu8wEpFR5rhRNb0cE+SA8tNmef9ycNBg8RCkR5J:Q7OQQl+ze3HRWcfbQAIxf9IKD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • XunLeiWebSetup11.1.7.1334dl.exe (PID: 3744)
      • XunLeiSetup11.1.7.1334.exe (PID: 1468)

    • Application was dropped or rewritten from another process

      • DownloadSDKServer.exe (PID: 4020)
      • DownloadSDKServer.exe (PID: 880)
      • xl_ext_chrome_setup.exe (PID: 3644)
      • BHOInstall.exe (PID: 2756)
      • ThunderBHOPlatform.exe (PID: 3896)
      • Win7AppId.exe (PID: 2636)
      • Win7AppId.exe (PID: 2708)
      • Win7AppId.exe (PID: 1228)
      • InstallXLWFP.exe (PID: 3888)
      • XLWFPSetup.exe (PID: 2280)
      • XLServicePlatform.exe (PID: 3028)
      • InstallXLWFP.exe (PID: 2552)
      • ThunderInstallHelper.exe (PID: 2724)
      • InstallXLGuard.exe (PID: 4040)
      • Thunder.exe (PID: 3424)
      • Thunder.exe (PID: 2160)
      • Thunder.exe (PID: 272)
      • InstallXLGuard.exe (PID: 2172)
      • Thunder.exe (PID: 2624)
      • Thunder.exe (PID: 3852)
      • DownloadSDKServer.exe (PID: 3336)
      • Thunder.exe (PID: 1736)
      • Thunder.exe (PID: 3828)
      • Thunder.exe (PID: 3168)
      • xlbrowsershell.exe (PID: 1936)
      • Thunder.exe (PID: 2152)
      • Thunder.exe (PID: 3492)
      • Thunder.exe (PID: 2968)
      • Thunder.exe (PID: 3416)
      • Thunder.exe (PID: 3048)
      • Thunder.exe (PID: 1880)
      • Thunder.exe (PID: 3280)
      • xlbrowsershell.exe (PID: 4632)
      • XLLiveUD.exe (PID: 5880)
      • XLLiveUD.exe (PID: 4364)

    • Loads dropped or rewritten executable

      • XunLeiWebSetup11.1.7.1334dl.exe (PID: 3744)
      • XunLeiSetup11.1.7.1334.exe (PID: 1468)
      • DownloadSDKServer.exe (PID: 880)
      • regsvr32.exe (PID: 2804)
      • regsvr32.exe (PID: 1760)
      • svchost.exe (PID: 2668)
      • XLWFPSetup.exe (PID: 2280)
      • regsvr32.exe (PID: 2656)
      • ThunderBHOPlatform.exe (PID: 3896)
      • BHOInstall.exe (PID: 2756)
      • regsvr32.exe (PID: 3964)
      • Thunder.exe (PID: 3424)
      • Thunder.exe (PID: 2160)
      • Thunder.exe (PID: 272)
      • Thunder.exe (PID: 3828)
      • Thunder.exe (PID: 2624)
      • Thunder.exe (PID: 3852)
      • Thunder.exe (PID: 1736)
      • DownloadSDKServer.exe (PID: 3336)
      • Thunder.exe (PID: 3416)
      • Thunder.exe (PID: 3492)
      • Thunder.exe (PID: 3168)
      • Thunder.exe (PID: 2152)
      • xlbrowsershell.exe (PID: 1936)
      • Thunder.exe (PID: 3048)
      • Thunder.exe (PID: 3280)
      • Thunder.exe (PID: 1880)
      • xlbrowsershell.exe (PID: 4632)
      • Thunder.exe (PID: 2968)

    • Registers / Runs the DLL via REGSVR32.EXE

      • XunLeiSetup11.1.7.1334.exe (PID: 1468)
      • ThunderBHOPlatform.exe (PID: 3896)

    • Creates or modifies windows services

      • XLServicePlatform.exe (PID: 3028)

    • Changes the autorun value in the registry

      • XunLeiSetup11.1.7.1334.exe (PID: 1468)

    • Changes settings of System certificates

      • Thunder.exe (PID: 2160)
      • svchost.exe (PID: 2668)

