File name:

GameDownload_gamedownload_i18n_hw-by6_100505_1.0.7773.123.exe

Full analysis: https://app.any.run/tasks/ad309375-6148-423f-b7bd-d1df3717fe3b
Verdict: Malicious activity
Analysis date: June 21, 2020, 07:10:44
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
installer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

834001AC734CEA36082E8DD4E739DB78

SHA1:

FBE3B8CEFC017F0F2E0D5BC962B910A28669324C

SHA256:

A4109BC6B5AD3B673C1066200EA47E8E6C71B44B3DE8EF92922AB7946E1B066F

SSDEEP:

196608:dio1nq2qlUgN7AktVweDOaG5eWWi/zio/ipemQn:dBga2ONwWrX/kC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • TenioDL.exe (PID: 2796)
      • GameDownload_gamedownload_i18n_hw-by6_100505_1.0.7773.123.exe (PID: 3932)

    • Application was dropped or rewritten from another process

      • TenioDL.exe (PID: 2796)

  • SUSPICIOUS

    • Creates files in the user directory

      • GameDownload_gamedownload_i18n_hw-by6_100505_1.0.7773.123.exe (PID: 3932)
      • TenioDL.exe (PID: 2796)

    • Uses ICACLS.EXE to modify access control list

      • TenioDL.exe (PID: 2796)

    • Low-level read access rights to disk partition

      • GameDownload_gamedownload_i18n_hw-by6_100505_1.0.7773.123.exe (PID: 3932)

    • Executable content was dropped or overwritten

      • GameDownload_gamedownload_i18n_hw-by6_100505_1.0.7773.123.exe (PID: 3932)

  • INFO

    • Reads the hosts file

      • GameDownload_gamedownload_i18n_hw-by6_100505_1.0.7773.123.exe (PID: 3932)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (17.9)
.exe | Win32 Executable MS Visual C++ (generic) (13)
.exe | Win64 Executable (generic) (11.5)
.scr | Windows screen saver (5.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:01:08 11:19:02+01:00
PEType: PE32
LinkerVersion: 8
CodeSize: 1191936
InitializedDataSize: 9064448
UninitializedDataSize: -
EntryPoint: 0x9a51a
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.7773.123
ProductVersionNumber: 1.0.7773.123
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Tencent
FileDescription: Tencent Gaming Buddy - Install
FileVersion: 1.0.7773.123
InternalName: GameDownload
LegalCopyright: Copyright © 2017 Tencent. All Rights Reserved.
OriginalFileName: GameDownload.exe
ProductName: Tencent Gaming Buddy
ProductVersion: 1,0,7773,123

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 08-Jan-2019 10:19:02
Detected languages:
  • Chinese - PRC
  • English - United States
Debug artifacts:
  • D:\jenkins_Trunk\workspace\RO\qqpcmgr_proj\AndroidEmulator\Output\Binfinal\GameDownload\GameDownload.pdb
CompanyName: Tencent
FileDescription: Tencent Gaming Buddy - Install
FileVersion: 1.0.7773.123
InternalName: GameDownload
LegalCopyright: Copyright © 2017 Tencent. All Rights Reserved.
OriginalFilename: GameDownload.exe
ProductName: Tencent Gaming Buddy
ProductVersion: 1,0,7773,123

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000100

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 08-Jan-2019 10:19:02
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00122638
0x00123000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.57755
.rdata
0x00124000
0x00050285
0x00051000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.80597
.data
0x00175000
0x00008048
0x00006000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.58485
.QMGuid
0x0017E000
0x00000014
0x00001000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x0017F000
0x0084CEBC
0x0084D000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.26902

