b35d15d82efffd1561d404c377d23c97fdacdfc90838b708364ecc0f7c1f2967

Analysis

max time kernel
135s
max time network
155s
platform
windows10_x64
resource
win10v20210410
submitted
08-07-2021 17:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FastDownloader.exe
Size

1.0MB
MD5

ce0abe6028bcff4777da9322c9451998
SHA1

a8d277111e2801b7dea3a31f9d0d6f4a68f011f4
SHA256

b35d15d82efffd1561d404c377d23c97fdacdfc90838b708364ecc0f7c1f2967
SHA512

19f57334c737fd7572e2f15b55c2cd5bba33f8e5d6632346b1f0908b1dcb46c66847cee1b8d7b35eb5243431fc61847a8227f978927a0eb4bdb7767cfa67cb1f

Score

10^/10

bootkit discovery persistence

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

regsvr32.exeDism.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\ContextMenuExt	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\ContextMenuExt\ = "{6ADF19E3-77A3-4395-ADB4-9FD7D351EB3E}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\ContextMenuPropExt	Dism.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\ContextMenuPropExt\ = "{903D855A-D671-4A8E-A592-9168755917DB}"	Dism.exe

Registers COM server for autorun 1 TTPs
persistence

Registry Run Keys / Startup Folder
T1060
Downloads MZ/PE file

Executes dropped EXE 15 IoCs

Processes:

1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exeInst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exeLDSGameMasterInstRoad_211501.exeldsgamemaster.exeSoftMgrInst.exejQrNqLvTuHbKiJmO.exekuaizip_setup_2206473764_beiao_004.exeIAbtukweZabckantu4092521131beiao001.exeMobileEmuHelper.exetMpOjCxXuRyCrKpX.exeLDSGameHall.exePhotoViewer.exeupdate.exePhotoViewer.exePhotoViewer.exe

pid	process
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
1464	LDSGameMasterInstRoad_211501.exe
3788	ldsgamemaster.exe
4596	SoftMgrInst.exe
1536	jQrNqLvTuHbKiJmO.exe
4232	kuaizip_setup_2206473764_beiao_004.exe
4164	IAbtukweZabckantu4092521131beiao001.exe
2216	MobileEmuHelper.exe
4220	tMpOjCxXuRyCrKpX.exe
4152	LDSGameHall.exe
4348	PhotoViewer.exe
1532	update.exe
5132	PhotoViewer.exe
5196	PhotoViewer.exe

Sets DLL path for service in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112
Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe

Loads dropped DLL 64 IoCs

Processes:

LDSGameMasterInstRoad_211501.exeInst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exeldsgamemaster.exeSoftMgrInst.exejQrNqLvTuHbKiJmO.exeMobileEmuHelper.exesvchost.exeRegSvr32.exeRegSvr32.exeregsvr32.exeregsvr32.exeupdate.exeDism.exePhotoViewer.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeLDSGameHall.exesvchost.exeregsvr32.exePhotoViewer.exe

pid	process
1464	LDSGameMasterInstRoad_211501.exe
1464	LDSGameMasterInstRoad_211501.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
4596	SoftMgrInst.exe
4596	SoftMgrInst.exe
3788	ldsgamemaster.exe
4596	SoftMgrInst.exe
4596	SoftMgrInst.exe
4596	SoftMgrInst.exe
4596	SoftMgrInst.exe
4596	SoftMgrInst.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
1536	jQrNqLvTuHbKiJmO.exe
3788	ldsgamemaster.exe
2216	MobileEmuHelper.exe
3788	ldsgamemaster.exe
3524	svchost.exe
3788	ldsgamemaster.exe
3904	RegSvr32.exe
3816	RegSvr32.exe
3600	regsvr32.exe
1796	regsvr32.exe
1532	update.exe
2892	Dism.exe
2892	Dism.exe
3524	svchost.exe
4348	PhotoViewer.exe
4964	regsvr32.exe
2416
2416
4632	regsvr32.exe
5044	regsvr32.exe
4708	regsvr32.exe
4152	LDSGameHall.exe
4152	LDSGameHall.exe
4152	LDSGameHall.exe
4160	svchost.exe
3480	regsvr32.exe
2892	Dism.exe
4348	PhotoViewer.exe
4348	PhotoViewer.exe
4348	PhotoViewer.exe
4348	PhotoViewer.exe
4152	LDSGameHall.exe
4152	LDSGameHall.exe
4152	LDSGameHall.exe
2416
4152	LDSGameHall.exe
4152	LDSGameHall.exe
1532	update.exe
1532	update.exe
3524	svchost.exe
2416
5132	PhotoViewer.exe
5132	PhotoViewer.exe
5132	PhotoViewer.exe
5132	PhotoViewer.exe
4348	PhotoViewer.exe
4348	PhotoViewer.exe
2416
2416

