File name:

b3aec2ccd97d96c938b132f0ca6b0e6e.exe

Full analysis: https://app.any.run/tasks/72f7c790-afd7-4066-aa61-a5d8f1829289
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: June 21, 2021, 12:56:37
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

B3AEC2CCD97D96C938B132F0CA6B0E6E

SHA1:

394BCB8A50EA4B62D4241460C77C42CD844299F6

SHA256:

EB2DB594F9A6EC157E0FAAB601968139A4369E7C1371CA83AE924960D1857C79

SSDEEP:

1536:lTViOcRUBWC2jZP2ITQX5+e7ZnbHJNtxlSEJ4AM:lTUOPWC/IUJtZnbHJPxlSc4f

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • b3aec2ccd97d96c938b132f0ca6b0e6e.exe (PID: 2772)

    • Changes the autorun value in the registry

      • SysoptasstSetup20210519-1600-12.exe (PID: 3216)

    • Loads dropped or rewritten executable

      • b3aec2ccd97d96c938b132f0ca6b0e6e.exe (PID: 2772)
      • astray.exe (PID: 2740)
      • ascore.exe (PID: 2504)
      • iNote_text_tn_1006.exe (PID: 2432)
      • regsvr32.exe (PID: 2596)
      • iNoterSvr.exe (PID: 1444)
      • iNoteHelperTools.exe (PID: 3744)
      • asdata.exe (PID: 944)
      • iNoterSvr.exe (PID: 3228)

    • Application was dropped or rewritten from another process

      • ascore.exe (PID: 2504)
      • astray.exe (PID: 2740)
      • iNote_text_tn_1006.exe (PID: 2432)
      • iNoterSvr.exe (PID: 1444)
      • iNoterSvr.exe (PID: 3228)
      • iNoteHelperTools.exe (PID: 3744)
      • asdata.exe (PID: 944)

    • Changes settings of System certificates

      • astray.exe (PID: 2740)

    • Registers / Runs the DLL via REGSVR32.EXE

      • iNote_text_tn_1006.exe (PID: 2432)

    • Connects to CnC server

      • asdata.exe (PID: 944)

    • Actions looks like stealing of personal data

      • ascore.exe (PID: 2504)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • b3aec2ccd97d96c938b132f0ca6b0e6e.exe (PID: 2772)
      • SysoptasstSetup20210519-1600-12.exe (PID: 3216)
      • iNote_text_tn_1006.exe (PID: 2432)

    • Drops a file with too old compile date

      • b3aec2ccd97d96c938b132f0ca6b0e6e.exe (PID: 2772)
      • SysoptasstSetup20210519-1600-12.exe (PID: 3216)
      • iNote_text_tn_1006.exe (PID: 2432)

    • Creates a directory in Program Files

      • SysoptasstSetup20210519-1600-12.exe (PID: 3216)
      • ascore.exe (PID: 2504)
      • astray.exe (PID: 2740)
      • iNote_text_tn_1006.exe (PID: 2432)

    • Creates files in the program directory

      • SysoptasstSetup20210519-1600-12.exe (PID: 3216)
      • ascore.exe (PID: 2504)
      • astray.exe (PID: 2740)
      • iNote_text_tn_1006.exe (PID: 2432)

    • Creates a software uninstall entry

      • SysoptasstSetup20210519-1600-12.exe (PID: 3216)
      • iNote_text_tn_1006.exe (PID: 2432)

    • Drops a file that was compiled in debug mode

      • SysoptasstSetup20210519-1600-12.exe (PID: 3216)
      • iNote_text_tn_1006.exe (PID: 2432)

    • Executed as Windows Service

      • ascore.exe (PID: 2504)
      • iNoterSvr.exe (PID: 3228)

    • Creates files in the user directory

      • astray.exe (PID: 2740)

    • Adds / modifies Windows certificates

      • astray.exe (PID: 2740)

    • Drops a file with a compile date too recent

      • iNote_text_tn_1006.exe (PID: 2432)

    • Changes default file association

      • iNote_text_tn_1006.exe (PID: 2432)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 2596)

    • Changes IE settings (feature browser emulation)

