File name:

GLP_Installer_900205157_PUBGM.exe

Full analysis: https://app.any.run/tasks/b5e560c3-8296-4997-99e0-f967a70debea
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: May 15, 2021, 08:03:59
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

05376C78D4004EC439D6F6D4281B3BAA

SHA1:

A63530AD6772613F5E7DEF479323CC09AD74F449

SHA256:

C8F07ECDE8228968ECD6A02BD0D32BDEB23BA477A09627BA3CE482F4A89C88E3

SSDEEP:

24576:0/KiLPCdw5c8RxEUqckhIXrnq7nJVL8ZXFzIohqXpSU9WRTLb7eofAdzxqvyUHaD:PiLPCG5Icnq7JVQpVIok587qxqBaD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • GLP_Installer_900205157_PUBGM.exe (PID: 2352)
      • Market.exe (PID: 3360)
      • Tinst.exe (PID: 1396)
      • GameDownload.exe (PID: 2672)

    • Loads dropped or rewritten executable

      • GLP_Installer_900205157_PUBGM.exe (PID: 2352)
      • QMEmulatorService.exe (PID: 2872)
      • AppMarket.exe (PID: 3688)
      • TBSWebRenderer.exe (PID: 4044)

    • Changes settings of System certificates

      • GLP_Installer_900205157_PUBGM.exe (PID: 2352)
      • AppMarket.exe (PID: 3688)

    • Application was dropped or rewritten from another process

      • Tinst.exe (PID: 1396)
      • QMEmulatorService.exe (PID: 2872)
      • AppMarket.exe (PID: 3688)
      • syzs_dl_svr.exe (PID: 2680)
      • TBSWebRenderer.exe (PID: 4044)
      • GameDownload.exe (PID: 2672)

    • Adds new firewall rule via NETSH.EXE

      • Tinst.exe (PID: 1396)

    • Actions looks like stealing of personal data

      • AppMarket.exe (PID: 3688)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • GLP_Installer_900205157_PUBGM.exe (PID: 2352)
      • Market.exe (PID: 3360)
      • Tinst.exe (PID: 1396)
      • GameDownload.exe (PID: 2672)

    • Drops a file that was compiled in debug mode

      • GLP_Installer_900205157_PUBGM.exe (PID: 2352)
      • Market.exe (PID: 3360)
      • Tinst.exe (PID: 1396)
      • GameDownload.exe (PID: 2672)

    • Creates files in the user directory

      • GLP_Installer_900205157_PUBGM.exe (PID: 2352)
      • Tinst.exe (PID: 1396)
      • GameDownload.exe (PID: 2672)
      • AppMarket.exe (PID: 3688)

    • Adds / modifies Windows certificates

      • GLP_Installer_900205157_PUBGM.exe (PID: 2352)
      • AppMarket.exe (PID: 3688)

    • Low-level read access rights to disk partition

      • GLP_Installer_900205157_PUBGM.exe (PID: 2352)
      • QMEmulatorService.exe (PID: 2872)
      • AppMarket.exe (PID: 3688)
      • GameDownload.exe (PID: 2672)

    • Creates a directory in Program Files

      • GLP_Installer_900205157_PUBGM.exe (PID: 2352)
      • Tinst.exe (PID: 1396)

    • Drops a file with too old compile date

      • Tinst.exe (PID: 1396)
      • Market.exe (PID: 3360)

    • Executed as Windows Service

      • QMEmulatorService.exe (PID: 2872)

    • Creates files in the program directory

      • QMEmulatorService.exe (PID: 2872)
      • Tinst.exe (PID: 1396)
      • GLP_Installer_900205157_PUBGM.exe (PID: 2352)
      • syzs_dl_svr.exe (PID: 2680)
      • AppMarket.exe (PID: 3688)

    • Uses NETSH.EXE for network configuration

      • Tinst.exe (PID: 1396)

    • Creates a software uninstall entry

      • Tinst.exe (PID: 1396)

    • Creates files in the Windows directory

      • QMEmulatorService.exe (PID: 2872)

    • Changes default file association

      • Tinst.exe (PID: 1396)
      • AppMarket.exe (PID: 3688)

