URL:

http://down.sandai.net/thunderx/XunLeiWebSetup10.1.27.658.exe

Full analysis: https://app.any.run/tasks/9e201194-9cc3-4b70-b9d2-174e06035b43
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: December 24, 2019, 10:57:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

049A3D47A679779C1418FE7E08A3884F

SHA1:

26932E241BC4AD2A320EF7B526C29121FADD5808

SHA256:

7DD7922980D77B01F33E881F5593A7E63793BD9194900BC2E784D006D06732A9

SSDEEP:

3:N1KaKBEjLBNeomQKin2VUhU6QdJn:CaRjOomzrh6IJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • XunLeiWebSetup10.1.27.658.exe (PID: 3228)
      • XunLeiWebSetup10.1.27.658.exe (PID: 184)
      • DownloadSDKServer.exe (PID: 2556)
      • DownloadSDKServer.exe (PID: 3172)
      • InstallXLWFP.exe (PID: 2708)
      • InstallXLWFP.exe (PID: 3912)
      • InstallXLGuard.exe (PID: 2572)
      • XLWFPSetup.exe (PID: 960)
      • InstallXLGuard.exe (PID: 1992)
      • XLServicePlatform.exe (PID: 2504)
      • XLServicePlatform.exe (PID: 1848)
      • XLServicePlatform.exe (PID: 3264)
      • Win7AppId.exe (PID: 2476)
      • Win7AppId.exe (PID: 3436)
      • Win7AppId.exe (PID: 2096)
      • Win7AppId.exe (PID: 3488)
      • Win7AppId.exe (PID: 3004)
      • Win7AppId.exe (PID: 3532)
      • ThunderBHOPlatform.exe (PID: 2480)
      • BHOInstall.exe (PID: 3908)
      • xl_ext_chrome_setup.exe (PID: 3028)
      • Thunder.exe (PID: 640)
      • APlayerCodecs3Embed.exe (PID: 2424)
      • Thunder.exe (PID: 3140)
      • DownloadSDKServer.exe (PID: 2160)
      • Thunder.exe (PID: 624)
      • Thunder.exe (PID: 2484)
      • Thunder.exe (PID: 2108)
      • Thunder.exe (PID: 3736)
      • XLLiveUD.exe (PID: 2660)
      • Thunder.exe (PID: 324)
      • Thunder.exe (PID: 2532)
      • XLLiveUD.exe (PID: 856)
      • Thunder.exe (PID: 1032)
      • Thunder.exe (PID: 2168)
      • xlbrowsershell.exe (PID: 1728)
      • xlbrowsershell.exe (PID: 3584)
      • Thunder.exe (PID: 3552)
      • xlbrowsershell.exe (PID: 1404)
      • xlbrowsershell.exe (PID: 3992)

    • Downloads executable files from the Internet

      • opera.exe (PID: 2520)
      • svchost.exe (PID: 3860)

    • Loads dropped or rewritten executable

      • XunLeiWebSetup10.1.27.658.exe (PID: 3228)
      • DownloadSDKServer.exe (PID: 2556)
      • XunLeiSetup10.1.27.658.exe (PID: 2068)
      • DownloadSDKServer.exe (PID: 3172)
      • XLWFPSetup.exe (PID: 960)
      • svchost.exe (PID: 3860)
      • ThunderBHOPlatform.exe (PID: 2480)
      • regsvr32.exe (PID: 2548)
      • regsvr32.exe (PID: 3516)
      • BHOInstall.exe (PID: 3908)
      • regsvr32.exe (PID: 2364)
      • APlayerCodecs3Embed.exe (PID: 2424)
      • rundll32.exe (PID: 1412)
      • Thunder.exe (PID: 640)
      • Thunder.exe (PID: 3140)
      • SearchProtocolHost.exe (PID: 3440)
      • Thunder.exe (PID: 624)
      • DownloadSDKServer.exe (PID: 2160)
      • Thunder.exe (PID: 2108)
      • Thunder.exe (PID: 2484)
      • Thunder.exe (PID: 324)
      • Thunder.exe (PID: 3736)
      • XLLiveUD.exe (PID: 2660)
      • Thunder.exe (PID: 1032)
      • Thunder.exe (PID: 2532)
      • Thunder.exe (PID: 2168)
      • XLLiveUD.exe (PID: 856)
      • xlbrowsershell.exe (PID: 1728)
      • xlbrowsershell.exe (PID: 3584)
      • Thunder.exe (PID: 3552)
      • xlbrowsershell.exe (PID: 1404)
      • xlbrowsershell.exe (PID: 3992)