      • iNote_text_tn_1006.exe (PID: 2432)

    • Low-level read access rights to disk partition

      • asdata.exe (PID: 944)

    • Searches for installed software

      • astray.exe (PID: 2740)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • SysoptasstSetup20210519-1600-12.exe (PID: 3216)
      • astray.exe (PID: 2740)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: 6
OSVersion: 4
EntryPoint: 0x3c60
UninitializedDataSize: 1024
InitializedDataSize: 119808
CodeSize: 28672
LinkerVersion: 6
PEType: PE32
TimeStamp: 2014:03:29 10:41:59+01:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 29-Mar-2014 09:41:59
Detected languages:
  • English - United States

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000F0

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 29-Mar-2014 09:41:59
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00006FCF
0x00007000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.50039
.rdata
0x00008000
0x00001198
0x00001200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.24353
.data
0x0000A000
0x0001AF9C
0x00000400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.68549
.ndata
0x00025000
0x00013000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x00038000
0x00003EC0
0x00004000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
1.05254

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.10394
533
UNKNOWN
English - United States
RT_MANIFEST
2
0
3752
UNKNOWN
English - United States
RT_ICON
3
0
2216
UNKNOWN
English - United States
RT_ICON
4
0
1384
UNKNOWN
English - United States
RT_ICON
5
0
1128
UNKNOWN
English - United States
RT_ICON
6
0
744
UNKNOWN
English - United States
RT_ICON
7
0
296
UNKNOWN
English - United States
RT_ICON
103
3.55964
104
UNKNOWN
English - United States
RT_GROUP_ICON
105
2.68733
494
UNKNOWN
English - United States
RT_DIALOG
106
2.86626
228
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
VERSION.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
54
Monitored processes
11
Malicious processes
8
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start b3aec2ccd97d96c938b132f0ca6b0e6e.exe sysoptasstsetup20210519-1600-12.exe ascore.exe astray.exe inote_text_tn_1006.exe regsvr32.exe no specs inotersvr.exe no specs inotersvr.exe no specs inotehelpertools.exe asdata.exe b3aec2ccd97d96c938b132f0ca6b0e6e.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
944"C:\Program Files\sysoptasst\asdata.exe" -active 2C:\Program Files\sysoptasst\asdata.exe
ascore.exe
User:
admin
Company:
深圳金奇异果科技有限公司
Integrity Level:
HIGH
Description:
asdata
Exit code:
0
Version:
2021,04,22,538
Modules
Images
c:\program files\sysoptasst\asdata.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1376"C:\Users\admin\AppData\Local\Temp\b3aec2ccd97d96c938b132f0ca6b0e6e.exe" C:\Users\admin\AppData\Local\Temp\b3aec2ccd97d96c938b132f0ca6b0e6e.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\b3aec2ccd97d96c938b132f0ca6b0e6e.exe
c:\systemroot\system32\ntdll.dll
1444"C:\Program Files\iNote\2.0.10.91\iNoterSvr.exe" -mC:\Program Files\iNote\2.0.10.91\iNoterSvr.exe—iNote_text_tn_1006.exe
User:
admin
Company:
Anhui Aiqi Network Technology Co., Ltd
Integrity Level:
HIGH
Description:
iNote 核心服务程序
Exit code:
1
Version:
1.0.0.1
Modules
Images
c:\program files\inote\2.0.10.91\inotersvr.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2432"C:\Users\admin\AppData\Local\Temp\iNote_text_tn_1006.exe" /SC:\Users\admin\AppData\Local\Temp\iNote_text_tn_1006.exe
b3aec2ccd97d96c938b132f0ca6b0e6e.exe
User:
admin
Company:
Anhui Aiqi Network Technology Co., Ltd
Integrity Level:
HIGH
Description:
iNote文本程序
Exit code:
0
Version:
2.0.10.91
Modules
Images
c:\users\admin\appdata\local\temp\inote_text_tn_1006.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\shell32.dll
2504"C:\Program Files\sysoptasst\ascore.exe" /service ascoreC:\Program Files\sysoptasst\ascore.exe
services.exe
User:
SYSTEM
Company:
深圳金奇异果科技有限公司
Integrity Level:
SYSTEM
Description:
ascore
Exit code:
0
Version:
2021,01,13,210
Modules
Images
c:\program files\sysoptasst\ascore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2596regsvr32 /s "C:\Program Files\iNote\2.0.10.91\iNoteExplorer.dll"C:\Windows\system32\regsvr32.exe—iNote_text_tn_1006.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2740"C:\Program Files\sysoptasst\astray.exe" /from:autorun /product:4 /updateversion /installC:\Program Files\sysoptasst\astray.exe
SysoptasstSetup20210519-1600-12.exe
User:
admin
Company:
深圳金奇异果科技有限公司
Integrity Level:
HIGH
Description:
astray
Exit code:
0
Version:
2021,05,10,581
Modules
Images
c:\program files\sysoptasst\astray.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2772"C:\Users\admin\AppData\Local\Temp\b3aec2ccd97d96c938b132f0ca6b0e6e.exe" C:\Users\admin\AppData\Local\Temp\b3aec2ccd97d96c938b132f0ca6b0e6e.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\b3aec2ccd97d96c938b132f0ca6b0e6e.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
3216"C:\Users\admin\AppData\Local\Temp\SysoptasstSetup20210519-1600-12.exe" C:\Users\admin\AppData\Local\Temp\SysoptasstSetup20210519-1600-12.exe
b3aec2ccd97d96c938b132f0ca6b0e6e.exe
User:
admin
Company:
深圳金奇异果科技有限公司
Integrity Level:
HIGH
Description:
金牌电脑管家安装程序
Exit code:
0
Version:
2021,04,05,484
Modules
Images
c:\users\admin\appdata\local\temp\sysoptasstsetup20210519-1600-12.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
3228"C:\Program Files\iNote\2.0.10.91\iNoterSvr.exe" -rC:\Program Files\iNote\2.0.10.91\iNoterSvr.exe—services.exe
User:
SYSTEM
Company:
Anhui Aiqi Network Technology Co., Ltd
Integrity Level:
SYSTEM
Description:
iNote 核心服务程序
Exit code:
0
Version:
1.0.0.1
Modules
Images
c:\program files\inote\2.0.10.91\inotersvr.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
3 533
Read events
3 349
Write events
182
Delete events
2

