PUP.TopTools

The detection of PUP.TopTools on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It's essential to understand what this detection means and how to properly remove it to prevent any potential harm.

What Is PUP.TopTools?

PUP.TopTools is a type of malware that is classified as a potentially unwanted program. This means that while it may not be as malicious as other types of malware, it can still cause problems with your system and compromise your privacy. PUPs are often installed unintentionally by users, usually through bundled software downloads or by clicking on suspicious links.

How PUP.TopTools Operates

PUP.TopTools operates by installing itself on your system and potentially altering your browser settings, registry entries, and other system configurations. It may also collect your personal data, such as browsing history and search queries, and transmit it to remote servers. Additionally, PUPs can slow down your system, cause annoying pop-ups and ads, and even install other malicious programs.

Symptoms of Infection

If your system is infected with PUP.TopTools, you may experience a range of symptoms, including slow system performance, unwanted pop-ups and ads, changed browser settings, and suspicious programs installed on your system. You may also notice that your system is crashing or freezing frequently, or that your personal data is being collected and used for targeted advertising.

• Unwanted browser extensions or toolbars
• Changed homepage or default search engine
• Pop-ups and ads that appear randomly
• Suspicious programs or processes running in the background
• Slow system performance or crashes

How to Remove PUP.TopTools

1. Boot your system in Safe Mode with Networking to prevent PUP.TopTools from loading and to allow for a more effective removal process.
2. Use a reputable anti-malware tool, such as SpyHunter, to perform a full scan of your system and detect any malicious files or programs.
3. Uninstall any suspicious programs or software that you don't recognize or need, as they may be related to the PUP infection.
4. Reset your browser settings, including Chrome, Firefox, and Edge, to their default values to remove any changes made by the PUP.
5. Reboot your system and perform another scan with your anti-malware tool to ensure that all remnants of PUP.TopTools have been removed.

Conclusion

Removing PUP.TopTools from your system requires a combination of technical knowledge and the right tools. By following the steps outlined above, you can effectively remove this potentially unwanted program and prevent any further harm to your system. It's essential to be vigilant when downloading software and to always read the terms and conditions carefully to avoid unintentionally installing PUPs. Additionally, keeping your operating system and software up to date, as well as using reputable anti-malware tools, can help prevent future infections and keep your system secure.

Analysis Report

General information

Family Name:	PUP.TopTools
Signature status:	Self Signed

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 24101e16a33d6b8b5ede49adb5799474 SHA1: 468571ad58803f9ef4b8c511ddf413a3d36236ef SHA256: 975F9AE814BB1B372C7EE0D69AF214F9353D44AD750C1A2B097E0F62C317E3B7 File Size: 669.67 KB, 669672 bytes

MD5: 48061dc67b60d631611db6dec4b01e84 SHA1: 45d3e2534d07d04ead9fb4d9dc1b1f5d1fb12e6c SHA256: 35D4F3024A2DA253BF860641AADAE804D5896A67D8F7D4DAA9E3A62B4468DCF5 File Size: 6.44 MB, 6442248 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)

Show More

• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Channel Name	base
Company Name	CatchYouTube ShenZhen Enode Techology co,.Ltd
File Description	CatchYouTube The Desktop Weather
File Version	3.0.0.1274 1.2.2.10256
Internal Name	mainfram.exe
Legal Copyright	Copyright (C) 2014 ShenZhen Enode Techology co,.Ltd All Rights Reserved Copyright (C) 2015
Original Filename	mainfram.exe
Product Name	CatchYouTube The Desktop Weather
Product Version	3.0.0.1274 1.2.2.10256

Digital Signatures

i

Digital Signatures

This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.