    • Creates or modifies windows services

      • XLServicePlatform.exe (PID: 3264)

    • Registers / Runs the DLL via REGSVR32.EXE

      • XunLeiSetup10.1.27.658.exe (PID: 2068)
      • ThunderBHOPlatform.exe (PID: 2480)

    • Changes the autorun value in the registry

      • XunLeiSetup10.1.27.658.exe (PID: 2068)

    • Changes settings of System certificates

      • Thunder.exe (PID: 640)
      • xlbrowsershell.exe (PID: 1728)

  • SUSPICIOUS

    • Uses NETSH.EXE for network configuration

      • XunLeiSetup10.1.27.658.exe (PID: 2068)
      • XunLeiWebSetup10.1.27.658.exe (PID: 3228)

    • Executable content was dropped or overwritten

      • opera.exe (PID: 2520)
      • XunLeiWebSetup10.1.27.658.exe (PID: 3228)
      • XLWFPSetup.exe (PID: 960)
      • DownloadSDKServer.exe (PID: 3172)
      • XLServicePlatform.exe (PID: 3264)
      • regsvr32.exe (PID: 2364)
      • XunLeiSetup10.1.27.658.exe (PID: 2068)
      • regsvr32.exe (PID: 2548)
      • xl_ext_chrome_setup.exe (PID: 3028)
      • ThunderBHOPlatform.exe (PID: 2480)
      • APlayerCodecs3Embed.exe (PID: 2424)
      • svchost.exe (PID: 3860)
      • XLLiveUD.exe (PID: 2660)
      • Thunder.exe (PID: 3140)

    • Connects to unusual port

      • XunLeiWebSetup10.1.27.658.exe (PID: 3228)
      • XunLeiSetup10.1.27.658.exe (PID: 2068)
      • XLServicePlatform.exe (PID: 1848)
      • InstallXLWFP.exe (PID: 2708)
      • InstallXLWFP.exe (PID: 3912)
      • InstallXLGuard.exe (PID: 1992)
      • InstallXLGuard.exe (PID: 2572)
      • XLServicePlatform.exe (PID: 3264)
      • svchost.exe (PID: 3860)
      • Thunder.exe (PID: 640)

    • Creates files in the program directory

      • XunLeiWebSetup10.1.27.658.exe (PID: 3228)
      • XLWFPSetup.exe (PID: 960)
      • XLServicePlatform.exe (PID: 3264)
      • XunLeiSetup10.1.27.658.exe (PID: 2068)
      • regsvr32.exe (PID: 2364)
      • regsvr32.exe (PID: 2548)
      • xl_ext_chrome_setup.exe (PID: 3028)
      • ThunderBHOPlatform.exe (PID: 2480)
      • svchost.exe (PID: 3860)
      • Thunder.exe (PID: 640)
      • Thunder.exe (PID: 3140)
      • Thunder.exe (PID: 2108)
      • xlbrowsershell.exe (PID: 1728)

    • Low-level read access rights to disk partition

      • XunLeiWebSetup10.1.27.658.exe (PID: 3228)
      • DownloadSDKServer.exe (PID: 2556)
      • DownloadSDKServer.exe (PID: 3172)
      • XLServicePlatform.exe (PID: 1848)
      • InstallXLWFP.exe (PID: 2708)
      • XunLeiSetup10.1.27.658.exe (PID: 2068)
      • InstallXLWFP.exe (PID: 3912)
      • InstallXLGuard.exe (PID: 1992)
      • InstallXLGuard.exe (PID: 2572)
      • svchost.exe (PID: 3860)
      • XLServicePlatform.exe (PID: 3264)
      • BHOInstall.exe (PID: 3908)
      • Thunder.exe (PID: 640)
      • Thunder.exe (PID: 3140)
      • Thunder.exe (PID: 624)
      • Thunder.exe (PID: 2484)
      • Thunder.exe (PID: 3736)
      • DownloadSDKServer.exe (PID: 2160)
      • Thunder.exe (PID: 2108)
      • XLLiveUD.exe (PID: 2660)
      • Thunder.exe (PID: 2532)
      • Thunder.exe (PID: 1032)
      • XLLiveUD.exe (PID: 856)
      • Thunder.exe (PID: 2168)
      • Thunder.exe (PID: 3552)