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.77304
333
Latin 1 / Western European
English - United States
RT_MANIFEST
2
4.39184
67624
Latin 1 / Western European
Chinese - PRC
RT_ICON
3
4.60059
38056
Latin 1 / Western European
Chinese - PRC
RT_ICON
4
4.58985
16936
Latin 1 / Western European
Chinese - PRC
RT_ICON
5
4.94036
9640
Latin 1 / Western European
Chinese - PRC
RT_ICON
6
4.94677
4264
Latin 1 / Western European
Chinese - PRC
RT_ICON
7
2.86818
122
Latin 1 / Western European
Chinese - PRC
RT_STRING
8
1.18167
46
Latin 1 / Western European
Chinese - PRC
RT_STRING
9
2.54353
296
Latin 1 / Western European
Chinese - PRC
RT_ICON
10
4.35478
3752
Latin 1 / Western European
Chinese - PRC
RT_ICON

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
IMM32.dll
KERNEL32.dll
NETAPI32.dll
OLEAUT32.dll
PSAPI.DLL
SHELL32.dll
SHLWAPI.dll

Exports

Title
Ordinal
Address
curl_easy_cleanup
1
0x000610F0
curl_easy_duphandle
2
0x00061170
curl_easy_escape
3
0x0008BAD0
curl_easy_getinfo
4
0x00061150
curl_easy_init
5
0x00060FA0
curl_easy_pause
6
0x000613E0
curl_easy_perform
7
0x00061010
curl_easy_recv
8
0x00061550
curl_easy_reset
9
0x00061340
curl_easy_send
10
0x000615B0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
4
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start gamedownload_gamedownload_i18n_hw-by6_100505_1.0.7773.123.exe teniodl.exe icacls.exe no specs gamedownload_gamedownload_i18n_hw-by6_100505_1.0.7773.123.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
600"C:\Users\admin\AppData\Local\Temp\GameDownload_gamedownload_i18n_hw-by6_100505_1.0.7773.123.exe" C:\Users\admin\AppData\Local\Temp\GameDownload_gamedownload_i18n_hw-by6_100505_1.0.7773.123.exe—explorer.exe
User:
admin
Company:
Tencent
Integrity Level:
MEDIUM
Description:
Tencent Gaming Buddy - Install
Exit code:
3221226540
Version:
1.0.7773.123
Modules
Images
c:\users\admin\appdata\local\temp\gamedownload_gamedownload_i18n_hw-by6_100505_1.0.7773.123.exe
c:\systemroot\system32\ntdll.dll
2520"C:\Windows\System32\icacls.exe" C:\Users\admin\AppData\Roaming\Tencent\Config\ /t /setintegritylevel lowC:\Windows\System32\icacls.exe—TenioDL.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\icacls.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
2796C:\Users\admin\AppData\Roaming\Tencent\TxGameAssistant\GameDownload\TenioDL.exeC:\Users\admin\AppData\Roaming\Tencent\TxGameAssistant\GameDownload\TenioDL.exe
GameDownload_gamedownload_i18n_hw-by6_100505_1.0.7773.123.exe
User:
admin
Company:
Tencent
Integrity Level:
HIGH
Description:
腾讯游戏云加速下载引擎（旋风Inside）
Exit code:
0
Version:
2, 0, 15, 26
Modules
Images
c:\users\admin\appdata\roaming\tencent\txgameassistant\gamedownload\teniodl.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\imm32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3932"C:\Users\admin\AppData\Local\Temp\GameDownload_gamedownload_i18n_hw-by6_100505_1.0.7773.123.exe" C:\Users\admin\AppData\Local\Temp\GameDownload_gamedownload_i18n_hw-by6_100505_1.0.7773.123.exe
explorer.exe
User:
admin
Company:
Tencent
Integrity Level:
HIGH
Description:
Tencent Gaming Buddy - Install
Exit code:
0
Version:
1.0.7773.123
Modules
Images
c:\users\admin\appdata\local\temp\gamedownload_gamedownload_i18n_hw-by6_100505_1.0.7773.123.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\psapi.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
Total events
78
Read events
71
Write events
7
Delete events
0