    • Drops a file with a compile date too recent

      • AppMarket.exe (PID: 3688)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • Tinst.exe (PID: 1396)
      • AppMarket.exe (PID: 3688)

    • Reads the hosts file

      • AppMarket.exe (PID: 3688)
      • GameDownload.exe (PID: 2672)

    • Reads settings of System Certificates

      • AppMarket.exe (PID: 3688)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (3.6)
.exe | Generic Win/DOS Executable (1.6)
.exe | DOS Executable Generic (1.5)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 5.1
ImageVersion: -
OSVersion: 5.1
EntryPoint: 0x7c0d1
UninitializedDataSize: -
InitializedDataSize: 736256
CodeSize: 819200
LinkerVersion: 14
PEType: PE32
TimeStamp: 2020:02:21 15:04:52+01:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 21-Feb-2020 14:04:52
Detected languages:
  • Chinese - PRC
  • English - United States
Debug artifacts:
  • D:\Devops\agent\workspace\p-111758179e0043a5b011650a32a71ea0\src\TGBDownloader\Output\TGBDownloader\Release\TGBDownloader.pdb

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000118

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 8
Time date stamp: 21-Feb-2020 14:04:52
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x000C7F23
0x000C8000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.64604
.rdata
0x000C9000
0x0003163C
0x00031800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.14655
.data
0x000FB000
0x00006504
0x00004C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.6235
.gfids
0x00102000
0x00000CE8
0x00000E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.74181
.tls
0x00103000
0x00000009
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.0203931
.QMGuid
0x00104000
0x00000014
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x00105000
0x0006E480
0x0006E600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.78935
.reloc
0x00174000
0x0000C408
0x0000C600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.53711

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.06216
651
UNKNOWN
English - United States
RT_MANIFEST
7
2.32128
84
UNKNOWN
Chinese - PRC
RT_STRING
107
1.91924
20
UNKNOWN
Chinese - PRC
RT_GROUP_ICON
109
3.24529
80
UNKNOWN
Chinese - PRC
RT_MENU
133
7.99644
354782
UNKNOWN
Chinese - PRC
ZIPRES
134
6.36562
9662
UNKNOWN
Chinese - PRC
CUSTOM
135
5.81636
76168
UNKNOWN
Chinese - PRC
CUSTOM

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
IMM32.dll
KERNEL32.dll
NETAPI32.dll
SHELL32.dll
SHLWAPI.dll
USER32.dll
VERSION.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
64
Monitored processes
15
Malicious processes
7
Suspicious processes
0