    • Creates files in the user directory

      • XunLeiSetup10.1.27.658.exe (PID: 2068)
      • Thunder.exe (PID: 640)

    • Reads CPU info

      • DownloadSDKServer.exe (PID: 3172)
      • DownloadSDKServer.exe (PID: 2556)
      • DownloadSDKServer.exe (PID: 2160)

    • Creates a software uninstall entry

      • XunLeiSetup10.1.27.658.exe (PID: 2068)

    • Creates files in the Windows directory

      • XLWFPSetup.exe (PID: 960)
      • svchost.exe (PID: 3860)

    • Creates files in the driver directory

      • XLWFPSetup.exe (PID: 960)

    • Removes files from Windows directory

      • svchost.exe (PID: 3860)

    • Creates COM task schedule object

      • regsvr32.exe (PID: 2364)
      • regsvr32.exe (PID: 2548)
      • regsvr32.exe (PID: 3516)
      • APlayerCodecs3Embed.exe (PID: 2424)

    • Modifies the open verb of a shell class

      • XunLeiSetup10.1.27.658.exe (PID: 2068)
      • rundll32.exe (PID: 1412)
      • Thunder.exe (PID: 3140)

    • Uses RUNDLL32.EXE to load library

      • XunLeiSetup10.1.27.658.exe (PID: 2068)

    • Application launched itself

      • Thunder.exe (PID: 640)
      • Thunder.exe (PID: 3140)
      • xlbrowsershell.exe (PID: 1728)

    • Adds / modifies Windows certificates

      • Thunder.exe (PID: 640)
      • xlbrowsershell.exe (PID: 1728)

    • Starts itself from another location

      • XLLiveUD.exe (PID: 2660)

    • Reads Internet Cache Settings

      • Thunder.exe (PID: 640)

  • INFO

    • Creates files in the user directory

      • opera.exe (PID: 2520)

    • Manual execution by user

      • XunLeiWebSetup10.1.27.658.exe (PID: 3228)
      • XunLeiWebSetup10.1.27.658.exe (PID: 184)

    • Dropped object may contain Bitcoin addresses

      • XunLeiSetup10.1.27.658.exe (PID: 2068)
      • XLLiveUD.exe (PID: 2660)

    • Reads the hosts file

      • Thunder.exe (PID: 640)
      • xlbrowsershell.exe (PID: 1728)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
125
Monitored processes
66
Malicious processes
30
Suspicious processes
7

