File name:

QQPCDownload1600.exe

Full analysis: https://app.any.run/tasks/12e97735-ce9c-49d6-a71e-9837edf28038
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: May 08, 2020, 13:13:09
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adware
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

B57FE319E54AE9101A18366471E428FB

SHA1:

CECACA4A3CE6DB8C5C3D125AFE968466E9B347E8

SHA256:

D3F4F81C5D755E717EDA1849D4932FA673C48E81DA960C906BD49DDC5E69B553

SSDEEP:

49152:rfd0GFi/pAEE7jnWURRlJswTbWLqf4i54:7d0GFi/pAEojRRlJdb/wD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • QQPCDownload1600.exe (PID: 3168)
      • QMBluerayInsHlp.exe (PID: 2640)
      • QQPCSoftCmd.exe (PID: 1604)
      • QQPCRTP.exe (PID: 3252)
      • regsvr32.exe (PID: 3304)
      • regsvr32.exe (PID: 2980)
      • QMMiYu.exe (PID: 2928)
      • regsvr32.exe (PID: 3196)
      • regsvr32.exe (PID: 480)
      • QMSuperScan.exe (PID: 2308)
      • QQPCTray.exe (PID: 1196)
      • QQPCRTP.exe (PID: 2400)
      • QQPCRTP.exe (PID: 1636)
      • QQPCRTP.exe (PID: 280)
      • QQPCTray.exe (PID: 3328)
      • QMCheckNetwork.exe (PID: 2012)
      • QMCheckNetwork.exe (PID: 2460)
      • QQPCTray.exe (PID: 3720)
      • InstallUninstallCube.exe (PID: 3636)
      • QQTrayMonitor.exe (PID: 3148)
      • VolSnapshot.exe (PID: 3224)
      • QQPCRealTimeSpeedup.exe (PID: 2956)
      • regsvr32.exe (PID: 3632)
      • QQRepair.EXE (PID: 4816)
      • svchost.exe (PID: 1052)
      • qmdl.exe (PID: 4176)
      • QQPCMgr.exe (PID: 5392)
      • QMPersonalCenter.exe (PID: 5112)
      • QQPCMgr.exe (PID: 4428)
      • explorer.exe (PID: 372)
      • svchost.exe (PID: 1804)
      • QQPCTray.exe (PID: 4104)
      • QQTrayMonitor.exe (PID: 5144)
      • QQPCTxtExt.exe (PID: 4212)
      • QQPCAuthorityRadar.exe (PID: 4160)
      • QQRepair.exe (PID: 4780)
      • QMBlueScreenFixSetup_13.5.20525.234__1579161095190.exe (PID: 5988)
      • QMRealTimeSpeedupSetup_13.5.20525.234__1579161095190.exe (PID: 5912)

    • Application was dropped or rewritten from another process

      • QQPCMgrDaemon.exe (PID: 3276)
      • RemNPX.exe (PID: 2588)
      • UpdateTrayIcon.exe (PID: 604)
      • InstallUninstallCube.exe (PID: 3636)
      • QMCheckNetwork.exe (PID: 2012)
      • QMCheckNetwork.exe (PID: 2460)
      • QMBluerayInsHlp.exe (PID: 2640)
      • QMMiYu.exe (PID: 2928)
      • QMSuperScan.exe (PID: 2308)
      • QQPCRTP.exe (PID: 2400)
      • QQPCRTP.exe (PID: 280)
      • QQPCRTP.exe (PID: 3252)
      • QQPCRTP.exe (PID: 1636)
      • QQPCRealTimeSpeedup.exe (PID: 2956)
      • QQRepair.EXE (PID: 4816)
      • QQPCSoftCmd.exe (PID: 1604)
      • QQPCMgr.exe (PID: 5392)
      • QQPCTray.exe (PID: 3720)
      • QQPCTray.exe (PID: 1196)
      • QQPCTray.exe (PID: 3328)
      • VolSnapshot.exe (PID: 3224)
      • QQTrayMonitor.exe (PID: 3148)
      • qmdl.exe (PID: 4176)
      • QQPCMgr.exe (PID: 4428)
      • QMPersonalCenter.exe (PID: 5112)
      • QQPCTray.exe (PID: 4104)
      • QQTrayMonitor.exe (PID: 5144)
      • QQPCTxtExt.exe (PID: 4212)
      • QQPCAuthorityRadar.exe (PID: 4160)
      • QQRepair.exe (PID: 4780)
      • QMBlueScreenFixSetup_13.5.20525.234__1579161095190.exe (PID: 5988)
      • QMRealTimeSpeedupSetup_13.5.20525.234__1579161095190.exe (PID: 5912)