    • Actions looks like stealing of personal data

      • Thunder.exe (PID: 272)
      • Thunder.exe (PID: 1880)

  • SUSPICIOUS

    • Drops a file with a compile date too recent

      • XunLeiWebSetup11.1.7.1334dl.exe (PID: 3744)
      • XunLeiSetup11.1.7.1334.exe (PID: 1468)
      • DownloadSDKServer.exe (PID: 3336)

    • Executable content was dropped or overwritten

      • XunLeiWebSetup11.1.7.1334dl.exe (PID: 3744)
      • DownloadSDKServer.exe (PID: 880)
      • XLServicePlatform.exe (PID: 3028)
      • XunLeiSetup11.1.7.1334.exe (PID: 1468)
      • XLWFPSetup.exe (PID: 2280)
      • xl_ext_chrome_setup.exe (PID: 3644)
      • regsvr32.exe (PID: 1760)
      • regsvr32.exe (PID: 2804)
      • regsvr32.exe (PID: 2656)
      • ThunderBHOPlatform.exe (PID: 3896)
      • svchost.exe (PID: 2668)
      • XLLiveUD.exe (PID: 5880)

    • Drops a file with too old compile date

      • XunLeiWebSetup11.1.7.1334dl.exe (PID: 3744)
      • XunLeiSetup11.1.7.1334.exe (PID: 1468)
      • DownloadSDKServer.exe (PID: 880)
      • XLServicePlatform.exe (PID: 3028)
      • XLWFPSetup.exe (PID: 2280)
      • xl_ext_chrome_setup.exe (PID: 3644)
      • ThunderBHOPlatform.exe (PID: 3896)

    • Drops a file that was compiled in debug mode

      • XunLeiWebSetup11.1.7.1334dl.exe (PID: 3744)
      • XLServicePlatform.exe (PID: 3028)
      • XunLeiSetup11.1.7.1334.exe (PID: 1468)
      • regsvr32.exe (PID: 1760)
      • regsvr32.exe (PID: 2804)
      • regsvr32.exe (PID: 2656)
      • XLWFPSetup.exe (PID: 2280)
      • ThunderBHOPlatform.exe (PID: 3896)
      • xl_ext_chrome_setup.exe (PID: 3644)
      • svchost.exe (PID: 2668)
      • XLLiveUD.exe (PID: 5880)

    • Creates files in the program directory

      • XunLeiWebSetup11.1.7.1334dl.exe (PID: 3744)
      • XLServicePlatform.exe (PID: 3028)
      • regsvr32.exe (PID: 2804)
      • regsvr32.exe (PID: 1760)
      • xl_ext_chrome_setup.exe (PID: 3644)
      • regsvr32.exe (PID: 2656)
      • XLWFPSetup.exe (PID: 2280)
      • XunLeiSetup11.1.7.1334.exe (PID: 1468)
      • ThunderBHOPlatform.exe (PID: 3896)
      • Thunder.exe (PID: 3424)
      • Thunder.exe (PID: 272)
      • xlbrowsershell.exe (PID: 1936)
      • svchost.exe (PID: 2668)
      • DownloadSDKServer.exe (PID: 3336)

    • Uses NETSH.EXE for network configuration

      • XunLeiWebSetup11.1.7.1334dl.exe (PID: 3744)
      • XunLeiSetup11.1.7.1334.exe (PID: 1468)
      • ThunderInstallHelper.exe (PID: 2724)

    • Low-level read access rights to disk partition

      • XunLeiWebSetup11.1.7.1334dl.exe (PID: 3744)
      • DownloadSDKServer.exe (PID: 4020)
      • XunLeiSetup11.1.7.1334.exe (PID: 1468)
      • DownloadSDKServer.exe (PID: 880)
      • XLServicePlatform.exe (PID: 3028)
      • svchost.exe (PID: 2668)
      • InstallXLWFP.exe (PID: 3888)
      • BHOInstall.exe (PID: 2756)
      • InstallXLWFP.exe (PID: 2552)
      • InstallXLGuard.exe (PID: 4040)
      • Thunder.exe (PID: 3424)
      • Thunder.exe (PID: 2160)
      • InstallXLGuard.exe (PID: 2172)
      • Thunder.exe (PID: 272)
      • Thunder.exe (PID: 2624)
      • Thunder.exe (PID: 3828)
      • Thunder.exe (PID: 3852)
      • DownloadSDKServer.exe (PID: 3336)
      • Thunder.exe (PID: 2152)
      • Thunder.exe (PID: 3168)
      • Thunder.exe (PID: 3416)
      • Thunder.exe (PID: 3492)
      • Thunder.exe (PID: 1736)
      • Thunder.exe (PID: 3280)
      • Thunder.exe (PID: 3048)
      • XLLiveUD.exe (PID: 5880)

