File name:

ceshi.exe

Full analysis: https://app.any.run/tasks/e385f6ae-4faa-47ab-b530-2d1ec0e4816f
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: November 18, 2019, 06:35:39
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adware
pup
pua
softcnapp
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

83158E7DFE1590224758A5128B39F3C8

SHA1:

41295356A8E7B6E9A0147F14404A426539221C52

SHA256:

D713C1333DAA740AF7426E385938A34EE1D33B5AB6CAEA5D42FC7CE827831CF4

SSDEEP:

196608:vW9RHipIVkLHPUd3lclkW+0e7jvwkpaY8dFd579ERB:vrmuHs4t+0ejOFd7E/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • WnZipUtility.exe (PID: 2764)
      • WnZipPower32.exe (PID: 3380)
      • WnZipVirtualCD.exe (PID: 792)
      • WnZipPower32.exe (PID: 3968)
      • WnZipUtility.exe (PID: 1504)
      • WnZipService.exe (PID: 3376)
      • WnZipUpd.exe (PID: 3880)
      • WnZipUtility.exe (PID: 2056)
      • WnZipUtility.exe (PID: 1856)
      • WnZipUtility.exe (PID: 3696)

    • Connects to CnC server

      • WnZipUtility.exe (PID: 2764)
      • WnZipUtility.exe (PID: 1856)
      • WnZipUtility.exe (PID: 2056)

    • SOFTCNAPP was detected

      • WnZipUtility.exe (PID: 2764)
      • WnZipUpd.exe (PID: 3880)
      • WnZipUtility.exe (PID: 1504)
      • WnZipUtility.exe (PID: 1856)

    • Loads dropped or rewritten executable

      • WnZipPower32.exe (PID: 3968)

  • SUSPICIOUS

    • Uses TASKKILL.EXE to kill process

      • ceshi.exe (PID: 600)

    • Creates files in the program directory

      • ceshi.exe (PID: 600)
      • WnZipUtility.exe (PID: 2764)
      • WnZipUtility.exe (PID: 1504)

    • Creates files in the Windows directory

      • WnZipVirtualCD.exe (PID: 792)

    • Creates files in the driver directory

      • WnZipVirtualCD.exe (PID: 792)

    • Executable content was dropped or overwritten

      • ceshi.exe (PID: 600)
      • WnZipVirtualCD.exe (PID: 792)

    • Creates a software uninstall entry

      • WnZipUtility.exe (PID: 2764)

    • Creates COM task schedule object

      • WnZipPower32.exe (PID: 3968)

    • Executed as Windows Service

      • WnZipService.exe (PID: 3376)

    • Application launched itself

      • WnZipUtility.exe (PID: 1504)

    • Modifies the open verb of a shell class

      • WnZipUtility.exe (PID: 1504)
      • WnZipUtility.exe (PID: 2764)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (3.6)
.exe | Generic Win/DOS Executable (1.6)
.exe | DOS Executable Generic (1.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:08:14 04:38:09+02:00
PEType: PE32
LinkerVersion: 14
CodeSize: 1579008
InitializedDataSize: 8004096
UninitializedDataSize: -
EntryPoint: 0x40e5d
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 1.4.1.19814
ProductVersionNumber: 1.4.1.19814
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
CompanyName: 万能压缩
FileDescription: 万能压缩
FileVersion: 1.4.1.19814
InternalName: 万能压缩
LegalCopyright: Copyright (C) 2019
OriginalFileName: Install.exe
ProductName: 万能压缩
ProductVersion: 1,4,1,19814

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 14-Aug-2019 02:38:09
Detected languages:
  • Chinese - PRC
  • English - United States
CompanyName: 万能压缩
FileDescription: 万能压缩
FileVersion: 1.4.1.19814
InternalName: 万能压缩
LegalCopyright: Copyright (C) 2019
OriginalFilename: Install.exe
ProductName: 万能压缩
ProductVersion: 1,4,1,19814