Behavior graph

Click at the process to see the details
start glp_installer_900205157_pubgm.exe market.exe tinst.exe qmemulatorservice.exe netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs appmarket.exe syzs_dl_svr.exe tbswebrenderer.exe no specs gamedownload.exe glp_installer_900205157_pubgm.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
752"C:\Users\admin\AppData\Local\Temp\GLP_Installer_900205157_PUBGM.exe" C:\Users\admin\AppData\Local\Temp\GLP_Installer_900205157_PUBGM.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\glp_installer_900205157_pubgm.exe
c:\systemroot\system32\ntdll.dll
1396"C:\Temp\TxGameDownload\Component\AppMarket\Setup\Tinst.exe" C:\Temp\TxGameDownload\Component\AppMarket\Setup\Tinst.exe
GLP_Installer_900205157_PUBGM.exe
User:
admin
Integrity Level:
HIGH
Description:
TMarketInst
Exit code:
0
Version:
3.11.1277.81
Modules
Images
c:\temp\txgamedownload\component\appmarket\setup\tinst.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\psapi.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2352"C:\Users\admin\AppData\Local\Temp\GLP_Installer_900205157_PUBGM.exe" C:\Users\admin\AppData\Local\Temp\GLP_Installer_900205157_PUBGM.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\glp_installer_900205157_pubgm.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\user32.dll
2420"C:\Windows\system32\Netsh.exe" advfirewall firewall add rule name="AppMarket" dir=in program="c:\program files\txgameassistant\appmarket\AppMarket.exe" action=allowC:\Windows\system32\Netsh.exe—Tinst.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
2444"C:\Windows\system32\Netsh.exe" advfirewall firewall add rule name="bugreport" dir=in program="c:\program files\txgameassistant\appmarket\bugreport.exe" action=allowC:\Windows\system32\Netsh.exe—Tinst.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
2672"C:\Program Files\TxGameAssistant\AppMarket\GameDownload.exe" -component -noupdate -from appmark -notiywnd 459074 -pkg com.tencent.ig -vdiver aow_71 -downspeedlimit 0 -no_install_vdi -no_install_vdi44 -no_install_vbox -install_aow_rootfs -aeparam -engine aow -aeparamendC:\Program Files\TxGameAssistant\AppMarket\GameDownload.exe
AppMarket.exe
User:
admin
Company:
Tencent
Integrity Level:
HIGH
Description:
Gameloop - Install
Exit code:
0
Version:
3.11.1277.81
Modules
Images
c:\program files\txgameassistant\appmarket\gamedownload.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\psapi.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
2680"C:\Program Files\TxGameAssistant\AppMarket\DL\syzs_dl_svr.exe" --conf-path="C:\Program Files\TxGameAssistant\AppMarket\DL\syzs_dl_svr.cfg" --daemon --log="C:\Program Files\TxGameAssistant\AppMarket\DL\syzs_dl_svr.log"C:\Program Files\TxGameAssistant\AppMarket\DL\syzs_dl_svr.exe
AppMarket.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\txgameassistant\appmarket\dl\syzs_dl_svr.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
2836"C:\Windows\system32\Netsh.exe" advfirewall firewall add rule name="TUpdate" dir=in program="c:\program files\txgameassistant\appmarket\GF186\TUpdate.exe" action=allowC:\Windows\system32\Netsh.exe—Tinst.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
2872"C:\Program Files\TxGameAssistant\AppMarket\QMEmulatorService.exe"C:\Program Files\TxGameAssistant\AppMarket\QMEmulatorService.exe
services.exe
User:
SYSTEM
Company:
Tencent
Integrity Level:
SYSTEM
Description:
腾讯手游助手
Exit code:
0
Version:
3.11.1277.81
Modules
Images
c:\program files\txgameassistant\appmarket\qmemulatorservice.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
3360"C:\Temp\TxGameDownload\Component\AppMarket\Market.exe" C:\Temp\TxGameDownload\Component\AppMarket\Market.exe
GLP_Installer_900205157_PUBGM.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\temp\txgamedownload\component\appmarket\market.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
1 397
Read events
573
Write events
824
Delete events
0

