File name:

XunLeiWebSetup12.0.12.2510.exe

Full analysis: https://app.any.run/tasks/6b21f9ae-2603-41cb-a92d-87f4bc924ec3
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: August 30, 2024, 06:13:38
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
adware
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

68F73BE4D7D9E76B687558D15071059F

SHA1:

7A3A0704E7FE9DDFA92F68B7EEE099E1361D32F4

SHA256:

FA36EC71CADD62970A100684AD48802B8EB393575145E40491F4A64363FFD35C

SSDEEP:

98304:CbvAAu+RI1Jv8EVb6fzYyj6JFN4IwnEUhZ/FF255g9ZexV46r8PxLrjKVf9W0vqp:3Cn+aLr2I

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to the CnC server

      • XunLeiWebSetup12.0.12.2510.exe (PID: 7132)
      • XunLeiSetup12.0.12.2510.exe (PID: 6988)

    • Runs injected code in another process

      • SysPin.exe (PID: 6948)

    • Application was injected by another process

      • explorer.exe (PID: 4552)

    • Actions looks like stealing of personal data

      • XunLeiSetup12.0.12.2510.exe (PID: 6988)

    • Registers / Runs the DLL via REGSVR32.EXE

      • XunLeiSetup12.0.12.2510.exe (PID: 6988)
      • ThunderBHOPlatform.exe (PID: 6240)

    • Creates or modifies Windows services

      • XLServicePlatform.exe (PID: 6132)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • XunLeiWebSetup12.0.12.2510.exe (PID: 7132)
      • XunLeiSetup12.0.12.2510.exe (PID: 6988)
      • xl_ext_chrome_setup.exe (PID: 2468)
      • ThunderBHOPlatform.exe (PID: 6240)
      • XLServicePlatform.exe (PID: 6132)

    • Checks Windows Trust Settings

      • XunLeiWebSetup12.0.12.2510.exe (PID: 7132)

    • The process drops C-runtime libraries

      • XunLeiWebSetup12.0.12.2510.exe (PID: 7132)
      • XunLeiSetup12.0.12.2510.exe (PID: 6988)
      • XLServicePlatform.exe (PID: 6132)
      • ThunderBHOPlatform.exe (PID: 6240)
      • xl_ext_chrome_setup.exe (PID: 2468)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • XunLeiWebSetup12.0.12.2510.exe (PID: 7132)
      • XunLeiSetup12.0.12.2510.exe (PID: 6988)

    • Connects to unusual port

      • XunLeiWebSetup12.0.12.2510.exe (PID: 7132)
      • XunLeiSetup12.0.12.2510.exe (PID: 6988)
      • XLServicePlatform.exe (PID: 6132)

    • Access to an unwanted program domain was detected

      • XunLeiWebSetup12.0.12.2510.exe (PID: 7132)
      • XunLeiSetup12.0.12.2510.exe (PID: 6988)

    • Drops the executable file immediately after the start

      • XunLeiWebSetup12.0.12.2510.exe (PID: 7132)
      • XunLeiSetup12.0.12.2510.exe (PID: 6988)
      • XLServicePlatform.exe (PID: 6132)
      • XLWFPSetup.exe (PID: 4524)
      • ThunderBHOPlatform.exe (PID: 6240)
      • xl_ext_chrome_setup.exe (PID: 2468)

    • Reads security settings of Internet Explorer

      • XunLeiWebSetup12.0.12.2510.exe (PID: 7132)
      • XunLeiSetup12.0.12.2510.exe (PID: 6988)
      • BHOInstall.exe (PID: 1636)
      • ThunderBHOPlatform.exe (PID: 6240)
      • XLServicePlatform.exe (PID: 6132)
      • InstallXLWFP.exe (PID: 3448)

    • Executable content was dropped or overwritten

      • XunLeiWebSetup12.0.12.2510.exe (PID: 7132)
      • XunLeiSetup12.0.12.2510.exe (PID: 6988)
      • regsvr32.exe (PID: 1680)
      • regsvr32.exe (PID: 5492)
      • XLWFPSetup.exe (PID: 4524)
      • regsvr32.exe (PID: 5552)
      • regsvr32.exe (PID: 4160)
      • ThunderBHOPlatform.exe (PID: 6240)
      • xl_ext_chrome_setup.exe (PID: 2468)
      • regsvr32.exe (PID: 3316)
      • XLServicePlatform.exe (PID: 6132)