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start opera.exe xunleiwebsetup10.1.27.658.exe no specs xunleiwebsetup10.1.27.658.exe netsh.exe no specs downloadsdkserver.exe xunleisetup10.1.27.658.exe netsh.exe no specs netsh.exe no specs downloadsdkserver.exe netsh.exe no specs xlserviceplatform.exe no specs xlserviceplatform.exe xlwfpsetup.exe installxlwfp.exe installxlwfp.exe installxlguard.exe installxlguard.exe win7appid.exe no specs xlserviceplatform.exe win7appid.exe no specs win7appid.exe no specs win7appid.exe no specs win7appid.exe no specs win7appid.exe no specs svchost.exe regsvr32.exe regsvr32.exe no specs regsvr32.exe regsvr32.exe no specs thunderbhoplatform.exe regsvr32.exe no specs bhoinstall.exe xl_ext_chrome_setup.exe regsvr32.exe netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs rundll32.exe no specs aplayercodecs3embed.exe netsh.exe no specs thunder.exe thunder.exe searchprotocolhost.exe no specs downloadsdkserver.exe thunder.exe no specs thunder.exe thunder.exe thunder.exe thunder.exe xlliveud.exe thunder.exe no specs thunder.exe xlliveud.exe thunder.exe no specs xlbrowsershell.exe xlbrowsershell.exe no specs thunder.exe no specs ping.exe no specs ping.exe no specs xlbrowsershell.exe no specs xlbrowsershell.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
184"C:\Users\admin\Desktop\XunLeiWebSetup10.1.27.658.exe" C:\Users\admin\Desktop\XunLeiWebSetup10.1.27.658.exe—explorer.exe
User:
admin
Company:
ShenZhen Xunlei Networking Technologies,LTD
Integrity Level:
MEDIUM
Description:
XunLeiWebSetup10.1.27.658xl
Exit code:
3221226540
Version:
10.1.27.658
Modules
Images
c:\users\admin\desktop\xunleiwebsetup10.1.27.658.exe
c:\systemroot\system32\ntdll.dll
324"C:\Program Files\Thunder Network\Thunder\Program\Thunder.exe" --type=renderer --no-sandbox --primordial-pipe-token=154A50F5F3F0E2D54975E8D25B1AAF4C --lang=en-US --app-user-model-id="C:\Program Files\Thunder Network\Thunder\Program\Thunder.exe" --app-path="C:\Program Files\Thunder Network\Thunder\Program\resources\app" --node-integration=true --webview-tag=true --no-sandbox --preload="C:\Program Files\Thunder Network\Thunder\Program\resources\app\out\common-preload.js" --guest-instance-id=1 --enable-blink-features --disable-blink-features --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553 --disable-accelerated-video-decode --disable-gpu-compositing --service-request-channel-token=154A50F5F3F0E2D54975E8D25B1AAF4C --renderer-client-id=5 --mojo-platform-channel-handle=2364 /prefetch:1C:\Program Files\Thunder Network\Thunder\Program\Thunder.exe
Thunder.exe
User:
admin
Company:
深圳市迅雷网络技术有限公司
Integrity Level:
HIGH
Description:
迅雷X
Exit code:
0
Version:
10,1,27,658
Modules
Images
c:\program files\thunder network\thunder\program\thunder.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\rpcrt4.dll
624"C:\Program Files\Thunder Network\Thunder\Program\Thunder.exe" "C:/Program Files/Thunder Network/Thunder/Program/resources/app/out/plugin-boot.js" --type=xdas-plugin-process "--xdas-plugin-config=C:/Program Files/Thunder Network/Thunder/Program/resources/app/plugins/VipDownload/config.json" --xdas-plugin-name=VipDownloadC:\Program Files\Thunder Network\Thunder\Program\Thunder.exe—Thunder.exe
User:
admin
Company:
深圳市迅雷网络技术有限公司
Integrity Level:
HIGH
Description:
迅雷X
Exit code:
0
Version:
10,1,27,658
Modules
Images
c:\program files\thunder network\thunder\program\thunder.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\rpcrt4.dll
640"C:\Program Files\Thunder Network\Thunder\Program\Thunder.exe" -StartType:InstallC:\Program Files\Thunder Network\Thunder\Program\Thunder.exe
XunLeiWebSetup10.1.27.658.exe
User:
admin
Company:
深圳市迅雷网络技术有限公司
Integrity Level:
HIGH
Description:
迅雷X
Exit code:
0
Version:
10,1,27,658
Modules
Images
c:\program files\thunder network\thunder\program\thunder.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\rpcrt4.dll
856"C:\Users\admin\AppData\Local\Temp\XLLiveUD\Thunder8_10.1.27.658\XLLiveUD.exe" -UpdateMode:l -Source:thunderx -RestartToInstallC:\Users\admin\AppData\Local\Temp\XLLiveUD\Thunder8_10.1.27.658\XLLiveUD.exe
XLLiveUD.exe
User:
admin
Company:
深圳市迅雷网络技术有限公司
Integrity Level:
HIGH
Description:
迅雷升级程序
Exit code:
0
Version:
3.1.10.86
Modules
Images
c:\users\admin\appdata\local\temp\xlliveud\thunder8_10.1.27.658\xlliveud.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\xlliveud\thunder8_10.1.27.658\xlliveupdateagent.dll
c:\windows\system32\psapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
960"C:\Program Files\Thunder Network\Thunder\Program\XLWFPSetup.exe" /S /PeerID=C:\Program Files\Thunder Network\Thunder\Program\XLWFPSetup.exe
XunLeiSetup10.1.27.658.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\thunder network\thunder\program\xlwfpsetup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
1032"C:\Program Files\Thunder Network\Thunder\Program\Thunder.exe" --type=renderer --no-sandbox --primordial-pipe-token=C400136C6C881C3C1B1620F9AEC2A973 --lang=en-US --app-user-model-id="C:\Program Files\Thunder Network\Thunder\Program\Thunder.exe" --app-path="C:\Program Files\Thunder Network\Thunder\Program\resources\app" --node-integration=true --webview-tag=true --no-sandbox --preload="C:\Program Files\Thunder Network\Thunder\Program\resources\app\out\plugin-boot.js" --guest-instance-id=2 --enable-blink-features --disable-blink-features --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553 --disable-accelerated-video-decode --disable-gpu-compositing --service-request-channel-token=C400136C6C881C3C1B1620F9AEC2A973 --renderer-client-id=11 --mojo-platform-channel-handle=3308 /prefetch:1C:\Program Files\Thunder Network\Thunder\Program\Thunder.exe
Thunder.exe
User:
admin
Company:
深圳市迅雷网络技术有限公司
Integrity Level:
HIGH
Description:
迅雷X
Exit code:
0
Version:
10,1,27,658
Modules
Images
c:\program files\thunder network\thunder\program\thunder.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\rpcrt4.dll
1036C:\Windows\system32\netsh.exe advfirewall firewall delete rule name="DownloadSDKServer" dir=in action=allow program="C:\Users\admin\AppData\Local\Temp\ThunderInstall\10.1.27.658\SDK\DownloadSDKServer.exe"C:\Windows\system32\netsh.exe—XunLeiSetup10.1.27.658.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1268regsvr32 /s "C:\Program Files\Thunder Network\Thunder\BHO\ThunderAgent64.dll"C:\Windows\system32\regsvr32.exe—XunLeiSetup10.1.27.658.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
3
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1404"C:\Program Files\Thunder Network\Thunder\Program\resources\bin\TBC\xlbrowsershell.exe" --type=renderer --no-sandbox --primordial-pipe-token=421974BBE2D78A35F8F9CDB5EBE66370 --lang=en-US --lang=zh-CN --log-file="C:\Program Files\Thunder Network\Thunder\Program\resources\bin\TBC\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 TBC/1.1.0.28 Thunder/10.1.27.658" --ppapi-flash-path="PepperFlash\pepflashplayer.dll" --ppapi-flash-version=32.0.0.192 --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --disable-accelerated-video-decode --disable-webrtc-hw-vp8-encoding --disable-gpu-compositing --service-request-channel-token=421974BBE2D78A35F8F9CDB5EBE66370 --renderer-client-id=3 --mojo-platform-channel-handle=2212 /prefetch:1C:\Program Files\Thunder Network\Thunder\Program\resources\bin\TBC\xlbrowsershell.exe—xlbrowsershell.exe
User:
admin
Company:
Xunlei Network Company
Integrity Level:
HIGH
Description:
Xunlei Browser Process Shell
Exit code:
0
Version:
1.0.0.7
Modules
Images
c:\program files\thunder network\thunder\program\resources\bin\tbc\xlbrowsershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
Total events
6 220
Read events
3 728
Write events
2 473
Delete events
19