Signer	Root	Status
ShenZhen Enode Techology co,.Ltd	VeriSign Class 3 Code Signing 2010 CA	Self Signed

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
\device\harddisk0\dr0	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\weathertool\1.2.2.10256\cloudoptclient\cloudoptclient.exe	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\cloudoptclient\cloudoptclient.exe	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\cloudoptclient\url.ini	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\cloudoptclient\url.ini	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\crashreport64.exe	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\crashreport64.exe	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\crashreportmoduleconf.ini	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\crashreportmoduleconf.ini	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\crashul.exe	Generic Write,Read Attributes

Show More

c:\program files (x86)\weathertool\1.2.2.10256\crashul.exe	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\evpconfig.ini	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\evpconfig.ini	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\evpdr.dll	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\evpdr.dll	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\evphelp.dll	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\evphelp.dll	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\evpkernel.dll	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\evpkernel.dll	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\evpnet.dll	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\evpnet.dll	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\evptask.dll	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\evptask.dll	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\installhelper.exe	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\installhelper.exe	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\report.exe	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\report.exe	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\city.xml	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\city.xml	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\cn	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\cn\skin.xml	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\cn\skin.xml	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\cn\skin2.xml	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\cn\skin2.xml	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\cn\skin3.xml	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\cn\skin3.xml	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\cn\skin4.xml	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\cn\skin4.xml	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\en	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\en\skin.xml	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\en\skin.xml	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\en\skin2.xml	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\en\skin2.xml	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\en\skin3.xml	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\en\skin3.xml	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\en\skin4.xml	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\en\skin4.xml	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\icon_config.ini	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\icon_config.ini	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\jp	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\jp\skin.xml	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\jp\skin.xml	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\jp\skin2.xml	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\jp\skin2.xml	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\jp\skin3.xml	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\jp\skin3.xml	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\jp\skin4.xml	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\jp\skin4.xml	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\about.png	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\about.png	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\back.png	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\back.png	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\bg.png	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\bg.png	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\bg2.png	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\bg2.png	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\bg3.png	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\bg3.png	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\close.png	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\close.png	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\collapse.png	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\collapse.png	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\comboboxarrow.png	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\comboboxarrow.png	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\expand.png	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\expand.png	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\humidity.png	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\humidity.png	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\refresh.png	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\refresh.png	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\refresh10g.png	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\refresh10g.png	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\scrollbar.bmp	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\scrollbar.bmp	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\scrollbars.png	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\scrollbars.png	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\search.png	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\search.png	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\select.png	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\select.png	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\split_line.png	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\split_line.png	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\tianqi_l_30x28.png	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\tianqi_l_30x28.png	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\tianqi_l_60x55.png	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\tianqi_l_60x55.png	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\uninstall	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\uninstall\bg.png	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\uninstall\bg.png	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\uninstall\button.png	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\uninstall\button.png	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\uninstall\buttondown.png	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\uninstall\buttondown.png	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\uninstall\click.png	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\uninstall\click.png	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\uninstall\close.png	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\uninstall\close.png	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\uninstall\hover.png	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\uninstall\hover.png	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\uninstall\normal.png	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\uninstall\normal.png	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\uninstall\page1.png	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\uninstall\page1.png	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\uninstall\page2.png	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\uninstall\page2.png	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\uninstall\page3.png	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\uninstall\page3.png	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\uninstall\page4.png	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\uninstall\page4.png	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\uninstall\uninstall.png	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\uninstall\uninstall.png	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\uninstall\uninstalldown.png	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\uninstall\uninstalldown.png	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\unselect.png	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\unselect.png	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\write_line.png	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\picture\write_line.png	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\wunder_city.xml	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\wunder_city.xml	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\xp	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\xp\cn	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\xp\cn\skin.xml	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\xp\cn\skin.xml	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\xp\cn\skin2.xml	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\xp\cn\skin2.xml	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\xp\cn\skin3.xml	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\xp\cn\skin3.xml	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\xp\cn\skin4.xml	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\xp\cn\skin4.xml	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\xp\en	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\xp\en\skin.xml	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\xp\en\skin.xml	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\xp\en\skin2.xml	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\xp\en\skin2.xml	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\xp\en\skin3.xml	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\xp\en\skin3.xml	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\xp\en\skin4.xml	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\xp\en\skin4.xml	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\xp\jp	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\xp\jp\skin.xml	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\xp\jp\skin.xml	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\xp\jp\skin2.xml	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\xp\jp\skin2.xml	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\xp\jp\skin3.xml	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\xp\jp\skin3.xml	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\xp\jp\skin4.xml	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\xp\jp\skin4.xml	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\yahoo_city.xml	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\res\yahoo_city.xml	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\updateplatform.exe	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\updateplatform.exe	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\weather.exe	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\weather.exe	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\weatherentrydll.dll	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\weatherentrydll.dll	Synchronize,Write Attributes
c:\program files (x86)\weathertool\1.2.2.10256\weatherservice.exe	Generic Write,Read Attributes
c:\program files (x86)\weathertool\1.2.2.10256\weatherservice.exe	Synchronize,Write Attributes
c:\users\public\documents\baidu\common\i18n\conf.db	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\public\documents\guid\common\i18n\conf.db	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\public\documents\guid\common\i18n\ipcsupdatecache\installhelper\6608201269efba00	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\installhelper.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\installhelper.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsgfe3e.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\roaming\weathertool\dump\bugreportconfig.ini	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\weathertool\dump\dumpconfig.ini	Generic Read,Write Data,Write Attributes,Write extended,Append data