    • Process requests binary or script from the Internet

      • XunLeiSetup12.0.12.2510.exe (PID: 6988)

    • Creates a software uninstall entry

      • XunLeiSetup12.0.12.2510.exe (PID: 6988)

    • Reads the date of Windows installation

      • XunLeiSetup12.0.12.2510.exe (PID: 6988)

    • The process creates files with name similar to system file names

      • XunLeiSetup12.0.12.2510.exe (PID: 6988)
      • XLWFPSetup.exe (PID: 4524)
      • regsvr32.exe (PID: 4160)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 1680)
      • regsvr32.exe (PID: 5552)
      • regsvr32.exe (PID: 4160)
      • regsvr32.exe (PID: 3316)
      • regsvr32.exe (PID: 6992)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • XLWFPSetup.exe (PID: 4524)

    • Drops a system driver (possible attempt to evade defenses)

      • XLWFPSetup.exe (PID: 4524)

    • Uses NETSH.EXE to delete a firewall rule or allowed programs

      • XunLeiSetup12.0.12.2510.exe (PID: 6988)

  • INFO

    • Reads the computer name

      • XunLeiWebSetup12.0.12.2510.exe (PID: 7132)
      • XunLeiSetup12.0.12.2510.exe (PID: 6988)
      • XLServicePlatform.exe (PID: 6132)
      • BHOInstall.exe (PID: 1636)
      • InstallXLWFP.exe (PID: 3448)
      • xl_ext_chrome_setup.exe (PID: 2468)
      • ThunderBHOPlatform.exe (PID: 6240)

    • Creates files in the program directory

      • XunLeiWebSetup12.0.12.2510.exe (PID: 7132)
      • XunLeiSetup12.0.12.2510.exe (PID: 6988)
      • XLServicePlatform.exe (PID: 6132)
      • regsvr32.exe (PID: 1680)
      • regsvr32.exe (PID: 5492)
      • xl_ext_chrome_setup.exe (PID: 2468)
      • regsvr32.exe (PID: 4160)
      • regsvr32.exe (PID: 5552)
      • ThunderBHOPlatform.exe (PID: 6240)
      • XLWFPSetup.exe (PID: 4524)
      • regsvr32.exe (PID: 3316)

    • Checks proxy server information

      • XunLeiWebSetup12.0.12.2510.exe (PID: 7132)
      • XunLeiSetup12.0.12.2510.exe (PID: 6988)
      • BHOInstall.exe (PID: 1636)
      • XLServicePlatform.exe (PID: 6132)
      • InstallXLWFP.exe (PID: 3448)

    • Creates files or folders in the user directory

      • XunLeiWebSetup12.0.12.2510.exe (PID: 7132)
      • XunLeiSetup12.0.12.2510.exe (PID: 6988)
      • explorer.exe (PID: 4552)
      • regsvr32.exe (PID: 6992)
      • BHOInstall.exe (PID: 1636)

    • Checks supported languages

      • XunLeiSetup12.0.12.2510.exe (PID: 6988)
      • XunLeiWebSetup12.0.12.2510.exe (PID: 7132)
      • SysPin.exe (PID: 6948)
      • Win7AppId.exe (PID: 5376)
      • XLServicePlatform.exe (PID: 6132)
      • ThunderBHOPlatform.exe (PID: 6240)
      • Win7AppId.exe (PID: 6740)
      • Win7AppId.exe (PID: 3896)
      • BHOInstall.exe (PID: 1636)
      • xl_ext_chrome_setup.exe (PID: 2468)
      • InstallXLWFP.exe (PID: 3448)
      • XLWFPSetup.exe (PID: 4524)

    • Reads the machine GUID from the registry

      • XunLeiWebSetup12.0.12.2510.exe (PID: 7132)
      • XunLeiSetup12.0.12.2510.exe (PID: 6988)

    • Reads the software policy settings

      • XunLeiWebSetup12.0.12.2510.exe (PID: 7132)