Modification events

(PID) Process:(3216) SysoptasstSetup20210519-1600-12.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2E79D13E-7339-4661-92EA-93AD506EF2E2}\Implemented Categories\{32C1137B-5DAB-4004-993F-46C7C3F7B560}
Operation:writeName:idex
Value:
91c62eb07e82105902123df9301c8ee7
(PID) Process:(3216) SysoptasstSetup20210519-1600-12.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\sysoptasst\ascommon
Operation:writeName:tid1
Value:
1600
(PID) Process:(3216) SysoptasstSetup20210519-1600-12.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\sysoptasst\ascommon
Operation:writeName:tid2
Value:
12
(PID) Process:(3216) SysoptasstSetup20210519-1600-12.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\sysoptasst\ascommon
Operation:writeName:tod1
Value:
1
(PID) Process:(3216) SysoptasstSetup20210519-1600-12.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\sysoptasst\ascommon
Operation:writeName:tod2
Value:
1
(PID) Process:(3216) SysoptasstSetup20210519-1600-12.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\sysoptasst\ascommon
Operation:writeName:iid
Value:
1621388013
(PID) Process:(3216) SysoptasstSetup20210519-1600-12.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\sysoptasst\ascommon
Operation:writeName:independent
Value:
1
(PID) Process:(3216) SysoptasstSetup20210519-1600-12.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\sysoptasst\ascommon
Operation:writeName:installpath
Value:
C:\Program Files\sysoptasst
(PID) Process:(3216) SysoptasstSetup20210519-1600-12.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\sysoptasst\ascommon
Operation:writeName:rcmdid
Value:
(PID) Process:(3216) SysoptasstSetup20210519-1600-12.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\sysoptasst\ascommon
Operation:writeName:installtime
Value:
1624280262
Executable files
98
Suspicious files
33
Text files
290
Unknown types
25

