File name:

KuaiZip.exe

Full analysis: https://app.any.run/tasks/34e29371-cf9e-4d5f-bdfd-b2705cdf043c
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: November 24, 2023, 17:02:55
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

F3E81CD092CCC89999618DE44A1C5361

SHA1:

AAE96E9407B4FEAD657812FAE543EF93715128FD

SHA256:

DDD9FB480E8170ED8E824026FF227D28A293ABF24FA51A27BD5662B585931E03

SSDEEP:

1536:jHuXUD5FEj28udzXJ4JLE8CCmcWVOl624qSQZOd8jrGz92:jzD5FEjl6zXJQLzChcWHGrGzg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • KuaiZip.exe (PID: 3352)
      • kuaizip_setup_2722097895_shouheng_001.exe (PID: 1496)

    • Registers / Runs the DLL via REGSVR32.EXE

      • kuaizip_setup_2722097895_shouheng_001.exe (PID: 1496)

  • SUSPICIOUS

    • Reads the Internet Settings

      • KuaiZip.exe (PID: 3352)
      • kuaizip_setup_2722097895_shouheng_001.exe (PID: 1496)
      • KuaiZip.exe (PID: 3396)
      • KuaiZip.exe (PID: 3528)
      • KZReport.exe (PID: 2100)
      • Update.exe (PID: 2436)

    • Process requests binary or script from the Internet

      • KuaiZip.exe (PID: 3352)
      • kuaizip_setup_2722097895_shouheng_001.exe (PID: 1496)
      • explorer.exe (PID: 1388)

    • Drops a system driver (possible attempt to evade defenses)

      • kuaizip_setup_2722097895_shouheng_001.exe (PID: 1496)

    • Drops 7-zip archiver for unpacking

      • kuaizip_setup_2722097895_shouheng_001.exe (PID: 1496)

    • The process executes via Task Scheduler

      • Update.exe (PID: 2436)

  • INFO

    • Reads the computer name

      • KuaiZip.exe (PID: 3352)
      • wmpnscfg.exe (PID: 2416)
      • kuaizip_setup_2722097895_shouheng_001.exe (PID: 1496)
      • KuaiZip.exe (PID: 3396)
      • KuaiZip.exe (PID: 3528)
      • KZReport.exe (PID: 2100)
      • Update.exe (PID: 2436)

    • Create files in a temporary directory

      • KuaiZip.exe (PID: 3352)

    • Checks supported languages

      • KuaiZip.exe (PID: 3352)
      • wmpnscfg.exe (PID: 2416)
      • kuaizip_setup_2722097895_shouheng_001.exe (PID: 1496)
      • KuaiZip.exe (PID: 3396)
      • KuaiZip.exe (PID: 3528)
      • KZReport.exe (PID: 2100)
      • Update.exe (PID: 2436)

    • Checks proxy server information

      • KuaiZip.exe (PID: 3352)
      • kuaizip_setup_2722097895_shouheng_001.exe (PID: 1496)
      • explorer.exe (PID: 1388)
      • KuaiZip.exe (PID: 3528)
      • KuaiZip.exe (PID: 3396)
      • KZReport.exe (PID: 2100)
      • Update.exe (PID: 2436)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 2416)

    • Reads the machine GUID from the registry

      • wmpnscfg.exe (PID: 2416)
      • kuaizip_setup_2722097895_shouheng_001.exe (PID: 1496)
      • KuaiZip.exe (PID: 3396)
      • KuaiZip.exe (PID: 3528)
      • KZReport.exe (PID: 2100)
      • Update.exe (PID: 2436)

    • Creates files or folders in the user directory

      • kuaizip_setup_2722097895_shouheng_001.exe (PID: 1496)
      • explorer.exe (PID: 1388)

    • Reads the Internet Settings

      • explorer.exe (PID: 1388)

    • Reads product name

      • KZReport.exe (PID: 2100)