    • Changes the autorun value in the registry

      • QQPCMgr_Setup.exe (PID: 1140)
      • QQPCRTP.exe (PID: 1636)

    • Registers / Runs the DLL via REGSVR32.EXE

      • QQPCMgr_Setup.exe (PID: 1140)
      • QQPCTray.exe (PID: 3328)

    • Downloads executable files from the Internet

      • QQPCDownload1600.exe (PID: 3168)

    • Actions looks like stealing of personal data

      • QQPCTray.exe (PID: 3328)
      • QQPCRTP.exe (PID: 1636)
      • explorer.exe (PID: 372)
      • QQPCAuthorityRadar.exe (PID: 4160)

    • Changes settings of System certificates

      • QQPCTray.exe (PID: 3328)
      • QQPCRTP.exe (PID: 1636)

  • SUSPICIOUS

    • Creates files in the user directory

      • QQPCDownload1600.exe (PID: 3168)
      • QMBluerayInsHlp.exe (PID: 2640)
      • QQPCMgr_Setup.exe (PID: 1140)
      • QMSuperScan.exe (PID: 2308)
      • QQPCTray.exe (PID: 3328)
      • qmdl.exe (PID: 4176)

    • Low-level read access rights to disk partition

      • QQPCDownload1600.exe (PID: 3168)
      • QQPCMgr_Setup.exe (PID: 1140)
      • QQPCRTP.exe (PID: 1636)
      • QMSuperScan.exe (PID: 2308)
      • QQPCTray.exe (PID: 3328)
      • QQRepair.EXE (PID: 4816)
      • QQPCTray.exe (PID: 4104)

    • Creates files in the program directory

      • QQPCMgrDaemon.exe (PID: 3276)
      • QQPCRTP.exe (PID: 3252)
      • QMSuperScan.exe (PID: 2308)
      • QMMiYu.exe (PID: 2928)
      • QQPCRTP.exe (PID: 1636)
      • InstallUninstallCube.exe (PID: 3636)
      • QQPCMgr_Setup.exe (PID: 1140)
      • QQPCTray.exe (PID: 3328)
      • QQPCRealTimeSpeedup.exe (PID: 2956)
      • QQRepair.EXE (PID: 4816)
      • qmdl.exe (PID: 4176)
      • QQPCTray.exe (PID: 4104)
      • QQPCAuthorityRadar.exe (PID: 4160)
      • QMBlueScreenFixSetup_13.5.20525.234__1579161095190.exe (PID: 5988)
      • QMRealTimeSpeedupSetup_13.5.20525.234__1579161095190.exe (PID: 5912)

    • Executable content was dropped or overwritten

      • QQPCDownload1600.exe (PID: 3168)
      • QQPCMgr_Setup.exe (PID: 1140)
      • QMMiYu.exe (PID: 2928)
      • QQPCRTP.exe (PID: 1636)
      • QQPCTray.exe (PID: 3328)
      • QQPCRealTimeSpeedup.exe (PID: 2956)
      • qmdl.exe (PID: 4176)
      • QMBlueScreenFixSetup_13.5.20525.234__1579161095190.exe (PID: 5988)
      • QMRealTimeSpeedupSetup_13.5.20525.234__1579161095190.exe (PID: 5912)