Modification events

(PID) Process:(3932) GameDownload_gamedownload_i18n_hw-by6_100505_1.0.7773.123.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Tencent\MobileGamePC
Operation:writeName:SupplyId
Value:
100505
(PID) Process:(3932) GameDownload_gamedownload_i18n_hw-by6_100505_1.0.7773.123.exeKey:HKEY_CURRENT_USER\Software\Tencent\MobileGamePC
Operation:writeName:sf
Value:
C:\Temp\TxGameDownload\MobileGamePCShared
(PID) Process:(2796) TenioDL.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2796) TenioDL.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2796) TenioDL.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\metnsd\clsid
Operation:writeName:SequenceID
Value:
F559E86CB2D03C4897D69873B7A78236
Executable files
5
Suspicious files
0
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
3932GameDownload_gamedownload_i18n_hw-by6_100505_1.0.7773.123.exeC:\test.tmp —
MD5:—
SHA256:—
2796TenioDL.exeC:\Users\admin\AppData\Local\Temp\etilqs_UCkVdBOoPUW2A4x —
MD5:—
SHA256:—
2796TenioDL.exeC:\Users\admin\AppData\Local\Temp\etilqs_md2WpxYj2SnCn7f —
MD5:—
SHA256:—
2796TenioDL.exeC:\Users\admin\AppData\Roaming\Tencent\File\user_game.initext
MD5:—
SHA256:—
3932GameDownload_gamedownload_i18n_hw-by6_100505_1.0.7773.123.exeC:\Users\admin\AppData\Roaming\Tencent\TxGameAssistant\GameDownload\p2papp.dllexecutable
MD5:B1B101D86C417286E60F471FC8B79BB1
SHA256:91CFA1769BE449DFDFBF6BCC8049CE5C9218DF6DEAA66A0879528526B204A51A
3932GameDownload_gamedownload_i18n_hw-by6_100505_1.0.7773.123.exeC:\Users\admin\AppData\Roaming\Tencent\TxGameAssistant\GameDownload\TenioDL.exeexecutable
MD5:8FB4E336F4C145EB6E379701C3AC59D1
SHA256:D7A59B5BA3F0FB3906EBAA7A67C76088995A1F37652A2AE9893977C19754D9BF
3932GameDownload_gamedownload_i18n_hw-by6_100505_1.0.7773.123.exeC:\Users\admin\AppData\Roaming\Tencent\TxGameAssistant\GameDownload\TenioDL_core.dllexecutable
MD5:11D65A68132E918BD80E7E0A09029730
SHA256:36C18DEDAC0429375C583FCF9420CDC9ACE8A38BBAC9F33378B5B4D6739DA511
3932GameDownload_gamedownload_i18n_hw-by6_100505_1.0.7773.123.exeC:\Users\admin\AppData\Roaming\Tencent\TxGameAssistant\GameDownload\dr.dllexecutable
MD5:2814ACBD607BA47BDBCDF6AC3076EE95
SHA256:5904A7E4D97EEAC939662C3638A0E145F64FF3DD0198F895C4BF0337595C6A67
3932GameDownload_gamedownload_i18n_hw-by6_100505_1.0.7773.123.exeC:\Users\admin\AppData\Roaming\Tencent\TxGameAssistant\GameDownload\TenioDL.dllexecutable
MD5:34431EB1AE2D3AC86E3415D8C3E977A3
SHA256:8379E09C7A3A51BDB652418781CEED8067E324B656C7D5A307B9A77C899F0806
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
13
DNS requests
9
Threats
5