    • Reads Environment values

      • KZReport.exe (PID: 2100)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2014:03:29 10:41:59+01:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 28672
InitializedDataSize: 119808
UninitializedDataSize: 1024
EntryPoint: 0x3c60
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
60
Monitored processes
14
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start kuaizip.exe wmpnscfg.exe no specs kuaizip_setup_2722097895_shouheng_001.exe regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs explorer.exe kuaizip.exe kuaizip.exe kzreport.exe update.exe kuaizip.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
240regsvr32.exe /s /u C:\Users\admin\AppData\Roaming\快压\X86\KuaiZipShellProp.dllC:\Windows\System32\regsvr32.exe—kuaizip_setup_2722097895_shouheng_001.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
3
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1388C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1496C:\Users\admin\AppData\Local\Temp\kuaizip_setup_2722097895_shouheng_001.exeC:\Users\admin\AppData\Local\Temp\kuaizip_setup_2722097895_shouheng_001.exe
KuaiZip.exe
User:
admin
Company:
上海广乐网络科技有限公司
Integrity Level:
HIGH
Description:
快压安装程序
Exit code:
0
Version:
3.3.0.3
Modules
Images
c:\users\admin\appdata\local\temp\kuaizip_setup_2722097895_shouheng_001.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
2100"C:\Users\admin\AppData\Roaming\快压\X86\KZReport.exe" C:\Users\admin\AppData\Roaming\快压\X86\KZReport.exe
kuaizip_setup_2722097895_shouheng_001.exe
User:
admin
Company:
上海广乐网络科技有限公司
Integrity Level:
HIGH
Description:
KZReport
Exit code:
0
Version:
3.3.0.3
Modules
Images
c:\users\admin\appdata\roaming\快压\x86\kzreport.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
2304regsvr32.exe /s /u C:\Users\admin\AppData\Roaming\快压\X86\KuaiZipShell.dllC:\Windows\System32\regsvr32.exe—kuaizip_setup_2722097895_shouheng_001.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
3
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2416"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
2436C:\Users\admin\AppData\Roaming\快压\X86\Update.exe C:\Users\admin\AppData\Roaming\快压\X86\Update.exe
taskeng.exe
User:
admin
Company:
上海广乐网络科技有限公司
Integrity Level:
HIGH
Description:
Update
Exit code:
0
Version:
3.3.0.3
Modules
Images
c:\users\admin\appdata\roaming\快压\x86\update.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
2708"C:\Users\admin\Desktop\KuaiZip.exe" C:\Users\admin\Desktop\KuaiZip.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\kuaizip.exe
c:\windows\system32\ntdll.dll
2764regsvr32.exe /s C:\Users\admin\AppData\Roaming\快压\X86\KuaiZipShell.dllC:\Windows\System32\regsvr32.exe—kuaizip_setup_2722097895_shouheng_001.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3352"C:\Users\admin\Desktop\KuaiZip.exe" C:\Users\admin\Desktop\KuaiZip.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\kuaizip.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
Total events
6 052
Read events
5 718
Write events
200
Delete events
134