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKLM\software\weathertool\quit::quitsession	{D1E7C8F3-3A58-4A99-A6C2-06008D500770}-1	RegNtPreCreateKey
HKLM\software\weathertool\settings::producttype	DeskTop	RegNtPreCreateKey
HKLM\software\microsoft\windows\currentversion\uninstall\weathertool::displayname	The Desktop Weather 1.2	RegNtPreCreateKey
HKLM\software\microsoft\windows\currentversion\uninstall\weathertool::displayicon	C:\Program Files (x86)\WeatherTool\1.2.2.10256\weather.exe	RegNtPreCreateKey
HKLM\software\microsoft\windows\currentversion\uninstall\weathertool::uninstallstring	C:\Program Files (x86)\WeatherTool\1.2.2.10256\InstallHelper.exe -Uninstall English	RegNtPreCreateKey
HKLM\software\microsoft\windows\currentversion\uninstall\weathertool::displayversion	1.2.2.10256	RegNtPreCreateKey
HKLM\software\microsoft\windows\currentversion\uninstall\weathertool::displayfullversion	1.2.2.10256	RegNtPreCreateKey
HKLM\software\microsoft\windows\currentversion\uninstall\weathertool::publisher	ShenZhen Enode Techology co,.Ltd	RegNtPreCreateKey
HKLM\software\weathertool\settings::datasource	BAIDU	RegNtPreCreateKey
HKLM\software\weathertool\settings::apiurl		RegNtPreCreateKey