    • Reads CPU info

      • DownloadSDKServer.exe (PID: 4020)
      • DownloadSDKServer.exe (PID: 880)
      • DownloadSDKServer.exe (PID: 3336)

    • Creates files in the user directory

      • XunLeiSetup11.1.7.1334.exe (PID: 1468)
      • Thunder.exe (PID: 3424)
      • Thunder.exe (PID: 2160)

    • Creates a software uninstall entry

      • XunLeiSetup11.1.7.1334.exe (PID: 1468)

    • Changes default file association

      • XunLeiSetup11.1.7.1334.exe (PID: 1468)
      • regsvr32.exe (PID: 1760)
      • Thunder.exe (PID: 272)

    • Creates a directory in Program Files

      • XunLeiSetup11.1.7.1334.exe (PID: 1468)
      • regsvr32.exe (PID: 2804)
      • xl_ext_chrome_setup.exe (PID: 3644)
      • ThunderBHOPlatform.exe (PID: 3896)
      • XLWFPSetup.exe (PID: 2280)
      • Thunder.exe (PID: 272)
      • xlbrowsershell.exe (PID: 1936)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 1760)
      • regsvr32.exe (PID: 2804)
      • regsvr32.exe (PID: 2656)
      • regsvr32.exe (PID: 3964)

    • Creates files in the Windows directory

      • XLWFPSetup.exe (PID: 2280)
      • svchost.exe (PID: 2668)

    • Creates files in the driver directory

      • XLWFPSetup.exe (PID: 2280)

    • Removes files from Windows directory

      • svchost.exe (PID: 2668)

    • Application launched itself

      • Thunder.exe (PID: 3424)
      • Thunder.exe (PID: 272)
      • xlbrowsershell.exe (PID: 1936)

    • Adds / modifies Windows certificates

      • Thunder.exe (PID: 2160)
      • svchost.exe (PID: 2668)

    • Starts itself from another location

      • XLLiveUD.exe (PID: 5880)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • XunLeiWebSetup11.1.7.1334dl.exe (PID: 3744)
      • XunLeiSetup11.1.7.1334.exe (PID: 1468)

    • Reads the hosts file

      • Thunder.exe (PID: 3424)
      • Thunder.exe (PID: 2160)
      • xlbrowsershell.exe (PID: 1936)

    • Reads settings of System Certificates

      • Thunder.exe (PID: 2160)
      • svchost.exe (PID: 2668)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:01:21 15:01:32+01:00
PEType: PE32
LinkerVersion: 14.27
CodeSize: 265216
InitializedDataSize: 4902400
UninitializedDataSize: -
EntryPoint: 0x1ff69
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 11.1.7.1334
ProductVersionNumber: 11.1.7.1334
FileFlagsMask: 0x003f
FileFlags: Special build
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: 深圳市迅雷网络技术有限公司
FileDescription: 安装迅雷 开始极速下载！
FileVersion: 11,1,7,1334
InternalName: XunLeiWebSetup10.1.38.884.exe
LegalCopyright: 版权所有 (C) 2020 深圳市迅雷网络技术有限公司
LegalTrademarks: 迅雷X
OriginalFileName: XunLeiWebSetup10.1.38.884.exe
ProductName: 迅雷X
ProductVersion: 11.1.7.1334
SpecialBuild: 100023

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 21-Jan-2021 14:01:32
Detected languages:
  • Chinese - PRC
  • English - United States
Debug artifacts:
  • D:\thunder11\trunk\build\setup\pdb\Release\OnlineInstall.pdb
CompanyName: 深圳市迅雷网络技术有限公司
FileDescription: 安装迅雷 开始极速下载！
FileVersion: 11,1,7,1334
InternalName: XunLeiWebSetup10.1.38.884.exe
LegalCopyright: 版权所有 (C) 2020 深圳市迅雷网络技术有限公司
LegalTrademarks: 迅雷X
OriginalFilename: XunLeiWebSetup10.1.38.884.exe
ProductName: 迅雷X
ProductVersion: 11.1.7.1334
SpecialBuild: 100023