    • Creates COM task schedule object

      • regsvr32.exe (PID: 2980)
      • regsvr32.exe (PID: 480)
      • regsvr32.exe (PID: 3304)
      • regsvr32.exe (PID: 3196)
      • QQPCTray.exe (PID: 3328)
      • regsvr32.exe (PID: 3632)

    • Modifies the open verb of a shell class

      • QQPCMgr_Setup.exe (PID: 1140)
      • QQPCTray.exe (PID: 3328)

    • Creates a software uninstall entry

      • QQPCMgr_Setup.exe (PID: 1140)

    • Creates files in the Windows directory

      • QQPCMgr_Setup.exe (PID: 1140)
      • QQPCRTP.exe (PID: 1636)
      • QQPCTray.exe (PID: 3328)

    • Creates or modifies windows services

      • QQPCMgr_Setup.exe (PID: 1140)
      • QQPCRTP.exe (PID: 1636)
      • QQPCTray.exe (PID: 3328)
      • QQRepair.EXE (PID: 4816)

    • Creates files in the driver directory

      • QQPCMgr_Setup.exe (PID: 1140)
      • QQPCTray.exe (PID: 3328)
      • QQPCRTP.exe (PID: 1636)

    • Uses NETSH.EXE for network configuration

      • QQPCMgr_Setup.exe (PID: 1140)

    • Uses REG.EXE to modify Windows registry

      • regsvr32.exe (PID: 3196)

    • Application launched itself

      • QMCheckNetwork.exe (PID: 2012)

    • Executed as Windows Service

      • QQPCRTP.exe (PID: 1636)
      • vssvc.exe (PID: 2840)

    • Reads Internet Cache Settings

      • QQPCTray.exe (PID: 3328)

    • Searches for installed software

      • QQPCTray.exe (PID: 3328)
      • QQPCRTP.exe (PID: 1636)
      • QQPCAuthorityRadar.exe (PID: 4160)

    • Starts SC.EXE for service management

      • QQRepair.EXE (PID: 4816)

    • Uses ICACLS.EXE to modify access control list

      • qmdl.exe (PID: 4176)

    • Adds / modifies Windows certificates

      • QQPCTray.exe (PID: 3328)
      • QQPCRTP.exe (PID: 1636)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • QQPCMgr_Setup.exe (PID: 1140)
      • QQPCTray.exe (PID: 3328)
      • QMBlueScreenFixSetup_13.5.20525.234__1579161095190.exe (PID: 5988)

    • Reads settings of System Certificates

      • QQPCRTP.exe (PID: 1636)
      • QQPCTray.exe (PID: 3328)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1970:01:05 06:15:44+01:00
PEType: PE32
LinkerVersion: 8
CodeSize: 262144
InitializedDataSize: 98304
UninitializedDataSize: -
EntryPoint: 0x2e259
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.0.6.27
ProductVersionNumber: 2.0.6.27
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
FileDescription: 腾讯电脑管家在线安装程序
FileVersion: 2.0.6.27
LegalCopyright: Copyright (C) 1998 - 2018 Tencent. All Rights Reserved.
ProductName: 腾讯电脑管家
ProductVersion: 2.0.6.27

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 05-Jan-1970 05:15:44
Detected languages:
  • Chinese - PRC
  • English - United States
Debug artifacts:
  • e:\Code\1_PCDownloader\PackageTools\product\win32\dbginfo\kpacket.pdb
FileDescription: 腾讯电脑管家在线安装程序
FileVersion: 2.0.6.27
LegalCopyright: Copyright (C) 1998 - 2018 Tencent. All Rights Reserved.
ProductName: 腾讯电脑管家
ProductVersion: 2.0.6.27

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000F0

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 4
Time date stamp: 05-Jan-1970 05:15:44
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0003F78D
0x00040000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.64327
.rdata
0x00041000
0x0000E2C8
0x0000F000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.63344
.data
0x00050000
0x00006E80
0x00003000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.22774
.rsrc
0x00057000
0x000051B8
0x00006000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.44407