Modification events

(PID) Process:(2352) GLP_Installer_900205157_PUBGM.exeKey:HKEY_CURRENT_USER\Software\Tencent\MobileGamePC
Operation:writeName:TempPath
Value:
C:\Temp\TxGameDownload\Component\
(PID) Process:(2352) GLP_Installer_900205157_PUBGM.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Tencent\MobileGamePC
Operation:writeName:SupplyId
Value:
900205157
(PID) Process:(2352) GLP_Installer_900205157_PUBGM.exeKey:HKEY_CURRENT_USER\Software\Tencent\MobileGamePC
Operation:writeName:UserLanguage
Value:
en
(PID) Process:(2352) GLP_Installer_900205157_PUBGM.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2352) GLP_Installer_900205157_PUBGM.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436
Operation:writeName:Blob
Value:
04000000010000001000000079E4A9840D7D3A96D7C04FE2434C892E0F0000000100000014000000B34DDD372ED92E8F2ABFBB9E20A9D31F204F194B030000000100000014000000A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C54361D000000010000001000000059779E39E21A2E3DFCED6857ED5C5FD90B000000010000001200000044006900670069004300650072007400000014000000010000001400000003DE503556D14CBB66F0A3E21B1BC397B23DD1556200000001000000200000004348A0E9444C78CB265E058D5E8944B4D84F9662BD26DB257F8934A443C701615300000001000000230000003021301F06096086480186FD6C020130123010060A2B0601040182373C0101030200C0090000000100000034000000303206082B0601050507030106082B0601050507030206082B0601050507030406082B0601050507030306082B060105050703081900000001000000100000000F3A0527D242DE2DC98E5CFCB1E991EE2000000001000000B3030000308203AF30820297A0030201020210083BE056904246B1A1756AC95991C74A300D06092A864886F70D01010505003061310B300906035504061302555331153013060355040A130C446967694365727420496E6331193017060355040B13107777772E64696769636572742E636F6D3120301E06035504031317446967694365727420476C6F62616C20526F6F74204341301E170D3036313131303030303030305A170D3331313131303030303030305A3061310B300906035504061302555331153013060355040A130C446967694365727420496E6331193017060355040B13107777772E64696769636572742E636F6D3120301E06035504031317446967694365727420476C6F62616C20526F6F7420434130820122300D06092A864886F70D01010105000382010F003082010A0282010100E23BE11172DEA8A4D3A357AA50A28F0B7790C9A2A5EE12CE965B010920CC0193A74E30B753F743C46900579DE28D22DD870640008109CECE1B83BFDFCD3B7146E2D666C705B37627168F7B9E1E957DEEB748A308DAD6AF7A0C3906657F4A5D1FBC17F8ABBEEE28D7747F7A78995985686E5C23324BBF4EC0E85A6DE370BF7710BFFC01F685D9A844105832A97518D5D1A2BE47E2276AF49A33F84908608BD45FB43A84BFA1AA4A4C7D3ECF4F5F6C765EA04B37919EDC22E66DCE141A8E6ACBFECDB3146417C75B299E32BFF2EEFAD30B42D4ABB74132DA0CD4EFF881D5BB8D583FB51BE84928A270DA3104DDF7B216F24C0A4E07A8ED4A3D5EB57FA390C3AF270203010001A3633061300E0603551D0F0101FF040403020186300F0603551D130101FF040530030101FF301D0603551D0E0416041403DE503556D14CBB66F0A3E21B1BC397B23DD155301F0603551D2304183016801403DE503556D14CBB66F0A3E21B1BC397B23DD155300D06092A864886F70D01010505000382010100CB9C37AA4813120AFADD449C4F52B0F4DFAE04F5797908A32418FC4B2B84C02DB9D5C7FEF4C11F58CBB86D9C7A74E79829AB11B5E370A0A1CD4C8899938C9170E2AB0F1CBE93A9FF63D5E40760D3A3BF9D5B09F1D58EE353F48E63FA3FA7DBB466DF6266D6D16E418DF22DB5EA774A9F9D58E22B59C04023ED2D2882453E7954922698E08048A837EFF0D6796016DEACE80ECD6EAC4417382F49DAE1453E2AB93653CF3A5006F72EE8C457496C612118D504AD783C2C3A806BA7EBAF1514E9D889C1B9386CE2916C8AFF64B977255730C01B24A3E1DCE9DF477CB5B424080530EC2DBD0BBF45BF50B9A9F3EB980112ADC888C698345F8D0A3CC6E9D595956DDE
(PID) Process:(2352) GLP_Installer_900205157_PUBGM.exeKey:HKEY_CURRENT_USER\Software\Tencent\MobileGamePC\GameDownload
Operation:writeName:DownloadSpeed
Value:
0
(PID) Process:(2352) GLP_Installer_900205157_PUBGM.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Tencent\MobileGamePC\AppMarket
Operation:writeName:InstallPath
Value:
C:\Program Files\TxGameAssistant\AppMarket
(PID) Process:(2352) GLP_Installer_900205157_PUBGM.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2352) GLP_Installer_900205157_PUBGM.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(1396) Tinst.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
234
Suspicious files
253
Text files
2 887
Unknown types
27

