home

QiqiBox.exe

奇奇美化大师

Beijing Wenyue Technology Co.,Ltd.

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘QiqiBox’.
Publisher:
Wenyue Corporation  (signed by Beijing Wenyue Technology Co.,Ltd.)

Product:
奇奇美化大师

Description:
奇奇美化大师主程序

Version:
2.0.3.4700

MD5:
ebecd7b410a7a6233c8975bee5797680

SHA-1:
d04ccf5b0ab4d631844d0b039509f3bbe9fd7832

SHA-256:
9aad5d4e8c74c5b0eb71510ca598a723825db7d93fa962bc799258c389b339e3

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/28/2024 2:39:13 AM UTC  (today)

File size:
1 MB (1,063,600 bytes)

Product version:
2.0.3.4700

Copyright:
Copyright (C) 2007-2013 Wenyue Corporation

Original file name:
QiqiBox.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\roaming\qiqibox\qiqibox.exe

Digital Signature
Signed by:
Beijing Wenyue Technology Co.,Ltd.

Authority:
Thawte, Inc.

Valid from:
10/21/2013 8:00:00 AM

Valid to:
10/22/2014 7:59:59 AM

Subject:
CN="Beijing Wenyue Technology Co.,Ltd.", OU=IThelp, O="Beijing Wenyue Technology Co.,Ltd.", L=Beijing, S=Beijing, C=CN

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
265E6914040F4A740B16B1E0D9E67CFE

File PE Metadata
Compilation timestamp:
5/6/2014 10:52:39 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
24576:Nf6HBgp3FJDL9eXF6RmJWJIT+z700b264db:Nf6Hu3qF6RmJWbzw0b264db

Entry address:
0x5CD08

Entry point:
E8, 52, 6A, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 5D, E9, 87, 01, 00, 00, 3B, 0D, CC, 43, 49, 00, 75, 02, F3, C3, E9, CE, 6A, 00, 00, 8B, FF, 55, 8B, EC, 8B, 55, 08, 56, 57, 85, D2, 74, 07, 8B, 7D, 0C, 85, FF, 75, 13, E8, 92, 3B, 00, 00, 6A, 16, 5E, 89, 30, E8, 3A, 6D, 00, 00, 8B, C6, EB, 33, 8B, 45, 10, 85, C0, 75, 04, 88, 02, EB, E2, 8B, F2, 2B, F0, 8A, 08, 88, 0C, 06, 40, 84, C9, 74, 03, 4F, 75, F3, 85, FF, 75, 11, C6, 02, 00, E8, 5C, 3B, 00, 00, 6A, 22, 59, 89, 08, 8B, F1, EB, C6, 33, C0, 5F...
 
[+]

Entropy:
7.1036

Code size:
495 KB (506,880 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
QiqiBox

Command:
"C:\users\{user}\appdata\roaming\qiqibox\qiqibox.exe" -autorun


Scan QiqiBox.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.