Modification events

(PID) Process:(1388) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000F6D6788197A75D498472ACE88906AC8D000000000200000000001066000000010000200000007F0C5AFCF1AE7F71286A81A9B86E67A7BE47980777E154AD953E683E2064784E000000000E8000000002000020000000C547D0854BEA52CCDED7859B79990A863903B335001ED826D40C3D8E323F237F30000000DF0FBC24E15CFF4FE438F74D8486DFB808CBF3EC9160BD0CF16731298F2800053F0DC9D2737FB85ABF81EDB882A089A94000000011BAC043EAAF96F8497DEE93A36C7829C97427DA018BC7750377DAC2CC3CE4D64139784732F789D57202D54D80C3AAC2B4B5EE990B65AEF23416199647916AD4
(PID) Process:(1388) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts
Operation:delete keyName:(default)
Value:
(PID) Process:(1388) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2416) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{08EC2A5B-8EC0-46DA-82C4-A65C92186D84}\{B7CCEA58-7748-40F0-978C-C100F7EDE61D}
Operation:delete keyName:(default)
Value:
(PID) Process:(2416) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{08EC2A5B-8EC0-46DA-82C4-A65C92186D84}
Operation:delete keyName:(default)
Value:
(PID) Process:(2416) wmpnscfg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Health\{88CC4BA6-B2EB-45D3-B65D-721CADEEDC85}
Operation:delete keyName:(default)
Value:
(PID) Process:(1496) kuaizip_setup_2722097895_shouheng_001.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1496) kuaizip_setup_2722097895_shouheng_001.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1496) kuaizip_setup_2722097895_shouheng_001.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(1496) kuaizip_setup_2722097895_shouheng_001.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000059010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
83
Suspicious files
11
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
1496kuaizip_setup_2722097895_shouheng_001.exeC:\Users\admin\AppData\Roaming\快压\7zNew.tmpcompressed
MD5:C995C0F4C984235E4437846F8F7ECABC
SHA256:6491D66CD094D06A9D871B9A8C0F799103E35F4B342B6F9E3B6FF4F475AF171D
3352KuaiZip.exeC:\Users\admin\AppData\Local\Temp\kuaizip_setup_2722097895_shouheng_001.exeexecutable
MD5:F4556B1B172145CEC2A6B7D3FA7EB9D4
SHA256:34FBEC7E3132565F69FF833C7EAC26A704B208873442A57CA7CE25AEF0B2E89C
3352KuaiZip.exeC:\Users\admin\AppData\Local\Temp\nsnDA40.tmp\NSISdl.dllexecutable
MD5:254F13DFD61C5B7D2119EB2550491E1D
SHA256:FD0E8BE2135F3D326B65520383A3468C3983FA32C9C93594D986B16709D80F28
1496kuaizip_setup_2722097895_shouheng_001.exeC:\Users\admin\AppData\Roaming\快压\7zNew.datcompressed
MD5:C995C0F4C984235E4437846F8F7ECABC
SHA256:6491D66CD094D06A9D871B9A8C0F799103E35F4B342B6F9E3B6FF4F475AF171D
1496kuaizip_setup_2722097895_shouheng_001.exeC:\Users\admin\AppData\Roaming\快压\KzNew.datbinary
MD5:A46F750CF32DCE09A552F994B3BC10C5
SHA256:8146C906CA9C686B3EDAFE171EFA67ABE4CFAF71E61E0933951663A489FA8470
1496kuaizip_setup_2722097895_shouheng_001.exeC:\Users\admin\AppData\Roaming\快压\readme.tmptext
MD5:B51C1E5A6FE0820A6E94360469290E95
SHA256:F1EC5D8CB63481B61CC92D36850A00588EC02F608133133A2262A0861654FB48
1496kuaizip_setup_2722097895_shouheng_001.exeC:\Users\admin\AppData\Roaming\快压\readme.txttext
MD5:B51C1E5A6FE0820A6E94360469290E95
SHA256:F1EC5D8CB63481B61CC92D36850A00588EC02F608133133A2262A0861654FB48
1496kuaizip_setup_2722097895_shouheng_001.exeC:\Users\admin\AppData\Roaming\快压\ErrorMsg.tmpxml
MD5:FB653E72A456C00DF8B1FAF34EF39F2D
SHA256:7992B056C0E12DB41D0927FDCDBED4D1A18671E1385A933C10361D5CC69F1724
1496kuaizip_setup_2722097895_shouheng_001.exeC:\Users\admin\AppData\Roaming\快压\SLDefault.tmpxml
MD5:23E50EC682CB128921CE6AFFFAD14840
SHA256:CBE3CD3E0003A2F42C4CE3387A994941EB6F1BB1AA4111BE99CED0B639643EBF
1496kuaizip_setup_2722097895_shouheng_001.exeC:\Users\admin\AppData\Roaming\快压\ErrorMsg.xmlxml
MD5:FB653E72A456C00DF8B1FAF34EF39F2D
SHA256:7992B056C0E12DB41D0927FDCDBED4D1A18671E1385A933C10361D5CC69F1724
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
30
TCP/UDP connections
81
DNS requests
34
Threats
17