Dropped files

PID
Process
Filename
Type
2772b3aec2ccd97d96c938b132f0ca6b0e6e.exeC:\Users\admin\AppData\Local\Temp\tsjpcfg.ini —
MD5:—
SHA256:—
2772b3aec2ccd97d96c938b132f0ca6b0e6e.exeC:\Users\admin\AppData\Local\Temp\SysoptasstSetup20210519-1600-12.exe —
MD5:—
SHA256:—
3216SysoptasstSetup20210519-1600-12.exeC:\Users\admin\AppData\Local\Temp\~1443ed\res\1.pngimage
MD5:—
SHA256:—
3216SysoptasstSetup20210519-1600-12.exeC:\Users\admin\AppData\Local\Temp\~1443ed\res\3.pngimage
MD5:072F12D164141008948DCADDBB335FFA
SHA256:DCC247AECA4E15E8FEE14C5DB926FD522E392C6398148B63348CC30079A97FBB
2772b3aec2ccd97d96c938b132f0ca6b0e6e.exeC:\Users\admin\AppData\Local\Temp\nseE207.tmp\NSISdl.dllexecutable
MD5:254F13DFD61C5B7D2119EB2550491E1D
SHA256:FD0E8BE2135F3D326B65520383A3468C3983FA32C9C93594D986B16709D80F28
3216SysoptasstSetup20210519-1600-12.exeC:\Users\admin\AppData\Local\Temp\~1443ed\res\58.pngimage
MD5:—
SHA256:—
3216SysoptasstSetup20210519-1600-12.exeC:\Users\admin\AppData\Local\Temp\~1443ed\res\63.pngimage
MD5:—
SHA256:—
3216SysoptasstSetup20210519-1600-12.exeC:\Users\admin\AppData\Local\Temp\~1443ed\res\4.pngimage
MD5:CC1444EA9E9188388916AD9091B11E0A
SHA256:F302C3D7CE98D15A4D5619D483F056B26B993EE70341FE7B1470653B0C4ABB8D
3216SysoptasstSetup20210519-1600-12.exeC:\Users\admin\AppData\Local\Temp\~1443ed\res\43.pngimage
MD5:0AF59156277CBC053B17D6A6C35A0C62
SHA256:5D5B186D9F71009D918D39895E08FDEE4452187A9D7E6C2E65B44616912241DC
3216SysoptasstSetup20210519-1600-12.exeC:\Users\admin\AppData\Local\Temp\~1443ed\res\40.pngimage
MD5:07B93E4303598ED7BC8020B10109C86C
SHA256:D33D7D08642EC5A861E649525AF7C776E076864305A451C8CD943C26D8C602D2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
39
TCP/UDP connections
39
DNS requests
29
Threats
60