Modification events

(PID) Process:(2520) opera.exeKey:HKEY_CURRENT_USER\Software\Opera Software
Operation:writeName:Last CommandLine v2
Value:
C:\Program Files\Opera\opera.exe "http://down.sandai.net/thunderx/XunLeiWebSetup10.1.27.658.exe"
(PID) Process:(2520) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2520) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:NodeSlots
Value:
020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202
(PID) Process:(2520) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:MRUListEx
Value:
02000000070000000100000009000000080000000000000006000000030000000500000004000000FFFFFFFF
(PID) Process:(2520) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\50\ComDlg
Operation:writeName:TV_FolderType
Value:
{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}
(PID) Process:(2520) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\50\ComDlg
Operation:writeName:TV_TopViewID
Value:
{82BA0782-5B7A-4569-B5D7-EC83085F08CC}
(PID) Process:(2520) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\50\ComDlg
Operation:writeName:TV_TopViewVersion
Value:
0
(PID) Process:(2520) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}
Operation:writeName:Mode
Value:
4
(PID) Process:(2520) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}
Operation:writeName:LogicalViewMode
Value:
1
(PID) Process:(2520) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}
Operation:writeName:FFlags
Value:
1092616257
Executable files
441
Suspicious files
209
Text files
1 211
Unknown types
29