    • Create files in a temporary directory

      • XunLeiWebSetup12.0.12.2510.exe (PID: 7132)
      • XunLeiSetup12.0.12.2510.exe (PID: 6988)
      • BHOInstall.exe (PID: 1636)
      • XLWFPSetup.exe (PID: 4524)
      • ThunderBHOPlatform.exe (PID: 6240)
      • xl_ext_chrome_setup.exe (PID: 2468)
      • regsvr32.exe (PID: 4160)

    • Process checks computer location settings

      • XunLeiSetup12.0.12.2510.exe (PID: 6988)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:05:27 07:23:34+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.27
CodeSize: 264704
InitializedDataSize: 6700032
UninitializedDataSize: -
EntryPoint: 0x1ff29
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 12.0.12.2510
ProductVersionNumber: 12.0.12.2510
FileFlagsMask: 0x003f
FileFlags: Special build
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: 深圳市迅雷网络技术有限公司
FileDescription: 安装迅雷 开始极速下载！
FileVersion: 12,0,12,2510
InternalName: XunLeiWebSetup10.1.38.884.exe
LegalCopyright: 版权所有 (C) 2020 深圳市迅雷网络技术有限公司
LegalTrademarks: 迅雷X
OriginalFileName: XunLeiWebSetup10.1.38.884.exe
ProductName: 迅雷X
ProductVersion: 12.0.12.2510
SpecialBuild: 100001
NoPinTaskBar: -
SimpleBuild: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
185
Monitored processes
56
Malicious processes
6
Suspicious processes
4

Behavior graph

Click at the process to see the details
start xunleiwebsetup12.0.12.2510.exe netsh.exe no specs conhost.exe no specs xunleisetup12.0.12.2510.exe syspin.exe no specs conhost.exe no specs xlwfpsetup.exe xlserviceplatform.exe win7appid.exe no specs win7appid.exe no specs win7appid.exe no specs thunderbhoplatform.exe bhoinstall.exe regsvr32.exe regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe regsvr32.exe no specs xl_ext_chrome_setup.exe regsvr32.exe regsvr32.exe installxlwfp.exe regsvr32.exe netsh.exe no specs netsh.exe no specs regsvr32.exe no specs conhost.exe no specs conhost.exe no specs regsvr32.exe netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs installxlwfp.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs explorer.exe xunleiwebsetup12.0.12.2510.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
208\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netsh.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
232"C:\WINDOWS\system32\netsh.exe" advfirewall firewall add rule name="xlbrowsershell" dir=in action=allow program="C:\Program Files (x86)\Thunder Network\Thunder\Program\resources\bin\TBC\xlbrowsershell.exe" C:\Windows\SysWOW64\netsh.exe—XunLeiSetup12.0.12.2510.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
460regsvr32 /s "C:\Program Files (x86)\Thunder Network\Thunder\Thunder BHO Platform\np_tdieplat.dll"C:\Windows\SysWOW64\regsvr32.exe—XunLeiSetup12.0.12.2510.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
3
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1064\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netsh.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1076\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netsh.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1404"C:\Program Files (x86)\Thunder Network\Thunder\Program\InstallXLWFP.exe" -iC:\Program Files (x86)\Thunder Network\Thunder\Program\InstallXLWFP.exe—XLWFPSetup.exe
User:
admin
Company:
深圳市迅雷网络技术有限公司
Integrity Level:
HIGH
Description:
XLWFP驱动安装程序
Version:
1, 0, 0, 6
1636"C:\Program Files (x86)\Thunder Network\Thunder\BHO\BHOInstall.exe" -checkandstatC:\Program Files (x86)\Thunder Network\Thunder\BHO\BHOInstall.exe
XunLeiSetup12.0.12.2510.exe
User:
admin
Company:
ShenZhen Xunlei Networking Technologies,LTD
Integrity Level:
HIGH
Description:
BHOInstall
Version:
1, 0, 0, 37
Modules
Images
c:\program files (x86)\thunder network\thunder\bho\bhoinstall.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
1680regsvr32 /s "C:\Program Files (x86)\Thunder Network\Thunder\BHO\ThunderAgent.dll"C:\Windows\SysWOW64\regsvr32.exe
XunLeiSetup12.0.12.2510.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2468"C:\Program Files (x86)\Thunder Network\Thunder\BHO\xl_ext_chrome_setup.exe" /SC:\Program Files (x86)\Thunder Network\Thunder\BHO\xl_ext_chrome_setup.exe
XunLeiSetup12.0.12.2510.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files (x86)\thunder network\thunder\bho\xl_ext_chrome_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2476"C:\WINDOWS\system32\netsh.exe" advfirewall firewall add rule name="APlayer" dir=in action=allow program="C:\Program Files (x86)\Thunder Network\Thunder\Program\native\APlayer.exe" C:\Windows\SysWOW64\netsh.exe—XunLeiSetup12.0.12.2510.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Total events
27 650
Read events
27 440
Write events
197
Delete events
13