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000148

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 7
Time date stamp: 14-Aug-2019 02:38:09
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x001817C3
0x00181800
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.64529
.rdata
0x00183000
0x00069304
0x00069400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.65144
.data
0x001ED000
0x0001245C
0x0000B400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.22735
.gfids
0x00200000
0x000001B4
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.59544
.tls
0x00201000
0x00000009
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.0203931
.rsrc
0x00202000
0x00718B34
0x00718C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.97158
.reloc
0x0091B000
0x000149E0
0x00014A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.58404

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.41141
1260
Latin 1 / Western European
English - United States
RT_MANIFEST
2
5.53107
67624
Latin 1 / Western European
Chinese - PRC
RT_ICON
3
5.88889
38056
Latin 1 / Western European
Chinese - PRC
RT_ICON
4
5.67784
16936
Latin 1 / Western European
Chinese - PRC
RT_ICON
5
5.94895
9640
Latin 1 / Western European
Chinese - PRC
RT_ICON
6
5.93778
5512
Latin 1 / Western European
Chinese - PRC
RT_ICON
7
6.16633
2440
Latin 1 / Western European
Chinese - PRC
RT_ICON
8
6.07871
1720
Latin 1 / Western European
Chinese - PRC
RT_ICON
9
6.0888
1128
Latin 1 / Western European
Chinese - PRC
RT_ICON
101
3.09794
132
Latin 1 / Western European
Chinese - PRC
RT_GROUP_ICON

Imports

ADVAPI32.dll
COMCTL32.dll
CRYPT32.dll
GDI32.dll
IMM32.dll
IPHLPAPI.DLL
KERNEL32.dll
OLEAUT32.dll
PSAPI.DLL
SHELL32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
62
Monitored processes
17
Malicious processes
6
Suspicious processes
2

Behavior graph

Click at the process to see the details
drop and start start ceshi.exe taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs #SOFTCNAPP wnziputility.exe wnzippower32.exe wnzipvirtualcd.exe wnzippower32.exe no specs wnzipservice.exe #SOFTCNAPP wnziputility.exe #SOFTCNAPP wnzipupd.exe wnziputility.exe #SOFTCNAPP wnziputility.exe wnziputility.exe ceshi.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
600"C:\Users\admin\AppData\Local\Temp\ceshi.exe" C:\Users\admin\AppData\Local\Temp\ceshi.exe
explorer.exe
User:
admin
Company:
万能压缩
Integrity Level:
HIGH
Description:
万能压缩
Exit code:
0
Version:
1.4.1.19814
Modules
Images
c:\users\admin\appdata\local\temp\ceshi.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
792"C:\Program Files\WanNengZip\WnZipVirtualCD.exe" /installC:\Program Files\WanNengZip\WnZipVirtualCD.exe
WnZipUtility.exe
User:
admin
Company:
www.wn51.com
Integrity Level:
HIGH
Description:
虚拟光盘
Exit code:
0
Version:
1.0.0.11031
Modules
Images
c:\program files\wannengzip\wnzipvirtualcd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1504"C:\Program Files\WanNengZip\WnZipUtility.exe" StExOp --RunType 0C:\Program Files\WanNengZip\WnZipUtility.exe
WnZipService.exe
User:
SYSTEM
Company:
万能压缩
Integrity Level:
SYSTEM
Description:
万能压缩
Exit code:
0
Version:
1.4.1.19814
Modules
Images
c:\program files\wannengzip\wnziputility.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1856"C:\Program Files\WanNengZip\WnZipUtility.exe" QInfoC:\Program Files\WanNengZip\WnZipUtility.exe
WnZipUtility.exe
User:
SYSTEM
Company:
万能压缩
Integrity Level:
SYSTEM
Description:
万能压缩
Exit code:
0
Version:
1.4.1.19814
Modules
Images
c:\program files\wannengzip\wnziputility.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2056"C:\Program Files\WanNengZip\WnZipUtility.exe" UpOLDT --SoftName YaSuo --RunType 0C:\Program Files\WanNengZip\WnZipUtility.exe
WnZipUtility.exe
User:
SYSTEM
Company:
万能压缩
Integrity Level:
SYSTEM
Description:
万能压缩
Exit code:
0
Version:
1.4.1.19814
Modules
Images
c:\program files\wannengzip\wnziputility.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2764"C:\Program Files\WanNengZip\WnZipUtility.exe" InstallSpreadOperate --NewClientID ceshi191118 --InstallSilent falseC:\Program Files\WanNengZip\WnZipUtility.exe
ceshi.exe
User:
admin
Company:
万能压缩
Integrity Level:
HIGH
Description:
万能压缩
Exit code:
0
Version:
1.4.1.19814
Modules
Images
c:\program files\wannengzip\wnziputility.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2812taskkill /f /im WnZipConfigd.exeC:\Windows\system32\taskkill.exe—ceshi.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
3008taskkill /f /im WnZipUtility.exeC:\Windows\system32\taskkill.exe—ceshi.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
3016taskkill /f /im WnZipService.exeC:\Windows\system32\taskkill.exe—ceshi.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
3028"C:\Users\admin\AppData\Local\Temp\ceshi.exe" C:\Users\admin\AppData\Local\Temp\ceshi.exe—explorer.exe
User:
admin
Company:
万能压缩
Integrity Level:
MEDIUM
Description:
万能压缩
Exit code:
3221226540
Version:
1.4.1.19814
Total events
1 704
Read events
274
Write events
1 425
Delete events
5