Show More

HKLM\software\weathertool\settings::updateurl		RegNtPreCreateKey
HKLM\software\weathertool\settings::cityapiurl	http://weather.toptools100.com/getCity?	RegNtPreCreateKey
HKLM\software\weathertool\settings::searchcityapiurl	http://weather.toptools100.com/search?	RegNtPreCreateKey
HKLM\software\weathertool\settings::reloaddatainterval	6	RegNtPreCreateKey
HKLM\software\dtsencodetools::{3b7fd029-d932-411b-af15-c96cf8ef0c18}	{3B7FD029-D932-411b-AF15-C96CF8EF0C18}	RegNtPreCreateKey
HKLM\software\weathertool::partnerid	base	RegNtPreCreateKey
HKLM\software\weathertool::version	1.2.2.10256	RegNtPreCreateKey
HKLM\software\weathertool::userid	=r=:�pC���؊ZI[$	RegNtPreCreateKey
HKLM\software\weathertool\install_mark::version	1.2.2.10256	RegNtPreCreateKey
HKLM\software\weathertool\1.2.2.10256::install_path	C:\Program Files (x86)\WeatherTool\1.2.2.10256	RegNtPreCreateKey
HKLM\software\weathertool::install_first_time	2026-04-27_12:33:01	RegNtPreCreateKey
HKCU\software\baidu\application bug\allinone\log\installhelper.exe::ticks	줰ﲋ홁ǜ	RegNtPreCreateKey
HKCU\software\baidu\application bug\allinone\log\installhelper.exe::times		RegNtPreCreateKey
HKCU\software\baidu\application bug\allinone\log\installhelper.exe::times		RegNtPreCreateKey
HKCU\software\baidu\application bug\allinone\log\installhelper.exe::times		RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Process Manipulation Evasion	NtUnmapViewOfSection ReadProcessMemory
Process Shell Execute	CreateProcess
Syscall Use	ntdll.dll!NtAccessCheck ntdll.dll!NtAddAtomEx ntdll.dll!NtAlpcConnectPortEx ntdll.dll!NtAlpcQueryInformation ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtApphelpCacheControl ntdll.dll!NtAssociateWaitCompletionPacket ntdll.dll!NtCancelWaitCompletionPacket ntdll.dll!NtClose ntdll.dll!NtCreateEvent Show More ntdll.dll!NtCreateIoCompletion ntdll.dll!NtCreateKey ntdll.dll!NtCreateMutant ntdll.dll!NtCreateSection ntdll.dll!NtCreateSemaphore ntdll.dll!NtCreateTimer2 ntdll.dll!NtCreateWaitCompletionPacket ntdll.dll!NtCreateWorkerFactory ntdll.dll!NtDeviceIoControlFile ntdll.dll!NtDuplicateObject ntdll.dll!NtDuplicateToken ntdll.dll!NtEnumerateKey ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtLockFile ntdll.dll!NtMapViewOfSection ntdll.dll!NtNotifyChangeKey ntdll.dll!NtOpenDirectoryObject ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenKeyEx ntdll.dll!NtOpenProcess ntdll.dll!NtOpenProcessToken ntdll.dll!NtOpenProcessTokenEx ntdll.dll!NtOpenSection ntdll.dll!NtOpenSemaphore ntdll.dll!NtOpenThreadToken ntdll.dll!NtOpenThreadTokenEx ntdll.dll!NtPowerInformation ntdll.dll!NtProtectVirtualMemory ntdll.dll!NtQueryAttributesFile ntdll.dll!NtQueryDefaultLocale ntdll.dll!NtQueryDirectoryFileEx ntdll.dll!NtQueryInformationFile ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationThread ntdll.dll!NtQueryInformationToken ntdll.dll!NtQueryKey ntdll.dll!NtQueryLicenseValue ntdll.dll!NtQueryObject ntdll.dll!NtQueryPerformanceCounter ntdll.dll!NtQuerySecurityAttributesToken ntdll.dll!NtQuerySecurityObject ntdll.dll!NtQuerySystemInformation ntdll.dll!NtQuerySystemInformationEx ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtQueryVolumeInformationFile ntdll.dll!NtQueryWnfStateData ntdll.dll!NtReadFile ntdll.dll!NtReadRequestData ntdll.dll!NtReleaseMutant ntdll.dll!NtReleaseSemaphore ntdll.dll!NtReleaseWorkerFactoryWorker ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationKey ntdll.dll!NtSetInformationObject ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationThread ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtSetTimer2 ntdll.dll!NtSubscribeWnfStateChange ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtUnlockFile ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtUnmapViewOfSectionEx ntdll.dll!NtWaitForSingleObject ntdll.dll!NtWaitForWorkViaWorkerFactory ntdll.dll!NtWaitLowEventPair ntdll.dll!NtWorkerFactoryWorkerReady ntdll.dll!NtWriteFile UNKNOWN
Service Control	OpenSCManager OpenService StartService
Network Info Queried	GetAdaptersAddresses
Anti Debug	IsDebuggerPresent
Network Winhttp	WinHttpConnect WinHttpOpen WinHttpOpenRequest
Other Suspicious	AdjustTokenPrivileges
Process Terminate	TerminateProcess

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

"C:\Users\Rqrzmvai\AppData\Local\Temp\InstallHelper.exe" -CalendarInstalled

"C:\Users\Rqrzmvai\AppData\Local\Temp\InstallHelper.exe" -InstallBegin

"C:\Program Files (x86)\WeatherTool\1.2.2.10256\WeatherService.exe" -InstallService

"C:\Program Files (x86)\WeatherTool\1.2.2.10256\InstallHelper.exe" -Install "c:\users\user\downloads\45d3e2534d07d04ead9fb4d9dc1b1f5d1fb12e6c_0006442248"

"C:\Program Files (x86)\WeatherTool\1.2.2.10256\CrashReport64.exe" /BugInfo:5870860,2016,8820,588

Show More

"C:\Program Files (x86)\WeatherTool\1.2.2.10256\CrashReport64.exe" /BugInfo:4b10860,4948,3492,616

"C:\Program Files (x86)\WeatherTool\1.2.2.10256\InstallHelper.exe" -InstallCloudOPTClient

"C:\Program Files (x86)\WeatherTool\1.2.2.10256\CrashReport64.exe" /BugInfo:52c0860,7120,5572,616