Dropped files

PID
Process
Filename
Type
2352GLP_Installer_900205157_PUBGM.exeC:\test.tmp —
MD5:—
SHA256:—
2352GLP_Installer_900205157_PUBGM.exeC:\Temp\TxGameDownload\Component\AppMarket\Market.exe —
MD5:—
SHA256:—
3360Market.exeC:\Temp\TxGameDownload\Component\AppMarket\Setup\AECommonDll.dllexecutable
MD5:—
SHA256:—
3360Market.exeC:\Temp\TxGameDownload\Component\AppMarket\Setup\aowgameex2.datbinary
MD5:—
SHA256:—
2352GLP_Installer_900205157_PUBGM.exeC:\Users\admin\AppData\Local\Temp\TGBDownload\44A1.tmpxml
MD5:—
SHA256:—
2352GLP_Installer_900205157_PUBGM.exeC:\Users\admin\AppData\Roaming\Tencent\DeskUpdate\GlobalMgr.dbtext
MD5:—
SHA256:—
3360Market.exeC:\Temp\TxGameDownload\Component\AppMarket\Setup\AowGame.xmltext
MD5:—
SHA256:—
3360Market.exeC:\Temp\TxGameDownload\Component\AppMarket\Setup\api-ms-win-core-console-l1-1-0.dllexecutable
MD5:11E55839FCB3A53BDFED2A27FB7D5E80
SHA256:F6BDC8FFD172B44F4D169707D9A457AEEF619872661229B8629EE4F15EEFFF0D
3360Market.exeC:\Temp\TxGameDownload\Component\AppMarket\Setup\api-ms-win-core-file-l1-2-0.dllexecutable
MD5:EC4F2CB68DCF7E96516EB284003BE8BB
SHA256:3816BBB7DD76D8FC6A7B83A0ED2F61B23DD5FC0843D3308EE077CB725D5C9088
3360Market.exeC:\Temp\TxGameDownload\Component\AppMarket\Setup\api-ms-win-core-datetime-l1-1-0.dllexecutable
MD5:9F3CF9F22836C32D988D7C7E0A977E1B
SHA256:7D588A5A958E32875D7BD346D1371E6EBFD9D5D2EDE47755942BADFC9C74E207
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
29
TCP/UDP connections
370
DNS requests
34
Threats
49

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2352
GLP_Installer_900205157_PUBGM.exe
GET
200
2.17.122.208:80
http://dldir1.qq.com/syzs/syzs_cms/102cefd05e0ddbdb50231e11ad357f1f.exe
unknown
executable
66.6 Mb
whitelisted
3688
AppMarket.exe
POST
200
203.205.255.80:8080
http://wup.imtt.qq.com:8080/?encrypt=17&len=1024&v=3&iv=dcc07701132c4a38&id=a690d5f54b43ca535af266c3180769c7&qbkey=71C009536E95FB1DA8EFF7F6DE29088E5E99CAF68FDEB6E22C68ECA1F18E5FF023CD8F4B7A24DFB34D4A0736F04620C49017130DA7FC01AE419E9802EA0092717883035C19043DC09ECF51E711494C37828EE0D16FBD5C31DBD362973DC80DC5301979AD451698302E9C436292497AE04F61B8E2202620C793A93D24B9384357
CN
binary
160 b
suspicious
3688
AppMarket.exe
POST
—
183.62.104.184:80
http://masterconn.qq.com/q.cgi
CN
—
—
unknown
—
—
GET
200
163.181.56.211:80
http://ocsp.digicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQhnxEBNL9LgIhfSsTcHsrTt204QgQURNnISjOO01KNp5KUYR%2BayKW37MsCEAg2tmilQPInaJVg4XyuEN0%3D
US
der
471 b
whitelisted
—
—
GET
200
163.181.56.211:80
http://ocsp.digicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbJNRrm8KxusAb7DCqnMkE%3D
US
der
471 b
whitelisted
3688
AppMarket.exe
POST
200
203.205.255.80:8080
http://wup.imtt.qq.com:8080/?encrypt=17&len=1024&v=3&iv=3f6a6b99c99d4630&id=a690d5f54b43ca535af266c3180769c7&qbkey=11002B0F1935B1686021DA4022431BB849AA996CC2AAE81EEF730C2908AD2469AAB4E905D3AD8E80C63AC3CB7CFFC9D3DACA5077802760133684ABFB385587EEFC27B9DD564E95A2F011A8161FCFC4DB7623D754F6F5FED81AA80EECCD247D00442CB6BC8F7D1ABD338A469C3E0F0E30C24F0BB60A2A47007D48364A9B9572D0
CN
binary
112 b
suspicious
—
—
GET
200
163.181.56.211:80
http://ocsp.digicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbJNRrm8KxusAb7DCqnMkE%3D
US
der
471 b
whitelisted
—
—
GET
200
104.18.20.226:80
http://ocsp2.globalsign.com/gsorganizationvalsha2g2/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQMnk2cPe3vhNiR6XLHz4QGvBl7BwQUlt5h8b0cFilTHMDMfTuDAEDmGnwCDFvr0VyEz0kMgWJYSA%3D%3D
US
der
1.46 Kb
whitelisted
—
—
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCCwQAAAAAAURO8EJH
US
der
1.41 Kb
whitelisted
3688
AppMarket.exe
POST
200
203.205.239.243:80
http://masterconn.qq.com/q.cgi
CN
pi3
250 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2352
GLP_Installer_900205157_PUBGM.exe
58.251.106.185:443
master.etl.desktop.qq.com
China Unicom Guangdong IP network
CN
malicious
2352
GLP_Installer_900205157_PUBGM.exe
211.152.136.87:443
s.syzs.qq.com
—
CN
unknown
2352
GLP_Installer_900205157_PUBGM.exe
2.17.122.208:80
dldir1.qq.com
Akamai International B.V.
—
malicious
1396
Tinst.exe
203.205.224.59:443
s.syzs.qq.com
Tencent Building, Kejizhongyi Avenue
CN
suspicious
1396
Tinst.exe
211.152.136.87:443
s.syzs.qq.com
—
CN
unknown
2872
QMEmulatorService.exe
58.251.106.185:443
master.etl.desktop.qq.com
China Unicom Guangdong IP network
CN
malicious
3688
AppMarket.exe
58.251.106.185:443
master.etl.desktop.qq.com
China Unicom Guangdong IP network
CN
malicious
3688
AppMarket.exe
203.205.239.248:8081
oth.eve.mdt.qq.com
—
CN
unknown
3688
AppMarket.exe
124.156.189.17:443
unifiedaccess.gameloop.com
—
CN
unknown
3688
AppMarket.exe
203.205.235.218:8081
oth.eve.mdt.qq.com
—
CN
unknown