Modification events

(PID) Process:(600) ceshi.exeKey:HKEY_CURRENT_USER\Software\WanNengZip\Setting
Operation:writeName:InstallType
Value:
0
(PID) Process:(600) ceshi.exeKey:HKEY_CURRENT_USER\Software\WanNengZip\PreInstall
Operation:writeName:InstallParentName
Value:
Explorer.EXE
(PID) Process:(600) ceshi.exeKey:HKEY_CURRENT_USER\Software\WanNengZip\PreInstall
Operation:writeName:InstallParentSign
Value:
UnKonw
(PID) Process:(600) ceshi.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WanNengZip
Operation:writeName:InstallPath
Value:
C:\Program Files\WanNengZip\
(PID) Process:(600) ceshi.exeKey:HKEY_CURRENT_USER\Software\WanNengZip\Setting
Operation:writeName:SoftMD5
Value:
83158e7dfe1590224758a5128b39f3c8
(PID) Process:(2764) WnZipUtility.exeKey:HKEY_CURRENT_USER\Software\WanNengZip\AppInfo
Operation:writeName:CfgRootPath
Value:
C:\Users\admin\AppData\LocalLow\WanNengZip\
(PID) Process:(2764) WnZipUtility.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WanNengZip
Operation:writeName:InstallPath
Value:
C:\Program Files\WanNengZip\
(PID) Process:(2764) WnZipUtility.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WanNengZip
Operation:writeName:LastUninstallTime
Value:
0
(PID) Process:(2764) WnZipUtility.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\TXlTb2Z0\U0hTb2Z0\V2FuTmVuZ1ppcA==
Operation:writeName:LastUninstallTime
Value:
0
(PID) Process:(2764) WnZipUtility.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WanNengZip
Operation:writeName:UninstallNum
Value:
0
Executable files
26
Suspicious files
1
Text files
54
Unknown types
5

Dropped files

PID
Process
Filename
Type
600ceshi.exeC:\Users\admin\AppData\Local\Temp\WanNengZip-56582-7zData.7z —
MD5:—
SHA256:—
600ceshi.exeC:\Program Files\Common Files\WanNengZip\WanNengZip.initext
MD5:—
SHA256:—
600ceshi.exeC:\Program Files\WanNengZip\Setting\AlgorithmConfig.xmlxml
MD5:—
SHA256:—
600ceshi.exeC:\Program Files\WanNengZip\Lang\zh-cn.txttext
MD5:—
SHA256:—
600ceshi.exeC:\Program Files\WanNengZip\wnzipvirtualcdbus.catcat
MD5:—
SHA256:—
600ceshi.exeC:\Program Files\WanNengZip\WnZipService.exeexecutable
MD5:—
SHA256:—
600ceshi.exeC:\Program Files\WanNengZip\WnZipPower64.exeexecutable
MD5:—
SHA256:—
600ceshi.exeC:\Program Files\WanNengZip\WanNengZip.initext
MD5:—
SHA256:—
600ceshi.exeC:\Program Files\WanNengZip\WnZip.exeexecutable
MD5:—
SHA256:—
600ceshi.exeC:\Program Files\WanNengZip\Setting\FilterConfig.xmlxml
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
25
TCP/UDP connections
25
DNS requests
14
Threats
17