Dropped files

PID
Process
Filename
Type
2520opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\sessions\opr9D34.tmp —
MD5:—
SHA256:—
2520opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\opr9D35.tmp —
MD5:—
SHA256:—
2520opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\opr9D65.tmp —
MD5:—
SHA256:—
2520opera.exeC:\Users\admin\AppData\Local\Opera\Opera\cache\sesn\opr00001.tmp —
MD5:—
SHA256:—
2520opera.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MP8H6RPQY7TPHLG2VDS7.temp —
MD5:—
SHA256:—
2520opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\tasks.xmlxml
MD5:—
SHA256:—
2520opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\opssl6.datbinary
MD5:—
SHA256:—
2520opera.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\16ec093b8f51508f.customDestinations-ms~RF39a93b.TMPbinary
MD5:—
SHA256:—
2520opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\download.datbinary
MD5:—
SHA256:—
2520opera.exeC:\Users\admin\Desktop\XunLeiWebSetup10.1.27.658.exeexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
283
TCP/UDP connections
372
DNS requests
215
Threats
14

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2556
DownloadSDKServer.exe
PRI
—
47.102.63.100:80
http://47.102.63.100:80*
CN
—
—
unknown
2520
opera.exe
GET
—
185.26.182.111:80
http://sitecheck2.opera.com/?host=down.sandai.net&hdn=UW4BjxL8TEuwU7L92AFtyA==
unknown
—
—
whitelisted
2556
DownloadSDKServer.exe
GET
—
140.249.60.228:80
http://down.sandai.net/thunderx/XunLeiSetup10.1.27.658.exe
CN
—
—
suspicious
2556
DownloadSDKServer.exe
GET
206
140.249.60.228:80
http://down.sandai.net/thunderx/XunLeiSetup10.1.27.658.exe
CN
binary
1.00 Mb
suspicious
2520
opera.exe
GET
200
140.249.60.228:80
http://down.sandai.net/thunderx/XunLeiWebSetup10.1.27.658.exe
CN
executable
4.48 Mb
suspicious
2556
DownloadSDKServer.exe
GET
206
140.249.60.228:80
http://down.sandai.net/thunderx/XunLeiSetup10.1.27.658.exe
CN
binary
1.00 Mb
suspicious
2556
DownloadSDKServer.exe
POST
200
120.79.103.155:80
http://dlcfg.client.v6.chub.sandai.net/query
CN
binary
864 b
unknown
2556
DownloadSDKServer.exe
GET
206
140.249.60.228:80
http://down.sandai.net/thunderx/XunLeiSetup10.1.27.658.exe
CN
binary
1.00 Mb
suspicious
3228
XunLeiWebSetup10.1.27.658.exe
GET
200
101.226.28.226:80
http://static-xl9-ssl.xunlei.com/json/thunderx_bind_config_xl.json
CN
text
2.14 Kb
suspicious
2556
DownloadSDKServer.exe
POST
200
47.102.253.179:80
http://dconf.xcloud.sandai.net/api/xsdn
CN
text
204 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2520
opera.exe
140.249.60.228:80
down.sandai.net
No.31,Jin-rong Street
CN
suspicious
2520
opera.exe
185.26.182.111:80
sitecheck2.opera.com
Opera Software AS
—
whitelisted
3228
XunLeiWebSetup10.1.27.658.exe
140.206.225.241:8099
stat.download.xunlei.com
China Unicom Shanghai network
CN
suspicious
3228
XunLeiWebSetup10.1.27.658.exe
101.226.28.226:80
static-xl9-ssl.xunlei.com
China Telecom (Group)
CN
unknown
2556
DownloadSDKServer.exe
47.102.253.179:80
dconf.xcloud.sandai.net
Hangzhou Alibaba Advertising Co.,Ltd.
CN
unknown
2556
DownloadSDKServer.exe
47.92.99.221:8000
hub5pnc.sandai.net
Hangzhou Alibaba Advertising Co.,Ltd.
CN
malicious
—
—
153.3.232.175:8000
hub5pn.wap.sandai.net
CHINA UNICOM China169 Backbone
CN
unknown
2556
DownloadSDKServer.exe
47.92.100.53:8000
hub5pnc.sandai.net
Hangzhou Alibaba Advertising Co.,Ltd.
CN
malicious
2556
DownloadSDKServer.exe
61.135.180.16:8000
g1.hub5pn.sandai.net
China Unicom Beijing Province Network
CN
unknown
2556
DownloadSDKServer.exe
87.98.162.88:6881
dht.transmissionbt.com
OVH SAS
FR
suspicious

