home

KwMusic.exe

酷我音乐盒

BEIJING KUWO TECHNOLOGY CO.,LTD.

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘kwmusic’.
Publisher:
酷我科技  (signed by BEIJING KUWO TECHNOLOGY CO.,LTD.)

Product:
酷我音乐盒

Version:
5, 0, 0, 0

MD5:
52997ed71d783bf8c1ccd8596cbb3914

SHA-1:
28329ed02d177ed7c1ee44a64941826dc9032672

SHA-256:
de631e690bd9015fb7ac13342ec9b519cb734a01064bacff202340f694b6ab15

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/18/2024 5:16:20 AM UTC  (today)

File size:
535.4 KB (548,272 bytes)

Product version:
5, 0, 0, 0

Copyright:
酷我公司保留所有权利

Original file name:
KwMusic.exe

File type:
Executable application (Win32 EXE)

Language:
Chinese (Simplified, China)

Digital Signature
Signed by:
BEIJING KUWO TECHNOLOGY CO.,LTD.

Authority:
VeriSign, Inc.

Valid from:
12/6/2011 8:00:00 AM

Valid to:
12/6/2013 7:59:59 AM

Subject:
CN="BEIJING KUWO TECHNOLOGY CO.,LTD.", OU=Digital ID Class 3 - Microsoft Software Validation v2, O="BEIJING KUWO TECHNOLOGY CO.,LTD.", L=Beijing, S=Beijing, C=CN

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
47D7B3A21FF5C08D6EF21F8C7DEC0CD7

File PE Metadata
Compilation timestamp:
11/12/2012 10:30:53 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
12288:HDDIfY9qtgWjOdB0+gJfY9qtgWjOdB0+go:HDDIT+ET+z

Entry address:
0x547A

Entry point:
E8, C2, 5B, 00, 00, E9, 78, FE, FF, FF, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 8B, 4C, 24, 04, F7, C1, 03, 00, 00, 00, 74, 24, 8A, 01, 83, C1, 01, 84, C0, 74, 4E, F7, C1, 03, 00, 00, 00, 75, EF, 05, 00, 00, 00, 00, 8D, A4, 24, 00, 00, 00, 00, 8D, A4, 24, 00, 00, 00, 00, 8B, 01, BA, FF, FE, FE, 7E, 03, D0, 83, F0, FF, 33, C2, 83, C1, 04, A9, 00, 01, 01, 81, 74, E8, 8B, 41, FC, 84, C0, 74, 32, 84, E4, 74, 24, A9, 00, 00, FF, 00, 74, 13, A9, 00, 00, 00, FF, 74, 02, EB, CD, 8D, 41, FF, 8B, 4C, 24, 04...
 
[+]

Entropy:
5.3753

Code size:
79.5 KB (81,408 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
kwmusic

Command:
"C:\media\kuwo\kwmusic\kwmusic.exe" \autorun


Scan KwMusic.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.