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000100

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 21-Jan-2021 14:01:32
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00040A47
0x00040C00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.57737
.rdata
0x00042000
0x00013CEE
0x00013E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.25503
.data
0x00056000
0x000044C0
0x00001200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.50318
.rsrc
0x0005B000
0x00494EA4
0x00495000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.96604
.reloc
0x004F0000
0x00002D58
0x00002E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.58921

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.18951
2247
Latin 1 / Western European
English - United States
RT_MANIFEST
2
1.84908
67624
Latin 1 / Western European
Chinese - PRC
RT_ICON
3
1.89825
38056
Latin 1 / Western European
Chinese - PRC
RT_ICON
4
2.51045
16936
Latin 1 / Western European
Chinese - PRC
RT_ICON
5
2.73288
9640
Latin 1 / Western European
Chinese - PRC
RT_ICON
6
2.90901
6760
Latin 1 / Western European
Chinese - PRC
RT_ICON
7
2.1901
84
Latin 1 / Western European
Chinese - PRC
RT_STRING
8
2.66653
2440
Latin 1 / Western European
Chinese - PRC
RT_ICON
9
2.88922
1128
Latin 1 / Western European
Chinese - PRC
RT_ICON
106
1.79879
16
Latin 1 / Western European
Chinese - PRC
RT_ACCELERATOR

Imports

ADVAPI32.dll
IPHLPAPI.DLL
KERNEL32.dll
OLEAUT32.dll
SHELL32.dll
SHLWAPI.dll
USER32.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
116
Monitored processes
60
Malicious processes
28
Suspicious processes
6