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.08691
763
Latin 1 / Western European
English - United States
RT_MANIFEST
2
3.04211
2216
Latin 1 / Western European
Chinese - PRC
RT_ICON
3
2.75499
1384
Latin 1 / Western European
Chinese - PRC
RT_ICON
4
3.02798
9640
Latin 1 / Western European
Chinese - PRC
RT_ICON
5
3.25238
4264
Latin 1 / Western European
Chinese - PRC
RT_ICON
6
4.60151
1128
Latin 1 / Western European
Chinese - PRC
RT_ICON
101
2.69653
90
Latin 1 / Western European
Chinese - PRC
RT_GROUP_ICON

Imports

ADVAPI32.dll
KERNEL32.dll
OLEAUT32.dll
SHLWAPI.dll
USER32.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
121
Monitored processes
60
Malicious processes
32
Suspicious processes
4

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start qqpcdownload1600.exe qqpcmgr_setup.exe cacls.exe no specs qqpcmgrdaemon.exe qmbluerayinshlp.exe no specs regsvr32.exe no specs qqpcsoftcmd.exe netsh.exe no specs qqpcrtp.exe no specs remnpx.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs qmsuperscan.exe reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs qmmiyu.exe reg.exe no specs reg.exe no specs reg.exe no specs qqpctray.exe no specs qqpcrtp.exe no specs qmchecknetwork.exe qmchecknetwork.exe qqpcrtp.exe no specs qqpcrtp.exe qqpctray.exe qqpctray.exe updatetrayicon.exe no specs installuninstallcube.exe qqtraymonitor.exe volsnapshot.exe qqpcrealtimespeedup.exe regsvr32.exe no specs vssvc.exe no specs qqrepair.exe sc.exe no specs svchost.exe svchost.exe no specs qqpcmgr.exe qmdl.exe qmpersonalcenter.exe icacls.exe no specs sc.exe no specs qqpcmgr.exe qqpctray.exe explorer.exe qqtraymonitor.exe sc.exe no specs qqpctxtext.exe no specs qqpcauthorityradar.exe qmbluescreenfixsetup_13.5.20525.234__1579161095190.exe qqrepair.exe qmrealtimespeedupsetup_13.5.20525.234__1579161095190.exe sc.exe no specs sc.exe no specs qqpcdownload1600.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
280"C:\Program Files\Tencent\QQPCMgr\13.5.20525.234\QQPCRTP.exe" -sC:\Program Files\Tencent\QQPCMgr\13.5.20525.234\QQPCRTP.exe—QQPCMgr_Setup.exe
User:
admin
Company:
Tencent
Integrity Level:
HIGH
Description:
电脑管家-实时防护服务
Exit code:
0
Version:
13,5,20525,234
Modules
Images
c:\program files\tencent\qqpcmgr\13.5.20525.234\qqpcrtp.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\user32.dll
372C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\winanr.dll
c:\windows\system32\wshtcpip.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
480"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Tencent\QQPCMgr\13.5.20525.234\QMContextUninstall.dll"C:\Windows\system32\regsvr32.exe—QQPCMgr_Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
548reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{29B6CFD5-0064-411A-8C42-9890C83F9921}\iexplore\AllowedDomains\sogou.com" /fC:\Windows\system32\reg.exe—regsvr32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
604"C:\Users\admin\AppData\Local\Temp\Tencent\QQPCMgr\~aa92ee\UpdateTrayIcon.exe" -t QQPCTray.exe -c 1 -p 1 -d "C:\Program Files\Tencent\QQPCMgr\13.5.20525.234\"C:\Users\admin\AppData\Local\Temp\Tencent\QQPCMgr\~aa92ee\UpdateTrayIcon.exe—QQPCMgr_Setup.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\tencent\qqpcmgr\~aa92ee\updatetrayicon.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
628reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{29B6CFD5-0064-411A-8C42-9890C83F9921}\iexplore\AllowedDomains\qq.com" /fC:\Windows\system32\reg.exe—regsvr32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1052C:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1084reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{29B6CFD5-0064-411A-8C42-9890C83F9921}\iexplore" /v Flags /t reg_dword /d 4 /fC:\Windows\system32\reg.exe—regsvr32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1140"C:\Users\admin\AppData\Roaming\tencent\QQPCMgr\Download\QQPCMgr_Setup.exe" /S ##silence=1&handle=590316&update=1&supply=1600&forceinstall=1&qqpcmgr=0&xsurl="http://dlied6.qq.com/invc/xfspeed/qqpcmgr/other/GuideCloudData52.zip"&DownloadSetupInOne=2&installpath="C:\Program Files\Tencent\QQPCMgr"&NeedDownGuideData=1C:\Users\admin\AppData\Roaming\tencent\QQPCMgr\Download\QQPCMgr_Setup.exe
QQPCDownload1600.exe
User:
admin
Company:
Tencent
Integrity Level:
HIGH
Description:
电脑管家
Exit code:
0
Version:
13.5.20525.234
Modules
Images
c:\users\admin\appdata\roaming\tencent\qqpcmgr\download\qqpcmgr_setup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1196"C:\Program Files\Tencent\QQPCMgr\13.5.20525.234\QQPCTray.exe" /loadexit /superfetch:1C:\Program Files\Tencent\QQPCMgr\13.5.20525.234\QQPCTray.exe—QQPCMgr_Setup.exe
User:
admin
Company:
Tencent
Integrity Level:
HIGH
Description:
电脑管家
Exit code:
0
Version:
13.5.20525.234
Modules
Images
c:\program files\tencent\qqpcmgr\13.5.20525.234\qqpctray.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
Total events
7 899
Read events
4 991
Write events
2 883
Delete events
25

