home

qanxicwl.exe

CPU-Z

Software Association LLC

The file qanxicwl.exe by Software Association has been detected as a potentially unwanted program by 17 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. The file has been seen being downloaded from cpuz.1800download.com and multiple other hosts.
Publisher:
Software Association LLC  (signed and verified)

Product:
CPU-Z

Version:
1.0.0.0

MD5:
2874a74b0fa62e9c5264576ac4440a1b

SHA-1:
f75f49f6121e5fc527a2da4e2760d60605b054c8

SHA-256:
4cde41be4f914beb3c42941ede84606290655d84ab8bf78efd791c5cb8f1ffd6

Scanner detections:
17 / 68

Status:
Potentially unwanted

Explanation:
Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:
8/14/2025 4:53:35 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Riskware.Agent
7.1.1

AhnLab V3 Security
PUP/Win32.OpenCandy
2015.04.21

AVG
OpenCandy
2016.0.3132

Baidu Antivirus
Adware.Win32.OpenCandy
4.0.3.15421

Clam AntiVirus
Win.Trojan.Agent-855157
0.98/21511

Dr.Web
Adware.Downware.9759
9.0.1.0111

ESET NOD32
Win32/OpenCandy.C potentially unsafe (variant)
9.11505

Fortinet FortiGate
Riskware/OpenCandy
4/21/2015

G Data
Win32.Adware.OpenCandy
15.4.25

K7 AntiVirus
Trojan
13.202.15654

Malwarebytes
PUP.Optional.OpenCandy
v2015.04.21.01

McAfee
Artemis!2874A74B0FA6
5600.6788

Panda Antivirus
PUP/OpenCandy
15.04.21.01

Sophos
OpenCandy
4.98

Trend Micro House Call
ADW_OpenCandy
7.2.111

Trend Micro
ADW_OpenCandy
10.465.21

VIPRE Antivirus
Trojan.Win32.Generic
39526

File size:
415.6 KB (425,616 bytes)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\qanxicwl.exe.part

Digital Signature
Signed by:
Software Association LLC

Authority:
DigiCert Inc

Valid from:
1/12/2015 10:00:00 PM

Valid to:
1/21/2016 10:00:00 AM

Subject:
CN=Software Association LLC, O=Software Association LLC, L=Dnepropetrovsk, S=Dnipropetrovs'ka Oblast', C=UA

Issuer:
CN=DigiCert SHA2 Assured ID Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:
0E1FC80B1C57AD69AA6F8D65D1CF90CF

File PE Metadata
Compilation timestamp:
5/19/2013 8:53:00 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:WiusMVt6Xbdq8kOK/cNByU/DekshdIrHdixcJTzQ6I48oo:CsMV4LMtOPXyU/iJaDgSXlI4y

Entry address:
0x331C

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 30, 92, 40, 00, 89, 6C, 24, 14, FF, 15, 34, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, BC, 70, 40, 00, 55, FF, 15, AC, 72, 40, 00, 6A, 08, A3, 98, 92, 42, 00, E8, A8, 2E, 00, 00, A3, E4, 91, 42, 00, 55, 8D, 44, 24, 34, 68, B4, 02, 00, 00, 50, 55, 68, 90, 06, 42, 00, FF, 15, 7C, 71, 40, 00, 68, 7C, 93, 40, 00, 68, E0, 81, 42, 00, E8, 13, 2B, 00, 00, FF, 15, 34, 71, 40, 00, BB, 00, 40, 43, 00, 50, 53, E8, 01, 2B, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
24 KB (24,576 bytes)

The file qanxicwl.exe has been seen being distributed by the following 2 URLs.

http://cpuz.1800download.com/get_azure_file/wUiS4WnYccXBwj pXP7oQlssmV89fDKmGBLgNIWQ9b9npCC8/np5iNEKJ1W0KP62LXj/.../CGOo5xKPxb05FpnkesOqbXhY38K6Gegv3BcX55q5yUrzLaB0nT6nEcQe5MSxUT w54Ob2SYmbaRBR4E5Pn8xu6GtGxBz2Ensg4gGASeiDAz5sZ72zEI=

http://jdcdn2com.blob.core.windows.net/fas/wi/18/34/1/.../cpu-z_1.72-en.exe

Remove qanxicwl.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.