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start xunleiwebsetup11.1.7.1334dl.exe netsh.exe no specs downloadsdkserver.exe xunleisetup11.1.7.1334.exe netsh.exe no specs netsh.exe no specs downloadsdkserver.exe win7appid.exe no specs xlserviceplatform.exe win7appid.exe no specs xlwfpsetup.exe win7appid.exe no specs bhoinstall.exe thunderbhoplatform.exe regsvr32.exe no specs regsvr32.exe regsvr32.exe regsvr32.exe no specs regsvr32.exe no specs xl_ext_chrome_setup.exe netsh.exe no specs netsh.exe no specs regsvr32.exe netsh.exe no specs svchost.exe installxlwfp.exe regsvr32.exe netsh.exe no specs netsh.exe no specs installxlwfp.exe netsh.exe no specs thunderinstallhelper.exe no specs netsh.exe no specs installxlguard.exe netsh.exe no specs thunder.exe netsh.exe no specs netsh.exe no specs thunder.exe thunder.exe installxlguard.exe netsh.exe no specs downloadsdkserver.exe thunder.exe thunder.exe thunder.exe thunder.exe no specs thunder.exe no specs xlbrowsershell.exe no specs thunder.exe no specs thunder.exe no specs thunder.exe thunder.exe no specs thunder.exe no specs thunder.exe thunder.exe no specs xlbrowsershell.exe no specs xlliveud.exe xlliveud.exe no specs xunleiwebsetup11.1.7.1334dl.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
272"C:\Program Files\Thunder Network\Thunder\Program\Thunder.exe" --type=renderer --no-sandbox --field-trial-handle=1792,5511923097104562222,17672961223584341068,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --disable-gpu-compositing --lang=en-US --app-user-model-id="C:\Program Files\Thunder Network\Thunder\Program\Thunder.exe" --app-path="C:\Program Files\Thunder Network\Thunder\Program\resources\app" --node-integration --webview-tag --no-sandbox --no-zygote --preload="C:\Program Files\Thunder Network\Thunder\Program\resources\app/out/common-preload.js" --enable-remote-module --background-color=#FFF --enable-websql --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=1988 /prefetch:1C:\Program Files\Thunder Network\Thunder\Program\Thunder.exe
Thunder.exe
User:
admin
Company:
深圳市迅雷网络技术有限公司
Integrity Level:
HIGH
Description:
迅雷11
Exit code:
0
Version:
11,1,7,1334
Modules
Images
c:\program files\thunder network\thunder\program\thunder.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
688"C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="DownloadSDKServer" dir=in program="C:\Users\admin\AppData\Local\Temp\ThunderInstall\11.1.7.1334\SDK\DownloadSDKServer.exe"C:\Windows\system32\netsh.exe—XunLeiSetup11.1.7.1334.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
880"C:\Users\admin\AppData\Local\Temp\ThunderInstall\11.1.7.1334\SDK\DownloadSDKServer.exe" BDAF7A63-568C-43ab-9406-D145CF03B08C:1468C:\Users\admin\AppData\Local\Temp\ThunderInstall\11.1.7.1334\SDK\DownloadSDKServer.exe
XunLeiSetup11.1.7.1334.exe
User:
admin
Company:
ShenZhen Xunlei Networking Technologies,LTD
Integrity Level:
HIGH
Description:
迅雷下载引擎
Exit code:
0
Version:
2.85.110.15
Modules
Images
c:\users\admin\appdata\local\temp\thunderinstall\11.1.7.1334\sdk\downloadsdkserver.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1188regsvr32 /s "C:\Program Files\Thunder Network\Thunder\BHO\ThunderAgent64.dll"C:\Windows\system32\regsvr32.exe—XunLeiSetup11.1.7.1334.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
3
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1228"C:\Program Files\Thunder Network\Thunder\Program\Win7AppId.exe" "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\迅雷软件\迅雷\迅雷.lnk" "C:\Program Files\Thunder Network\Thunder\Program\Thunder.exe"C:\Program Files\Thunder Network\Thunder\Program\Win7AppId.exe—XunLeiSetup11.1.7.1334.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\thunder network\thunder\program\win7appid.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1468"C:\Users\admin\AppData\Local\Temp\OnlineInstall\11.1.7.1334\XunLeiSetup11.1.7.1334.exe" /Silent /InstallPath:"C:\Program Files\Thunder Network\Thunder" /ChannelId:100023 /AutoRunC:\Users\admin\AppData\Local\Temp\OnlineInstall\11.1.7.1334\XunLeiSetup11.1.7.1334.exe
XunLeiWebSetup11.1.7.1334dl.exe
User:
admin
Company:
ShenZhen Xunlei Networking Technologies,LTD
Integrity Level:
HIGH
Description:
XunLeiSetup11.1.7.1334xl
Exit code:
0
Version:
11.1.7.1334
Modules
Images
c:\users\admin\appdata\local\temp\onlineinstall\11.1.7.1334\xunleisetup11.1.7.1334.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
1492"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="DownloadSDKServer" dir=in action=allow program="C:\Program Files\Thunder Network\Thunder\Program\resources\bin\SDK\DownloadSDKServer.exe" C:\Windows\system32\netsh.exe—XunLeiSetup11.1.7.1334.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1676netsh advfirewall firewall add rule name="DownloadSDKServer" dir=in action=allow program=C:\Users\admin\AppData\Local\Temp\OnlineInstall\11.1.7.1334\SDK\DownloadSDKServer.exe enable=yesC:\Windows\system32\netsh.exe—XunLeiWebSetup11.1.7.1334dl.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1736"C:\Program Files\Thunder Network\Thunder\Program\Thunder.exe" "C:/Program Files/Thunder Network/Thunder/Program/resources/app/out/plugin-boot.js" --type=xdas-plugin-process "--xdas-plugin-config=C:/Program Files/Thunder Network/Thunder/Program/resources/app/plugins/ThunderPanPlugin/config.json" --xdas-plugin-name=ThunderPanPluginC:\Program Files\Thunder Network\Thunder\Program\Thunder.exe—Thunder.exe
User:
admin
Company:
深圳市迅雷网络技术有限公司
Integrity Level:
HIGH
Description:
迅雷11
Exit code:
0
Version:
11,1,7,1334
Modules
Images
c:\program files\thunder network\thunder\program\thunder.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1760regsvr32 /s "C:\Program Files\Thunder Network\Thunder\BHO\ThunderMyComputerIcon.dll"C:\Windows\system32\regsvr32.exe
XunLeiSetup11.1.7.1334.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
4 069
Read events
2 482
Write events
1 574
Delete events
13