Modification events

(PID) Process:(1052) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Nla\Cache\Intranet
Operation:writeName:{4040CF00-1B3E-486A-B407-FA14C56B6FC0}
Value:
525400363EFF
(PID) Process:(372) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Operation:writeName:P:\Hfref\nqzva\Qrfxgbc\DDCPQbjaybnq1600.rkr
Value:
00000000000000000100000000000000000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BFFFFFFFFF000000000000000000000000
(PID) Process:(372) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Operation:writeName:HRZR_PGYFRFFVBA
Value:
000000004200000054000000120E26000B0000001A00000057BE0F007B00460033003800420046003400300034002D0031004400340033002D0034003200460032002D0039003300300035002D003600370044004500300042003200380046004300320033007D005C006500780070006C006F007200650072002E0065007800650000000010000024E9ED017990C577B8006900000069000010000050E9ED01C4F6C4770000690000000000580269000002690064E9ED016C19C5770D00000000026900580269002CEBED0128EBED01000008009786217614E8ED0114EAED01D8E9ED0115E1C077C7670800FEFFFFFF8B8DC477108BC47701000000010000000000000004EAED01CCE9ED01E8E9ED012C8AC375010000000000000004EAED013F8AC375ED1805AB000000006CEFED0102000000FFFFFFFF0000000000000000000000000000E96FACE9ED01485F9B0050EEED01B514C5754D7B2BDFFEFFFFFF3F8AC375A36CC375A589C375651F05AB6CEFED0111000000483D3200403D32006CEFED017CEA0000C05704AB2CEAED018291D2767CEAED01EC430000FC5704AB40EAED01B69CD276F04311024C06000058EAED01603F110264EAED01789CD2763691D27611000000483D3200403D320000EBED01803F1102D0EA0000BC5704AB80EAED018291D276D0EAED0184EAED012795D27600000000EC431102ACEAED01CD94D276EC43110258EBED01603F1102E194D27600000000603F110258EBED01B4EAED010B0000001A00000057BE0F007B00460033003800420046003400300034002D0031004400340033002D0034003200460032002D0039003300300035002D003600370044004500300042003200380046004300320033007D005C006500780070006C006F007200650072002E0065007800650000000010000024E9ED017990C577B8006900000069000010000050E9ED01C4F6C4770000690000000000580269000002690064E9ED016C19C5770D00000000026900580269002CEBED0128EBED01000008009786217614E8ED0114EAED01D8E9ED0115E1C077C7670800FEFFFFFF8B8DC477108BC47701000000010000000000000004EAED01CCE9ED01E8E9ED012C8AC375010000000000000004EAED013F8AC375ED1805AB000000006CEFED0102000000FFFFFFFF0000000000000000000000000000E96FACE9ED01485F9B0050EEED01B514C5754D7B2BDFFEFFFFFF3F8AC375A36CC375A589C375651F05AB6CEFED0111000000483D3200403D32006CEFED017CEA0000C05704AB2CEAED018291D2767CEAED01EC430000FC5704AB40EAED01B69CD276F04311024C06000058EAED01603F110264EAED01789CD2763691D27611000000483D3200403D320000EBED01803F1102D0EA0000BC5704AB80EAED018291D276D0EAED0184EAED012795D27600000000EC431102ACEAED01CD94D276EC43110258EBED01603F1102E194D27600000000603F110258EBED01B4EAED010B0000001A00000057BE0F007B00460033003800420046003400300034002D0031004400340033002D0034003200460032002D0039003300300035002D003600370044004500300042003200380046004300320033007D005C006500780070006C006F007200650072002E0065007800650000000010000024E9ED017990C577B8006900000069000010000050E9ED01C4F6C4770000690000000000580269000002690064E9ED016C19C5770D00000000026900580269002CEBED0128EBED01000008009786217614E8ED0114EAED01D8E9ED0115E1C077C7670800FEFFFFFF8B8DC477108BC47701000000010000000000000004EAED01CCE9ED01E8E9ED012C8AC375010000000000000004EAED013F8AC375ED1805AB000000006CEFED0102000000FFFFFFFF0000000000000000000000000000E96FACE9ED01485F9B0050EEED01B514C5754D7B2BDFFEFFFFFF3F8AC375A36CC375A589C375651F05AB6CEFED0111000000483D3200403D32006CEFED017CEA0000C05704AB2CEAED018291D2767CEAED01EC430000FC5704AB40EAED01B69CD276F04311024C06000058EAED01603F110264EAED01789CD2763691D27611000000483D3200403D320000EBED01803F1102D0EA0000BC5704AB80EAED018291D276D0EAED0184EAED012795D27600000000EC431102ACEAED01CD94D276EC43110258EBED01603F1102E194D27600000000603F110258EBED01B4EAED01
(PID) Process:(1140) QQPCMgr_Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Tencent\QQPCMgr
Operation:writeName:SupplyID
Value:
1600
(PID) Process:(1140) QQPCMgr_Setup.exeKey:HKEY_USERS\QMCONFIG\QQDoctor\QQDoctor\ComCfg
Operation:writeName:defSimpleVersionNetConfig
Value:
7B74EA37
(PID) Process:(1140) QQPCMgr_Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Tencent\QQPCMgr
Operation:writeName:QQPCMgrInstallTime
Value:
8A5BB55E00000000
(PID) Process:(1140) QQPCMgr_Setup.exeKey:HKEY_USERS\QMCONFIG\QQDoctor\QQDoctor\ComCfg
Operation:writeName:GameExposure_ShowedDeskTopTip
Value:
7874EA37
(PID) Process:(1140) QQPCMgr_Setup.exeKey:HKEY_USERS\QMCONFIG\QQDoctor\QQDoctor\ComCfg
Operation:writeName:GameExposure_ShowSpeedupTabTips
Value:
7B74EA37
(PID) Process:(1140) QQPCMgr_Setup.exeKey:HKEY_USERS\QMCONFIG\QQDoctor\QQDoctor\ComCfg
Operation:writeName:QQPCMgrNewUITypeValue
Value:
7974EA37
(PID) Process:(372) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Operation:writeName:P:\Hfref\nqzva\Qrfxgbc\DDCPQbjaybnq1600.rkr
Value:
000000000000000001000000C0D40100000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BFFFFFFFFF000000000000000000000000
Executable files
513
Suspicious files
415
Text files
650
Unknown types
84