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2772
b3aec2ccd97d96c938b132f0ca6b0e6e.exe
GET
—
163.171.132.119:80
http://downsrf.eastday.com/pdf/wn/setup_wnpdfkb023.exe
US
—
—
suspicious
2772
b3aec2ccd97d96c938b132f0ca6b0e6e.exe
GET
—
218.12.76.151:80
http://pcmgr-down.vipguanjia.net/package/SysoptasstSetup20210519-1600-12.exe
CN
—
—
malicious
2740
astray.exe
POST
200
106.55.217.188:80
http://weather.vipguanjia.net/ip/cityid
CN
text
60 b
suspicious
2772
b3aec2ccd97d96c938b132f0ca6b0e6e.exe
GET
200
163.171.132.18:80
http://xz.8dashi.com/qd/tsjpcfg.ini
US
text
1.57 Kb
suspicious
2740
astray.exe
POST
200
123.207.105.156:8080
http://knsv2.vipguanjia.net:8080/kurl_query?1369968
CN
binary
130 b
suspicious
2740
astray.exe
GET
200
121.29.46.104:80
http://pcmgr-cdn.vipguanjia.net/public/defend/cloudscreenshot.dat
CN
text
30.6 Kb
suspicious
2740
astray.exe
POST
200
106.55.217.188:80
http://weather.vipguanjia.net/weather/v2/get
CN
text
1.24 Kb
suspicious
2740
astray.exe
POST
200
81.71.125.12:80
http://vip-pcmgr.vipguanjia.net/api/sdk/service/get
NL
text
171 b
suspicious
2740
astray.exe
POST
200
211.159.130.107:80
http://data.vipguanjia.net/c/v2/
CN
binary
43 b
whitelisted
2740
astray.exe
POST
200
81.71.125.12:80
http://vip-pcmgr.vipguanjia.net/api/sdk/service/get
NL
text
170 b
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2772
b3aec2ccd97d96c938b132f0ca6b0e6e.exe
163.171.132.18:80
xz.8dashi.com
—
US
malicious
2772
b3aec2ccd97d96c938b132f0ca6b0e6e.exe
218.12.76.151:80
pcmgr-down.vipguanjia.net
CHINA UNICOM China169 Backbone
CN
malicious
2740
astray.exe
123.207.105.156:8080
knsv2.vipguanjia.net
Shenzhen Tencent Computer Systems Company Limited
CN
suspicious
3216
SysoptasstSetup20210519-1600-12.exe
111.230.160.42:80
dbsu.vipguanjia.net
Shenzhen Tencent Computer Systems Company Limited
CN
unknown
3216
SysoptasstSetup20210519-1600-12.exe
211.159.130.107:80
—
Shenzhen Tencent Computer Systems Company Limited
CN
malicious
2740
astray.exe
110.43.81.34:80
optimize.vipguanjia.net
—
CN
suspicious
2740
astray.exe
106.55.217.188:80
weather.vipguanjia.net
—
CN
suspicious
2772
b3aec2ccd97d96c938b132f0ca6b0e6e.exe
140.249.240.192:80
download.52pcfree.com
No.31,Jin-rong Street
CN
suspicious
2740
astray.exe
81.71.125.12:80
vip-pcmgr.vipguanjia.net
Euronet Communications B.V.
NL
suspicious
2740
astray.exe
139.199.215.55:80
ct.vipguanjia.net
Shenzhen Tencent Computer Systems Company Limited
CN
malicious

DNS requests

Domain
IP
Reputation
xz.8dashi.com
  • 163.171.132.18
suspicious
pcmgr-down.vipguanjia.net
  • 218.12.76.151
  • 120.52.95.242
  • 120.52.95.243
  • 218.12.76.150
malicious
dbsu.vipguanjia.net
  • 111.230.160.42
unknown
data.vipguanjia.net
  • 142.250.186.131
whitelisted
download.52pcfree.com
  • 140.249.240.192
  • 140.249.240.191
malicious
optimize.vipguanjia.net
  • 110.43.81.34
suspicious
weather.vipguanjia.net
  • 106.55.217.188
suspicious
vip-pcmgr.vipguanjia.net
  • 81.71.125.12
suspicious
pcmgr-cdn.vipguanjia.net
  • 121.29.46.104
  • 121.29.46.106
  • 121.29.46.103
  • 121.29.46.102
  • 121.29.46.105
  • 121.29.46.101
suspicious
knsv2.vipguanjia.net
  • 123.207.105.156
suspicious

Threats

PID
Process
Class
Message
2772
b3aec2ccd97d96c938b132f0ca6b0e6e.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3216
SysoptasstSetup20210519-1600-12.exe
Potentially Bad Traffic
ET INFO Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
2740
astray.exe
Potentially Bad Traffic
ET INFO Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
2740
astray.exe
Generic Protocol Command Decode
SURICATA STREAM CLOSEWAIT FIN out of window
2740
astray.exe
Potentially Bad Traffic
ET INFO Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
2740
astray.exe
Potentially Bad Traffic
ET INFO Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
2740
astray.exe
Potentially Bad Traffic
ET INFO Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
2740
astray.exe
Potentially Bad Traffic
ET INFO Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
2740
astray.exe
Potentially Bad Traffic
ET INFO Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
2740
astray.exe
Potentially Bad Traffic
ET INFO Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
22 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
b3aec2ccd97d96c938b132f0ca6b0e6e.exe