Modification events

(PID) Process:(3744) XunLeiWebSetup11.1.7.1334dl.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted
Operation:writeName:C:\Users\admin\AppData\Local\Temp\XunLeiWebSetup11.1.7.1334dl.exe
Value:
1
(PID) Process:(3744) XunLeiWebSetup11.1.7.1334dl.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3744) XunLeiWebSetup11.1.7.1334dl.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000A5000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(3744) XunLeiWebSetup11.1.7.1334dl.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3744) XunLeiWebSetup11.1.7.1334dl.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3744) XunLeiWebSetup11.1.7.1334dl.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3744) XunLeiWebSetup11.1.7.1334dl.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3744) XunLeiWebSetup11.1.7.1334dl.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1676) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1676) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:@%SystemRoot%\system32\dhcpqec.dll,-100
Value:
DHCP Quarantine Enforcement Client
Executable files
284
Suspicious files
48
Text files
909
Unknown types
152

Dropped files

PID
Process
Filename
Type
3744XunLeiWebSetup11.1.7.1334dl.exeC:\Users\admin\AppData\Local\Temp\OnlineInstall\11.1.7.1334\OnlineResource.7zcompressed
MD5:—
SHA256:—
3744XunLeiWebSetup11.1.7.1334dl.exeC:\Users\admin\AppData\Local\Temp\OnlineInstall\11.1.7.1334\OnlineResource\MainWnd.xmlxml
MD5:—
SHA256:—
3744XunLeiWebSetup11.1.7.1334dl.exeC:\Users\admin\AppData\Local\Temp\OnlineInstall\11.1.7.1334\OnlineResource\resource\check@250.pngimage
MD5:AC6FC14C73578E87C1771EBF22DCECC7
SHA256:29C7D7B8DE8BCA4B2C4DE68335694251F7AD2D3797C2A0BBBC6BD2F14E0DC0A2
3744XunLeiWebSetup11.1.7.1334dl.exeC:\Users\admin\AppData\Local\Temp\OnlineInstall\11.1.7.1334\OnlineResource\resource\cancel_btn@250.pngimage
MD5:79DDC83EA2FE545D31DEBB09C3E40282
SHA256:6CECADB7948A62AE1DC8E450209938B7904F6743A7DBC5C7968DB60C95E14FB2
3744XunLeiWebSetup11.1.7.1334dl.exeC:\Users\admin\AppData\Local\Temp\OnlineInstall\11.1.7.1334\OnlineResource\resource\download_btn@250.pngimage
MD5:8DF00AD52E2964CF24843502B66D15C2
SHA256:0880A80A3A8E89092DCC65BFF5BF63A044C3A8763F543ADEA5BF3F027A125716
3744XunLeiWebSetup11.1.7.1334dl.exeC:\Users\admin\AppData\Local\Temp\OnlineInstall\11.1.7.1334\OnlineResource\resource\install_bkg.pngimage
MD5:67C2EA3E241772B1948E647BD5E8C891
SHA256:46CF534ED72C7AA774EC09FD79CF5995E71B9A590CE85DC61366E9CA2753AAA5
3744XunLeiWebSetup11.1.7.1334dl.exeC:\Users\admin\AppData\Local\Temp\OnlineInstall\11.1.7.1334\OnlineResource\resource\install_static_bkg1@250.pngimage
MD5:2C1F732CFBDF56420DD987754DD4847F
SHA256:31B2E9B4E962DED0734DE30A4277D33F178C1EB519ECCA86F8333D08567BE53A
3744XunLeiWebSetup11.1.7.1334dl.exeC:\Users\admin\AppData\Local\Temp\OnlineInstall\11.1.7.1334\OnlineResource\resource\confirm_btn@250.pngimage
MD5:5126E81BABA698D9C91D4C60BFACC1E3
SHA256:B4240170D66C84CF0207DF23032CE33B16C8172122F212D32900B37FF4F7E476
3744XunLeiWebSetup11.1.7.1334dl.exeC:\Users\admin\AppData\Local\Temp\OnlineInstall\11.1.7.1334\OnlineResource\resource\install_btn@250.pngimage
MD5:8DF00AD52E2964CF24843502B66D15C2
SHA256:0880A80A3A8E89092DCC65BFF5BF63A044C3A8763F543ADEA5BF3F027A125716
3744XunLeiWebSetup11.1.7.1334dl.exeC:\Users\admin\AppData\Local\Temp\OnlineInstall\11.1.7.1334\OnlineResource\resource\close_btn@250.pngimage
MD5:F350F4BB9CEA348BC42EAFDFD7F52182
SHA256:3885706DB8C031D804E7EEB87EC8A3826DBB407A103CE15B347BF33AE41F5C52
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
484
TCP/UDP connections
659
DNS requests
461
Threats
129