Dropped files

PID
Process
Filename
Type
3168QQPCDownload1600.exeC:\Users\admin\AppData\Roaming\Tencent\QQPCMgr\Download\version —
MD5:—
SHA256:—
3168QQPCDownload1600.exeC:\Users\admin\AppData\Roaming\tencent\QQPCMgr\Download\QQPCMgr_Setup.exe —
MD5:—
SHA256:—
3168QQPCDownload1600.exeC:\Users\admin\AppData\Local\Temp\TencentDownload\~a887ad\QQPCDownload.dllexecutable
MD5:—
SHA256:—
3168QQPCDownload1600.exeC:\Users\admin\AppData\Local\Temp\TencentDownload\~a887ad\QQPCDownload.kuicompressed
MD5:—
SHA256:—
3168QQPCDownload1600.exeC:\Users\admin\AppData\Roaming\Tencent\DeskUpdate\GlobalMgr.dbtext
MD5:—
SHA256:—
3168QQPCDownload1600.exeC:\Users\admin\AppData\Local\Temp\8A0E.tmpbinary
MD5:—
SHA256:—
3168QQPCDownload1600.exeC:\Users\admin\AppData\Local\Temp\TencentDownload\~a887ad\setup.xmlxml
MD5:—
SHA256:—
3168QQPCDownload1600.exeC:\Users\admin\AppData\Local\Temp\UIConfig.Zipcompressed
MD5:—
SHA256:—
1140QQPCMgr_Setup.exeC:\Users\admin\AppData\Local\Temp\Tencent\QQPCMgr\~aa92ee\bugreport.exeexecutable
MD5:—
SHA256:—
3168QQPCDownload1600.exeC:\Users\admin\AppData\Roaming\Tencent\QQPCMgr\GuidePic03.pngimage
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
114
TCP/UDP connections
203
DNS requests
46
Threats
26

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3276
QQPCMgrDaemon.exe
GET
302
203.205.137.182:80
http://dlied6.qq.com/invc/xfspeed/qqpcmgr/other/GuideCloudData52.zip
CN
—
—
whitelisted
3168
QQPCDownload1600.exe
GET
200
203.205.137.182:80
http://dlied6.qq.com/invc/xfspeed/qqpcmgr/versetup/update/PCMgr_Setup_135_20525_234.exe
CN
executable
74.0 Mb
whitelisted
3276
QQPCMgrDaemon.exe
GET
200
203.205.137.101:80
http://203.205.137.101/dlied6.qq.com/invc/xfspeed/qqpcmgr/other/GuideCloudData52.zip?mkey=5eb57d78b9d9536d&f=0a7c&cip=185.217.117.152&proto=http
CN
compressed
514 Kb
malicious
3168
QQPCDownload1600.exe
GET
200
203.205.137.182:80
http://dlied6.qq.com/invc/xfspeed/qqpcmgr/other/007151615C7E41FF6324D0E6ABBFC28B.zip
CN
compressed
266 Kb
whitelisted
2308
QMSuperScan.exe
POST
200
219.133.60.246:80
http://www.qq.com/q.cgi
CN
binary
250 b
unknown
2308
QMSuperScan.exe
POST
200
203.205.239.243:80
http://www.qq.com/q.cgi
CN
abr
1.70 Kb
unknown
1636
QQPCRTP.exe
POST
200
203.205.239.243:80
http://www.qq.com/q.cgi
CN
abr
1.70 Kb
unknown
1636
QQPCRTP.exe
POST
200
203.205.239.243:80
http://www.qq.com/q.cgi
CN
abr
282 b
unknown
3328
QQPCTray.exe
POST
—
203.205.239.243:80
http://www.qq.com/q.cgi
CN
—
—
unknown
3328
QQPCTray.exe
POST
200
203.205.239.243:80
http://www.qq.com/q.cgi
CN
abr
146 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3168
QQPCDownload1600.exe
58.251.106.185:443
master.etl.desktop.qq.com
China Unicom Guangdong IP network
CN
malicious
3168
QQPCDownload1600.exe
203.205.253.183:80
c.gj.qq.com
—
CN
suspicious
3168
QQPCDownload1600.exe
203.205.253.140:80
c.gj.qq.com
—
CN
suspicious
3168
QQPCDownload1600.exe
203.205.137.182:80
dlied6.qq.com
Tencent Building, Kejizhongyi Avenue
CN
suspicious
2308
QMSuperScan.exe
203.205.239.243:80
conna.gj.qq.com
—
CN
unknown
2308
QMSuperScan.exe
203.205.254.111:36688
connc.gj.qq.com
—
CN
malicious
2012
QMCheckNetwork.exe
203.205.239.243:80
conna.gj.qq.com
—
CN
unknown
2012
QMCheckNetwork.exe
203.205.239.243:8000
conna.gj.qq.com
—
CN
unknown
2460
QMCheckNetwork.exe
203.205.239.243:80
conna.gj.qq.com
—
CN
unknown
1636
QQPCRTP.exe
203.205.239.243:80
conna.gj.qq.com
—
CN
unknown