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2764
WnZipUtility.exe
GET
200
106.75.114.162:80
http://tjv5.wn51.com/statistics/sign?code=VUlELDRiNDcwNDFiODJhMTBhZDIyZjIzYzJkMjZiNTAwNjg5LFFJRCxjZXNoaTE5MTExOCxTb2Z0SUQsV2FuTmVuZ1ppcCxJc09sZCwwLElzV0IsMA%3D%3D
CN
text
57 b
malicious
1504
WnZipUtility.exe
GET
200
163.171.131.240:80
http://d.wn51.com/yasuo/cfg/re.dat
US
binary
758 b
malicious
2056
WnZipUtility.exe
GET
200
106.75.114.162:80
http://tjv5.wn51.com/statistics/timestamp
CN
text
26 b
malicious
3880
WnZipUpd.exe
GET
200
106.75.107.219:80
http://update.wn51.com/yasuo/wanneng/updatev1.dat?rand=6836922
CN
binary
488 b
malicious
1856
WnZipUtility.exe
GET
200
180.150.186.132:80
http://config.wn51.com/yasuo/wanneng/jpquery/queryinfo.dat
CN
binary
3.95 Kb
suspicious
2764
WnZipUtility.exe
GET
200
120.132.61.186:80
http://tjv1.wn51.com/statistics/timestamp
CN
text
26 b
malicious
2764
WnZipUtility.exe
GET
200
117.50.93.3:80
http://ins.wn51.com/ins.php?data=NGI0NzA0MWI4MmExMGFkMjJmMjNjMmQyNmI1MDA2ODkJV2FuTmVuZ1ppcAkxLjQuMS4xCWNlc2hpMTkxMTE4CVdpbmRvd3M3CTAJMAkxNTc0MDU5MDQ0CUV4cGxvcmVyLkVYRQlVbktvbncJMAk0ZGE3YTBmMGYxZTZiM2UzYzUyYTBjNDY5NjAzN2U5NwlOVUxMCU5VTEw%3D
CN
text
20 b
malicious
2056
WnZipUtility.exe
GET
200
106.75.114.162:80
http://tjv5.wn51.com/statistics/online?code=VUlELDRiNDcwNDFiODJhMTBhZDIyZjIzYzJkMjZiNTAwNjg5LFFJRCxjZXNoaTE5MTExOCxTb2Z0TmFtZSxZYVN1byxTb2Z0SUQsV2FuTmVuZ1ppcCxTb2Z0VmVyLDEuNC4xLjEsVHlwZSww
CN
text
12 b
malicious
2056
WnZipUtility.exe
GET
200
117.50.93.3:80
http://ol.wn51.com/ol.php?data=NGI0NzA0MWI4MmExMGFkMjJmMjNjMmQyNmI1MDA2ODkJV2FuTmVuZ1ppcAkxLjQuMS4xCWNlc2hpMTkxMTE4CVdpbmRvd3M3CTAJMTU3NDA1OTA0NAkxNTc0MDU5MDQ0CTAJNGRhN2EwZjBmMWU2YjNlM2M1MmEwYzQ2OTYwMzdlOTcJ
CN
text
20 b
malicious
1856
WnZipUtility.exe
GET
200
120.132.61.186:80
http://tjv1.wn51.com/statistics/softlist?code=dWlkLDRiNDcwNDFiODJhMTBhZDIyZjIzYzJkMjZiNTAwNjg5LHFpZCxjZXNoaTE5MTExOCxzb2Z0dHlwZSxZYVN1byxzb2Z0bmFtZSxXYW5OZW5nWmlwLHZlciwxLjQuMS4xLHNvZnRsaXN0LDM2MEFRV1MtMDAwfFFRR0otMDAwfEpTREItMDAwfEhSLTAwMHxMRFMtMDAw
CN
text
12 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1504
WnZipUtility.exe
163.171.131.240:80
d.wn51.com
—
US
malicious
2056
WnZipUtility.exe
106.75.114.162:80
tjv5.wn51.com
China Unicom Beijing Province Network
CN
malicious
1856
WnZipUtility.exe
180.150.186.132:80
config.wn51.com
China Unicom Beijing Province Network
CN
malicious
600
ceshi.exe
120.132.61.186:80
tjv1.wn51.com
China Unicom Beijing Province Network
CN
malicious
2764
WnZipUtility.exe
120.132.61.186:80
tjv1.wn51.com
China Unicom Beijing Province Network
CN
malicious
2764
WnZipUtility.exe
180.150.186.132:80
config.wn51.com
China Unicom Beijing Province Network
CN
malicious
1856
WnZipUtility.exe
120.132.61.186:80
tjv1.wn51.com
China Unicom Beijing Province Network
CN
malicious
1856
WnZipUtility.exe
117.50.93.3:80
tjtv3.wn51.com
IDC, China Telecommunications Corporation
CN
malicious
3696
WnZipUtility.exe
163.171.131.240:80
d.wn51.com
—
US
malicious
2056
WnZipUtility.exe
117.50.93.3:80
tjtv3.wn51.com
IDC, China Telecommunications Corporation
CN
malicious