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3744
XunLeiWebSetup11.1.7.1334dl.exe
GET
—
117.27.140.211:80
http://static-xl9-ssl.xunlei.com/json/thunderx_install_slider_config_11.1.7.json
CN
—
—
suspicious
4020
DownloadSDKServer.exe
GET
—
61.130.21.134:80
http://down.sandai.net/thunder11/XunLeiSetup11.1.7.1334.exe
CN
—
—
suspicious
4020
DownloadSDKServer.exe
GET
—
61.130.21.134:80
http://down.sandai.net/thunder11/XunLeiSetup11.1.7.1334.exe
CN
—
—
suspicious
4020
DownloadSDKServer.exe
GET
—
61.130.21.134:80
http://down.sandai.net/thunder11/XunLeiSetup11.1.7.1334.exe
CN
—
—
suspicious
4020
DownloadSDKServer.exe
GET
—
61.130.21.134:80
http://down.sandai.net/thunder11/XunLeiSetup11.1.7.1334.exe
CN
—
—
suspicious
4020
DownloadSDKServer.exe
PRI
—
140.206.225.167:80
http://140.206.225.167:80*
CN
—
—
unknown
3744
XunLeiWebSetup11.1.7.1334dl.exe
GET
200
117.27.140.211:80
http://static-xl9-ssl.xunlei.com/json/thunderx_bind_config_dl.json
CN
text
3.49 Kb
suspicious
4020
DownloadSDKServer.exe
GET
206
61.130.21.134:80
http://down.sandai.net/thunder11/XunLeiSetup11.1.7.1334.exe
CN
binary
1.00 Mb
suspicious
4020
DownloadSDKServer.exe
GET
206
61.130.21.134:80
http://down.sandai.net/thunder11/XunLeiSetup11.1.7.1334.exe
CN
binary
1.00 Mb
suspicious
4020
DownloadSDKServer.exe
GET
206
61.130.21.134:80
http://down.sandai.net/thunder11/XunLeiSetup11.1.7.1334.exe
CN
binary
1.00 Mb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4020
DownloadSDKServer.exe
139.224.204.61:80
pcdownsdk.rcv.sandai.net
Hangzhou Alibaba Advertising Co.,Ltd.
CN
unknown
4020
DownloadSDKServer.exe
58.144.251.2:8000
hub5pn.wap.sandai.net
CHINA UNICOM China169 Backbone
CN
unknown
—
—
95.181.251.134:6881
—
Link Ltd.
RU
unknown
—
—
114.5.209.172:37016
—
—
ID
unknown
—
—
81.155.253.102:6881
—
British Telecommunications PLC
GB
unknown
3744
XunLeiWebSetup11.1.7.1334dl.exe
47.101.179.215:8099
stat.download.xunlei.com
Hangzhou Alibaba Advertising Co.,Ltd.
CN
malicious
3744
XunLeiWebSetup11.1.7.1334dl.exe
117.27.140.211:80
static-xl9-ssl.xunlei.com
Fuzhou
CN
unknown
4020
DownloadSDKServer.exe
112.64.218.60:80
dconf.xcloud.sandai.net
China Unicom Shanghai network
CN
unknown
—
—
47.92.100.53:8000
hub5pnc.sandai.net
Hangzhou Alibaba Advertising Co.,Ltd.
CN
malicious
—
—
153.3.232.174:8000
hub5pn.wap.sandai.net
CHINA UNICOM China169 Backbone
CN
unknown