DNS requests

Domain
IP
Reputation
master.etl.desktop.qq.com
  • 58.251.106.185
whitelisted
c.gj.qq.com
  • 203.205.253.183
  • 203.205.253.140
unknown
dlied6.qq.com
  • 203.205.137.182
  • 203.205.137.186
  • 203.205.137.72
  • 203.205.137.101
whitelisted
masterconn11.qq.com
  • —
whitelisted
connc.gj.qq.com
  • 203.205.254.111
unknown
conna.gj.qq.com
  • 203.205.239.243
unknown
connpm.gj.qq.com
  • 203.205.253.186
whitelisted
connps.gj.qq.com
  • 59.37.96.250
unknown
connb.gj.qq.com
  • 219.133.60.246
  • 183.57.48.55
unknown
localhost.ptlogin2.qq.com
  • 127.0.0.1
unknown

Threats

PID
Process
Class
Message
3168
QQPCDownload1600.exe
Misc activity
ADWARE [PTsecurity] QQ_games PUP Installer
3168
QQPCDownload1600.exe
Misc activity
ADWARE [PTsecurity] QQ_games PUP Installer
3168
QQPCDownload1600.exe
Generic Protocol Command Decode
SURICATA STREAM CLOSEWAIT FIN out of window
3168
QQPCDownload1600.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1140
QQPCMgr_Setup.exe
Generic Protocol Command Decode
SURICATA TLS error message encountered
1140
QQPCMgr_Setup.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
1140
QQPCMgr_Setup.exe
Misc activity
ADWARE [PTsecurity] QQ_games PUP Installer
1140
QQPCMgr_Setup.exe
Generic Protocol Command Decode
SURICATA TLS error message encountered
1140
QQPCMgr_Setup.exe
Misc activity
ADWARE [PTsecurity] QQ_games PUP Installer
1140
QQPCMgr_Setup.exe
Misc activity
ADWARE [PTsecurity] QQ_games PUP Installer
Process
Message
QQPCMgr_Setup.exe
"cacls" "C:\Program Files\Tencent\QQPCMgr\13.5.20525.234" /t /e /c /g SYSTEM:f
QQPCSoftCmd.exe
=========== mem dump after here is valid ========
QQPCMgr_Setup.exe
0
QQPCMgr_Setup.exe
CreateService
QQPCMgr_Setup.exe
0
QQPCMgr_Setup.exe
StartService
QQPCMgr_Setup.exe
CreateService
QQPCMgr_Setup.exe
0
QQPCMgr_Setup.exe
StartService
QQPCMgr_Setup.exe
0
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
QQPCDownload1600.exe