Modification events

(PID) Process:(7132) XunLeiWebSetup12.0.12.2510.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(7132) XunLeiWebSetup12.0.12.2510.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(7132) XunLeiWebSetup12.0.12.2510.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(7132) XunLeiWebSetup12.0.12.2510.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(7132) XunLeiWebSetup12.0.12.2510.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7132) XunLeiWebSetup12.0.12.2510.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7132) XunLeiWebSetup12.0.12.2510.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4552) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000603A6
Operation:writeName:VirtualDesktop
Value:
1000000030304456033BCEE44DE41B4E8AEC331E84F566D2
(PID) Process:(4552) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search
Operation:writeName:TraySearchBoxVisible
Value:
1
(PID) Process:(4552) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search
Operation:writeName:TraySearchBoxVisibleOnAnyMonitor
Value:
1
Executable files
543
Suspicious files
178
Text files
400
Unknown types
4

Dropped files

PID
Process
Filename
Type
7132XunLeiWebSetup12.0.12.2510.exeC:\Users\admin\AppData\Local\Temp\OnlineInstall\12.0.12.2510\OnlineResource\resource\download_btn@250.pngimage
MD5:0CCD101A1ADFE7CA02DA3EFC092C1268
SHA256:7A5A05255450F34BFFD39D76BC7D41B45CBA7744CC562BECBEB7572B32BC11A1
7132XunLeiWebSetup12.0.12.2510.exeC:\Users\admin\AppData\Local\Temp\OnlineInstall\12.0.12.2510\OnlineResource\resource\install_static_bkg1@250.pngimage
MD5:F0AA99D73F5C74D2A0E280B2E63D26DB
SHA256:9A55287C38D7505DA1B8FA670DE3AC43A1CC3F96693915E3237D231578B820B2
7132XunLeiWebSetup12.0.12.2510.exeC:\Users\admin\AppData\Local\Temp\OnlineInstall\12.0.12.2510\OnlineResource\resource\install_static_bkg3@250.pngimage
MD5:E4A2CDC965D5226E53D0590D3823D7E9
SHA256:7874E23471C913B2A4184BCEC5F61FAE689353229BBD5A121CC06B96715EFE02
7132XunLeiWebSetup12.0.12.2510.exeC:\Users\admin\AppData\Local\Temp\OnlineInstall\12.0.12.2510\OnlineResource\resource\cancel_btn@250.pngimage
MD5:F1FED1CB25575121765CCBC17F7FD6B2
SHA256:16E734822D964FCD21723489108CFAC337B3C910619C21739B63655412849934
7132XunLeiWebSetup12.0.12.2510.exeC:\Users\admin\AppData\Local\Temp\OnlineInstall\12.0.12.2510\OnlineResource\resource\close_btn@250.pngimage
MD5:7FB51054D1CD663BBF8FFA55021B9249
SHA256:771391EAEEA31AB1DEBC547CE1FA14C52302073794A06BACC548BED427EC568E
7132XunLeiWebSetup12.0.12.2510.exeC:\Users\admin\AppData\Local\Temp\OnlineInstall\12.0.12.2510\OnlineResource.7zcompressed
MD5:13CC12CEB724DE0DA2484130D06B55E3
SHA256:0B97FA85D10DFA1E401DE81CE5DB67AEF4D3B2D23BC2457F417B778BCC8F7C8E
7132XunLeiWebSetup12.0.12.2510.exeC:\Users\admin\AppData\Local\Temp\OnlineInstall\12.0.12.2510\OnlineResource\resource\install_bkg.pngimage
MD5:7FEE676F9EAF162DCA4298CF40A971DB
SHA256:7F49606DE40353B0133028433C82995653A6D4D47F5DEB0355320A37ADF14D74
7132XunLeiWebSetup12.0.12.2510.exeC:\Users\admin\AppData\Local\Temp\OnlineInstall\12.0.12.2510\OnlineResource\resource\check@250.pngimage
MD5:5F7FA003532E78A4054E85F7055D048B
SHA256:E7038B0360E4EB261E6DEE8E96D8FF6E28309FC55B82D3B29EC3B8C3F430AD32
7132XunLeiWebSetup12.0.12.2510.exeC:\Users\admin\AppData\Local\Temp\OnlineInstall\12.0.12.2510\OnlineResource\resource\open-folder@250.pngimage
MD5:4A3714D2AB6132EC38427C5C979453F9
SHA256:37CCE4C15FCFD9B396DB672E6F4F3E76EC38B0475193520B7A0873D9A79A8552
7132XunLeiWebSetup12.0.12.2510.exeC:\Users\admin\AppData\Local\Temp\OnlineInstall\12.0.12.2510\OnlineResource\resource\edit_bkg@250.pngimage
MD5:BCD9693086EBDC4B37DD532820133334
SHA256:F94A832248565569DA61BFE475617278B6AE428C2E09B4AE26348AC8AD87DF2F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