DNS requests

Domain
IP
Reputation
static-xl9-ssl.xunlei.com
  • 117.27.140.211
suspicious
stat.download.xunlei.com
  • 47.101.179.215
malicious
dconf.xcloud.sandai.net
  • 112.64.218.60
unknown
hub5pnc.sandai.net
  • 47.92.100.53
  • 47.92.99.221
malicious
hub5pn.wap.sandai.net
  • 58.144.251.2
  • 211.91.242.37
  • 111.206.4.176
  • 118.212.146.21
  • 153.3.232.175
  • 111.206.4.164
  • 157.255.225.53
  • 118.212.146.20
  • 211.91.242.38
  • 153.3.232.174
  • 58.144.251.1
  • 157.255.225.49
malicious
pc.grpc.xnet.sandai.net
  • 140.206.220.105
  • 140.206.225.167
unknown
gslb.xcloud.sandai.net
  • 140.206.225.144
  • 123.125.222.180
suspicious
hubciddata.sandai.net
  • 106.14.169.88
malicious
g3.hub5pn.sandai.net
  • 58.144.251.2
  • 58.144.251.1
  • 123.6.27.49
  • 111.206.4.182
  • 111.206.4.177
  • 123.6.27.16
  • 111.206.4.194
  • 111.206.4.195
  • 157.255.225.55
  • 123.6.27.68
unknown
detection.v6.shub.sandai.net
  • —
suspicious

Threats

PID
Process
Class
Message
4020
DownloadSDKServer.exe
Potential Corporate Privacy Violation
ET P2P BitTorrent DHT ping request
4020
DownloadSDKServer.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
4020
DownloadSDKServer.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
4020
DownloadSDKServer.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
880
DownloadSDKServer.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2756
BHOInstall.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User-Agent (HTTP Downloader)
2756
BHOInstall.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User-Agent (HTTP Downloader)
3336
DownloadSDKServer.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
880
DownloadSDKServer.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
272
Thunder.exe
Potential Corporate Privacy Violation
ET POLICY Outgoing Basic Auth Base64 HTTP Password detected unencrypted
3 ETPRO signatures available at the full report
Process
Message
XunLeiSetup11.1.7.1334.exe
..
XunLeiSetup11.1.7.1334.exe
..
regsvr32.exe
[3964:3928] [05:14 02] Debug <np_tdieplat.dll> [osshell.cpp:270 Xunlei::Platform::OSShell::GetAppDatalowPath] using SHGetKnownFolderPath with FOLDERID_LocalAppDataLow
regsvr32.exe
[3964:3928] [05:14 02] Message <np_tdieplat.dll> [osshell.cpp:39 Xunlei::Platform::OSShell::InstallRuntime] Initializing running environment ...
regsvr32.exe
[3964:3928] [05:14 02] Debug <np_tdieplat.dll> [osshell.cpp:49 Xunlei::Platform::OSShell::InstallRuntime] Current environment directories C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\
regsvr32.exe
[3964:3928] [05:14 02] Debug <np_tdieplat.dll> [osshell.cpp:56 Xunlei::Platform::OSShell::InstallRuntime] Adding local module directory C:\Program Files\Thunder Network\Thunder\Thunder BHO Platform to work environment
regsvr32.exe
[3964:3928] [05:14 02] Debug <np_tdieplat.dll> [osshell.cpp:75 Xunlei::Platform::OSShell::InstallRuntime] Adding C:\Program Files\Thunder Network\Thunder\Thunder BHO Platform to environment
regsvr32.exe
[3964:3928] [05:14 02] Debug <np_tdieplat.dll> [osshell.cpp:103 Xunlei::Platform::OSShell::InstallRuntime] --------------- Current Environment --------------
regsvr32.exe
[3964:3928] [05:14 02] Debug <np_tdieplat.dll> [osshell.cpp:270 Xunlei::Platform::OSShell::GetAppDatalowPath] using SHGetKnownFolderPath with FOLDERID_LocalAppDataLow
regsvr32.exe
[3964:3928] [05:14 02] Debug <np_tdieplat.dll> [osshell.cpp:104 Xunlei::Platform::OSShell::InstallRuntime] GetAppDatalowPath : C:\Users\admin\AppData\LocalLow
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
XunLeiWebSetup11.1.7.1334dl.exe