DNS requests

Domain
IP
Reputation
tjv1.wn51.com
  • 120.132.61.186
malicious
config.wn51.com
  • 180.150.186.132
suspicious
tjtv3.wn51.com
  • 117.50.93.3
unknown
tjv5.wn51.com
  • 106.75.114.162
malicious
ins.wn51.com
  • 117.50.93.3
malicious
update.wn51.com
  • 106.75.107.219
malicious
d.wn51.com
  • 163.171.131.240
malicious
ol.wn51.com
  • 117.50.93.3
malicious
jp.wn51.com
  • 117.50.93.3
malicious

Threats

PID
Process
Class
Message
2764
WnZipUtility.exe
Misc activity
ADWARE [PTsecurity] Softcnapp.J PUP
2764
WnZipUtility.exe
Misc activity
ADWARE [PTsecurity] PUA.Softcnapp payload
3880
WnZipUpd.exe
Misc activity
ADWARE [PTsecurity] Softcnapp.J PUP
3880
WnZipUpd.exe
Misc activity
ADWARE [PTsecurity] PUA.Softcnapp payload
1504
WnZipUtility.exe
Misc activity
ADWARE [PTsecurity] PUA.Softcnapp payload
1856
WnZipUtility.exe
Misc activity
ADWARE [PTsecurity] Softcnapp.J PUP
1856
WnZipUtility.exe
Misc activity
ADWARE [PTsecurity] PUA.Softcnapp payload
1856
WnZipUtility.exe
Misc activity
ADWARE [PTsecurity] Softcnapp.J PUP
1856
WnZipUtility.exe
Misc activity
ADWARE [PTsecurity] PUA.Softcnapp payload
8 ETPRO signatures available at the full report
Process
Message
ceshi.exe
[zip]CreateRunProcess("C:\Program Files\WanNengZip\WnZipUtility.exe" InstallSpreadOperate --NewClientID ceshi191118 --InstallSilent false)
WnZipUtility.exe
[zip]CreateRunProcess("C:\Program Files\WanNengZip\WnZipPower32.exe" RegCM)
WnZipUtility.exe
[zip]CreateRunProcess("C:\Program Files\WanNengZip\WnZipVirtualCD.exe" /install)
WnZipPower32.exe
[zip]CreateRunProcess("C:\Program Files\WanNengZip\WnZipPower32.exe" Reg32CM)
WnZipUtility.exe
CheckRegSZValue false -
WnZipUtility.exe
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\UserChoice
WnZipUtility.exe
WnZipUtility.exe
CheckRegSZValue false -
WnZipUtility.exe
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zipx\UserChoice
WnZipUtility.exe
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ceshi.exe