DNS requests

Domain
IP
Reputation
master.etl.desktop.qq.com
  • 58.251.106.185
whitelisted
s.syzs.qq.com
  • 211.152.136.87
  • 203.205.224.59
  • 211.152.136.88
suspicious
dldir1.qq.com
  • 2.17.122.208
  • 2.17.123.169
  • 2.17.120.35
  • 2.17.120.97
whitelisted
webapp.gameloop.com
  • 203.205.224.59
  • 211.152.136.88
suspicious
masterconn11.qq.com
  • 58.251.106.185
whitelisted
oth.eve.mdt.qq.com
  • 203.205.239.248
  • 203.205.235.218
  • 117.184.248.53
  • 183.192.177.65
  • 183.194.234.114
  • 117.184.248.54
  • 117.184.248.56
  • 117.184.248.52
  • 117.184.248.57
  • 117.184.248.51
  • 117.184.248.73
  • 117.184.248.47
unknown
wup.imtt.qq.com
  • 203.205.255.80
  • 203.205.255.78
  • 203.205.255.79
suspicious
unifiedaccess.gameloop.com
  • 124.156.189.17
  • 124.156.190.64
  • 129.226.103.140
  • 124.156.190.4
suspicious
sy.guanjia.qq.com
  • 203.205.235.145
whitelisted
masterconn.qq.com
  • 203.205.239.243
whitelisted

Threats

PID
Process
Class
Message
2352
GLP_Installer_900205157_PUBGM.exe
Generic Protocol Command Decode
SURICATA TLS error message encountered
2352
GLP_Installer_900205157_PUBGM.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
2352
GLP_Installer_900205157_PUBGM.exe
Generic Protocol Command Decode
SURICATA TLS error message encountered
2352
GLP_Installer_900205157_PUBGM.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2352
GLP_Installer_900205157_PUBGM.exe
Generic Protocol Command Decode
SURICATA TLS error message encountered
2352
GLP_Installer_900205157_PUBGM.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
2352
GLP_Installer_900205157_PUBGM.exe
Generic Protocol Command Decode
SURICATA TLS error message encountered
2872
QMEmulatorService.exe
Generic Protocol Command Decode
SURICATA TLS error message encountered
2872
QMEmulatorService.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
2872
QMEmulatorService.exe
Generic Protocol Command Decode
SURICATA TLS error message encountered
4 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
GLP_Installer_900205157_PUBGM.exe