DNS requests

Domain
IP
Reputation
down.sandai.net
  • 140.249.60.228
suspicious
certs.opera.com
  • 185.26.182.94
  • 185.26.182.93
whitelisted
crl4.digicert.com
  • 93.184.220.29
whitelisted
sitecheck2.opera.com
  • 185.26.182.111
  • 185.26.182.94
  • 185.26.182.93
  • 185.26.182.112
whitelisted
static-xl9-ssl.xunlei.com
  • 101.226.28.226
  • 101.226.28.227
  • 101.226.28.228
  • 101.226.28.229
  • 101.226.28.230
  • 101.226.28.231
  • 101.226.28.232
  • 101.226.28.233
suspicious
stat.download.xunlei.com
  • 140.206.225.241
malicious
dconf.xcloud.sandai.net
  • 47.102.253.179
unknown
hub5pnc.sandai.net
  • 47.92.99.221
  • 47.92.100.53
malicious
hub5pn.wap.sandai.net
  • 153.3.232.175
  • 61.135.179.34
  • 211.91.242.38
  • 211.91.242.37
  • 58.144.251.1
  • 118.212.146.20
  • 118.212.146.21
  • 58.144.251.2
  • 153.3.232.174
  • 61.135.179.35
  • 157.255.225.49
  • 157.255.225.53
malicious
hubciddata.sandai.net
  • 106.14.169.88
malicious

Threats

PID
Process
Class
Message
2520
opera.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2556
DownloadSDKServer.exe
Potential Corporate Privacy Violation
ET P2P BitTorrent DHT ping request
2556
DownloadSDKServer.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3172
DownloadSDKServer.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3908
BHOInstall.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User-Agent (HTTP Downloader)
3908
BHOInstall.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User-Agent (HTTP Downloader)
3860
svchost.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3860
svchost.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
3140
Thunder.exe
Potentially Bad Traffic
ET INFO Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
3140
Thunder.exe
Potentially Bad Traffic
ET INFO Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
3 ETPRO signatures available at the full report
Process
Message
XunLeiSetup10.1.27.658.exe
..
XunLeiSetup10.1.27.658.exe
..
regsvr32.exe
[3516:2060] [11:00 08] Debug <np_tdieplat.dll> [osshell.cpp:270 Xunlei::Platform::OSShell::GetAppDatalowPath] using SHGetKnownFolderPath with FOLDERID_LocalAppDataLow
regsvr32.exe
[3516:2060] [11:00 08] Message <np_tdieplat.dll> [osshell.cpp:39 Xunlei::Platform::OSShell::InstallRuntime] Initializing running environment ...
regsvr32.exe
[3516:2060] [11:00 08] Debug <np_tdieplat.dll> [osshell.cpp:75 Xunlei::Platform::OSShell::InstallRuntime] Adding C:\Program Files\Thunder Network\Thunder\Thunder BHO Platform to environment
regsvr32.exe
[3516:2060] [11:00 08] Debug <np_tdieplat.dll> [osshell.cpp:113 Xunlei::Platform::OSShell::InstallRuntime] GetPlatformCrashDumpPath : C:\Users\admin\AppData\LocalLow\Thunder Network\Thunder BHO Platform\bugreport
regsvr32.exe
[3516:2060] [11:00 08] Debug <np_tdieplat.dll> [osshell.cpp:270 Xunlei::Platform::OSShell::GetAppDatalowPath] using SHGetKnownFolderPath with FOLDERID_LocalAppDataLow
regsvr32.exe
[3516:2060] [11:00 08] Debug <np_tdieplat.dll> [ziputil.cpp:354 vx::ZipUtil::Unzip] Unzipping file : config.xml to C:\Users\admin\AppData\LocalLow\Thunder Network\Thunder BHO Platform\package\config.xml
regsvr32.exe
[3516:2060] [11:00 08] Debug <np_tdieplat.dll> [osshell.cpp:49 Xunlei::Platform::OSShell::InstallRuntime] Current environment directories C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\
regsvr32.exe
[3516:2060] [11:00 08] Debug <np_tdieplat.dll> [osshell.cpp:270 Xunlei::Platform::OSShell::GetAppDatalowPath] using SHGetKnownFolderPath with FOLDERID_LocalAppDataLow
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://down.sandai.net/thunderx/XunLeiWebSetup10.1.27.658.exe