21
TCP/UDP connections
67
DNS requests
24
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7132
XunLeiWebSetup12.0.12.2510.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSXi0cW5bD2WLrmnasWibg2OuPDpgQUVXRPsnJP9WC6UNHX5lFcmgGHGtcCEAtQI4lMfXTZ0sNIDHPp0Wg%3D
unknown
—
—
whitelisted
7132
XunLeiWebSetup12.0.12.2510.exe
GET
—
47.101.179.215:8099
http://stat.download.xunlei.com:8099/?xlbtid=1&aid=1022&id=800&peerid=525400CE79E0038Q&userid=&referfrom=100001&OS=win&OSversion=10.0.19045&productname=XunLeiWebSetup12.0.12.2510&productversion=12.0.12.2510
unknown
—
—
unknown
7132
XunLeiWebSetup12.0.12.2510.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ5rEWLwbJFq%2FmAU80sm7E%3D
unknown
—
—
whitelisted
7132
XunLeiWebSetup12.0.12.2510.exe
GET
200
104.18.20.226:80
http://ocsp2.globalsign.com/rootr3/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBT1nGh%2FJBjWKnkPdZIzB1bqhelHBwQUj%2FBLf6guRSSuTVD6Y5qL3uLdG7wCDQHuXyId%2FGI71DM6hVc%3D
unknown
—
—
whitelisted
7132
XunLeiWebSetup12.0.12.2510.exe
GET
—
47.101.179.215:8099
http://stat.download.xunlei.com:8099/?xlbtid=1&aid=1022&id=801&peerid=525400CE79E0038Q&userid=&referfrom=100001&OS=win&OSversion=10.0.19045&productname=XunLeiWebSetup12.0.12.2510&productversion=12.0.12.2510
unknown
—
—
unknown
2028
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
3160
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
3160
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6988
XunLeiSetup12.0.12.2510.exe
GET
—
47.101.179.215:8099
http://stat.download.xunlei.com:8099/?xlbtid=1&aid=1022&id=910&peerid=525400CE79E0038Q&userid=&referfrom=100001&OS=win&OSversion=10.0.19045&productname=XunLeiSetup12.0.12.2510.exe&productversion=12.0.12.2510
unknown
—
—
unknown
6988
XunLeiSetup12.0.12.2510.exe
GET
—
47.101.179.215:8099
http://stat.download.xunlei.com:8099/?xlbtid=1&aid=1022&id=911&peerid=525400CE79E0038Q&userid=&referfrom=100001&OS=win&OSversion=10.0.19045&productname=XunLeiSetup12.0.12.2510.exe&productversion=12.0.12.2510
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:138
—
—
—
whitelisted
6420
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6160
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7132
XunLeiWebSetup12.0.12.2510.exe
47.101.179.215:8099
stat.download.xunlei.com
Hangzhou Alibaba Advertising Co.,Ltd.
CN
unknown
7132
XunLeiWebSetup12.0.12.2510.exe
47.103.194.216:443
conf-m-ssl.xunlei.com
Hangzhou Alibaba Advertising Co.,Ltd.
CN
unknown
7132
XunLeiWebSetup12.0.12.2510.exe
122.189.32.168:80
static-xl9-ssl.xunlei.com
CHINA UNICOM China169 Backbone
CN
suspicious
7132
XunLeiWebSetup12.0.12.2510.exe
104.18.21.226:80
ocsp.globalsign.com
CLOUDFLARENET
—
whitelisted
7132
XunLeiWebSetup12.0.12.2510.exe
104.18.20.226:80
ocsp.globalsign.com
CLOUDFLARENET
—
whitelisted
7132
XunLeiWebSetup12.0.12.2510.exe
113.240.100.228:443
down.sandai.net
No.293,Wanbao Avenue
CN
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.110
whitelisted
static-xl9-ssl.xunlei.com
  • 122.189.32.168
  • 111.6.201.146
  • 175.6.233.195
  • 111.48.108.100
  • 111.177.9.196
  • 36.158.216.175
  • 183.204.211.135
  • 58.19.48.141
  • 111.48.138.116
  • 1.194.172.138
unknown
stat.download.xunlei.com
  • 47.101.179.215
unknown
conf-m-ssl.xunlei.com
  • 47.103.194.216
unknown
ocsp.globalsign.com
  • 104.18.21.226
  • 104.18.20.226
whitelisted
ocsp2.globalsign.com
  • 104.18.20.226
  • 104.18.21.226
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
  • 20.73.194.208
whitelisted
down.sandai.net
  • 113.240.100.228
  • 119.36.124.135
  • 111.47.229.217
  • 122.189.226.141
  • 111.6.255.158
  • 118.253.153.153
  • 183.204.210.163
  • 183.204.231.154
  • 119.36.90.183
  • 111.174.12.222
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted

Threats

PID
Process
Class
Message
7132
XunLeiWebSetup12.0.12.2510.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP ThunderUnion Install Checkin
7132
XunLeiWebSetup12.0.12.2510.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP ThunderUnion Install Checkin
7132
XunLeiWebSetup12.0.12.2510.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP ThunderUnion Install Checkin
7132
XunLeiWebSetup12.0.12.2510.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP ThunderUnion Install Checkin
7132
XunLeiWebSetup12.0.12.2510.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP ThunderUnion Install Checkin
7132
XunLeiWebSetup12.0.12.2510.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP ThunderUnion Install Checkin
6988
XunLeiSetup12.0.12.2510.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP ThunderUnion Install Checkin
7132
XunLeiWebSetup12.0.12.2510.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP ThunderUnion Install Checkin
6988
XunLeiSetup12.0.12.2510.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP ThunderUnion Install Checkin
1636
BHOInstall.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User-Agent (HTTP Downloader)
Process
Message
XunLeiWebSetup12.0.12.2510.exe
UnCompress7z begin===============
XunLeiWebSetup12.0.12.2510.exe
UnCompress7z begin===============
XunLeiSetup12.0.12.2510.exe
..
XunLeiSetup12.0.12.2510.exe
..
XunLeiSetup12.0.12.2510.exe
UnCompress7z begin===============
XunLeiSetup12.0.12.2510.exe
UnCompress7z begin===============
XunLeiSetup12.0.12.2510.exe
UnCompress7z begin===============
XunLeiSetup12.0.12.2510.exe
UnCompress7z begin===============
XunLeiSetup12.0.12.2510.exe
UnCompress7z begin===============
regsvr32.exe
[6992:6372] [06:18 46] Debug <np_tdieplat.dll> [osshell.cpp:270 Xunlei::Platform::OSShell::GetAppDatalowPath] using SHGetKnownFolderPath with FOLDERID_LocalAppDataLow
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
XunLeiWebSetup12.0.12.2510.exe