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3932
GameDownload_gamedownload_i18n_hw-by6_100505_1.0.7773.123.exe
111.161.108.227:8000
p2pupgrade.gamedl.qq.com
CHINA UNICOM China169 Backbone
CN
unknown
3932
GameDownload_gamedownload_i18n_hw-by6_100505_1.0.7773.123.exe
58.251.106.185:443
master.etl.desktop.qq.com
China Unicom Guangdong IP network
CN
malicious
2796
TenioDL.exe
220.194.108.75:8000
ps2.gamedl.qq.com
CHINA UNICOM China169 Backbone
CN
unknown
2796
TenioDL.exe
111.161.108.227:8000
p2pupgrade.gamedl.qq.com
CHINA UNICOM China169 Backbone
CN
unknown
2796
TenioDL.exe
220.194.106.243:14309
config.gamedl.qq.com
CHINA UNICOM China169 Backbone
CN
unknown
2796
TenioDL.exe
163.177.93.178:8000
stun.qqlive.qq.com
China Unicom Shenzen network
CN
unknown
—
—
163.177.93.177:8000
—
China Unicom Shenzen network
CN
unknown
—
—
85.206.166.82:20190
—
Informacines sistemos ir technologijos, UAB
LT
unknown
—
—
183.61.39.228:8000
—
China Telecom (Group)
CN
unknown
—
—
183.61.39.214:8000
—
China Telecom (Group)
CN
unknown

DNS requests

Domain
IP
Reputation
masterconn.qq.com
  • 203.205.239.243
whitelisted
p2pupgrade.gamedl.qq.com
  • 111.161.108.227
  • 111.161.108.243
unknown
master.etl.desktop.qq.com
  • 58.251.106.185
whitelisted
masterconn2.qq.com
  • 123.151.71.34
unknown
stat.gamedl.qq.com
  • 220.194.106.177
  • 220.194.106.140
  • 220.194.106.240
  • 111.161.108.18
  • 111.161.108.102
  • 111.161.108.43
unknown
config.gamedl.qq.com
  • 220.194.106.243
  • 220.194.106.77
whitelisted
stun.qqlive.qq.com
  • 163.177.93.178
  • 163.177.93.188
  • 163.177.93.245
  • 220.249.245.24
  • 220.249.245.138
suspicious
ps2.gamedl.qq.com
  • 220.194.108.75
  • 60.28.190.146
unknown
p2pupdate.gamedl.qq.com
  • 111.161.108.227
  • 111.161.108.243
unknown

Threats

PID
Process
Class
Message
2796
TenioDL.exe
Generic Protocol Command Decode
ET INFO Session Traversal Utilities for NAT (STUN Binding Request obsolete rfc 3489 CHANGE-REQUEST attribute change IP flag false change port flag false)
2796
TenioDL.exe
Generic Protocol Command Decode
ET INFO Session Traversal Utilities for NAT (STUN Binding Request obsolete rfc 3489 CHANGE-REQUEST attribute change IP flag true change port flag false)
2796
TenioDL.exe
Generic Protocol Command Decode
ET INFO Session Traversal Utilities for NAT (STUN Binding Request obsolete rfc 3489 CHANGE-REQUEST attribute change IP flag false change port flag true)
—
—
Generic Protocol Command Decode
ET INFO Session Traversal Utilities for NAT (STUN Binding Request obsolete rfc 3489 CHANGE-REQUEST attribute change IP flag false change port flag false)
—
—
Generic Protocol Command Decode
ET INFO Session Traversal Utilities for NAT (STUN Binding Request obsolete rfc 3489 CHANGE-REQUEST attribute change IP flag false change port flag false)
Process
Message
GameDownload_gamedownload_i18n_hw-by6_100505_1.0.7773.123.exe
[Downloader] DriverType C: = 3
GameDownload_gamedownload_i18n_hw-by6_100505_1.0.7773.123.exe
[Downloader] GetLogicalDrives 4
GameDownload_gamedownload_i18n_hw-by6_100505_1.0.7773.123.exe
[Downloader] DriverType C: = 3
GameDownload_gamedownload_i18n_hw-by6_100505_1.0.7773.123.exe
[Downloader] DriverType C: = 3
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
GameDownload_gamedownload_i18n_hw-by6_100505_1.0.7773.123.exe