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3528
KuaiZip.exe
GET
200
175.43.23.67:80
http://api.kz.naruto.red/1710cf263c6c070f68bcbb953ff8a781.md5
unknown
text
32 b
unknown
1496
kuaizip_setup_2722097895_shouheng_001.exe
POST
200
101.200.121.171:80
http://report.uchiha.ltd/
unknown
—
—
unknown
1496
kuaizip_setup_2722097895_shouheng_001.exe
POST
200
101.200.121.171:80
http://report.uchiha.ltd/
unknown
—
—
unknown
1388
explorer.exe
GET
200
36.248.64.54:80
http://i.glzip.com/n/kuaizip/shell.json
unknown
binary
2.05 Kb
unknown
3352
KuaiZip.exe
GET
—
45.199.87.156:80
http://xz.8dashi.com/qd/mastercfgo.ini?v20231124170301
unknown
—
—
unknown
3352
KuaiZip.exe
GET
—
45.199.87.156:80
http://xz.8dashi.com/qd/mastercfgo.ini?v20231124170301
unknown
—
—
unknown
3352
KuaiZip.exe
GET
—
45.199.87.156:80
http://xz.8dashi.com/qd/mastercfgo.ini?v20231124170301
unknown
—
—
unknown
3352
KuaiZip.exe
GET
—
45.199.87.156:80
http://xz.8dashi.com/qd/mastercfgo.ini?v20231124170301
unknown
—
—
unknown
3352
KuaiZip.exe
GET
—
45.199.87.156:80
http://xz.8dashi.com/qd/mastercfgo.ini?v20231124170301
unknown
—
—
unknown
3352
KuaiZip.exe
GET
—
45.199.87.156:80
http://xz.8dashi.com/qd/mastercfgo.ini?v20231124170301
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3352
KuaiZip.exe
45.199.87.156:80
xz.8dashi.com
DXTL Tseung Kwan O Service
HK
unknown
3352
KuaiZip.exe
202.97.231.60:80
dl.kkdownload.com
CHINA UNICOM China169 Backbone
CN
unknown
1496
kuaizip_setup_2722097895_shouheng_001.exe
175.43.23.67:80
dl.kkdownload.com
CHINA UNICOM China169 Backbone
CN
unknown
1496
kuaizip_setup_2722097895_shouheng_001.exe
103.235.47.103:443
www.baidu.com
Beijing Baidu Netcom Science and Technology Co., Ltd.
HK
unknown
1496
kuaizip_setup_2722097895_shouheng_001.exe
116.153.45.250:80
dl.kkdownload.com
CHINA UNICOM China169 Backbone
CN
unknown

DNS requests

Domain
IP
Reputation
xz.8dashi.com
  • 45.199.87.156
unknown
dl.kkdownload.com
  • 202.97.231.60
  • 61.54.7.129
  • 14.205.47.70
  • 61.54.7.127
  • 61.54.7.107
  • 175.43.23.67
  • 175.43.23.80
  • 175.43.23.247
  • 116.153.45.250
  • 36.248.64.77
  • 36.248.64.54
  • 61.54.7.111
  • 61.54.7.112
unknown
api.kz.naruto.red
  • 175.43.23.67
  • 36.248.64.54
  • 14.205.47.70
  • 202.97.231.60
  • 175.43.23.247
  • 61.54.7.107
  • 36.248.64.77
  • 61.54.7.112
  • 61.54.7.111
  • 175.43.23.80
  • 61.54.7.129
  • 61.54.7.127
  • 116.153.45.250
unknown
www.baidu.com
  • 103.235.47.103
  • 183.2.172.42
  • 183.2.172.185
whitelisted
report.uchiha.ltd
  • 101.200.121.171
unknown
i.glzip.com
  • 36.248.64.54
  • 36.248.64.77
  • 61.54.7.129
  • 202.97.231.60
  • 61.54.7.112
  • 61.54.7.111
  • 61.54.7.127
  • 61.54.7.107
  • 175.43.23.247
  • 116.153.45.250
  • 14.205.47.70
  • 175.43.23.80
  • 175.43.23.67
unknown
tj.glzip.com
  • —
unknown
i.hhrspb7.top
  • 36.248.64.77
  • 61.54.7.129
  • 61.54.7.107
  • 61.54.7.127
  • 175.43.23.80
  • 175.43.23.67
  • 14.205.47.70
  • 116.153.45.250
  • 36.248.64.54
  • 202.97.231.60
  • 61.54.7.111
  • 61.54.7.112
  • 175.43.23.247
malicious
dns.msftncsi.com
  • 131.107.255.255
shared
kyposition.dftoutiao.com
  • —
unknown

Threats

PID
Process
Class
Message
3352
KuaiZip.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1080
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
1388
explorer.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
14 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
KuaiZip.exe