Checks for any installed AV software in registry 1 TTPs 12 IoCs

Security Software Discovery

T1063

Processes:

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Launcher	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AhnLab\V3IS80	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AhnLab\V3IS80	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avira\Launcher	jQrNqLvTuHbKiJmO.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Launcher	jQrNqLvTuHbKiJmO.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AhnLab\V3IS80	jQrNqLvTuHbKiJmO.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avira\Launcher	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AhnLab\V3IS80	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AhnLab\V3IS80	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avira\Launcher	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Launcher	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AhnLab\V3IS80	jQrNqLvTuHbKiJmO.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

ldsgamemaster.exe

description	ioc	process
File opened (read-only)	\??\T:	ldsgamemaster.exe
File opened (read-only)	\??\E:	ldsgamemaster.exe
File opened (read-only)	\??\Q:	ldsgamemaster.exe
File opened (read-only)	\??\O:	ldsgamemaster.exe
File opened (read-only)	\??\S:	ldsgamemaster.exe
File opened (read-only)	\??\G:	ldsgamemaster.exe
File opened (read-only)	\??\M:	ldsgamemaster.exe
File opened (read-only)	\??\J:	ldsgamemaster.exe
File opened (read-only)	\??\N:	ldsgamemaster.exe
File opened (read-only)	\??\P:	ldsgamemaster.exe
File opened (read-only)	\??\R:	ldsgamemaster.exe
File opened (read-only)	\??\V:	ldsgamemaster.exe
File opened (read-only)	\??\W:	ldsgamemaster.exe
File opened (read-only)	\??\F:	ldsgamemaster.exe
File opened (read-only)	\??\H:	ldsgamemaster.exe
File opened (read-only)	\??\X:	ldsgamemaster.exe
File opened (read-only)	\??\Y:	ldsgamemaster.exe
File opened (read-only)	\??\L:	ldsgamemaster.exe
File opened (read-only)	\??\U:	ldsgamemaster.exe
File opened (read-only)	\??\Z:	ldsgamemaster.exe
File opened (read-only)	\??\I:	ldsgamemaster.exe
File opened (read-only)	\??\K:	ldsgamemaster.exe

Writes to the Master Boot Record (MBR) 1 TTPs 10 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

Processes:

FastDownloader.exeInst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exejQrNqLvTuHbKiJmO.exeMobileEmuHelper.exeLDSGameHall.exe1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exeldsgamemaster.exeIAbtukweZabckantu4092521131beiao001.exekuaizip_setup_2206473764_beiao_004.exeupdate.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	FastDownloader.exe
File opened for modification	\??\PhysicalDrive0	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
File opened for modification	\??\PhysicalDrive0	jQrNqLvTuHbKiJmO.exe
File opened for modification	\??\PhysicalDrive0	MobileEmuHelper.exe
File opened for modification	\??\PhysicalDrive0	LDSGameHall.exe
File opened for modification	\??\PhysicalDrive0	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
File opened for modification	\??\PhysicalDrive0	ldsgamemaster.exe
File opened for modification	\??\PhysicalDrive0	IAbtukweZabckantu4092521131beiao001.exe
File opened for modification	\??\PhysicalDrive0	kuaizip_setup_2206473764_beiao_004.exe
File opened for modification	\??\PhysicalDrive0	update.exe

Drops file in System32 directory 11 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9A19ADAD9D098E039450ABBEDD5616EB_CE18D35E70C72FBD424F3A4C77930458	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\360NetUL\svchost.netul.log	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8DFDF057024880D7A081AFBF6D26B92F	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9A19ADAD9D098E039450ABBEDD5616EB_CE18D35E70C72FBD424F3A4C77930458	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

Processes:

Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe

pid	process
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe

Drops file in Windows directory 6 IoCs

Processes:

MicrosoftEdge.exeldsgamemaster.exeIAbtukweZabckantu4092521131beiao001.exekuaizip_setup_2206473764_beiao_004.exeDism.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File opened for modification	C:\Windows\	ldsgamemaster.exe
File created	C:\Windows\Tasks\PV_UPDATE.job	IAbtukweZabckantu4092521131beiao001.exe
File created	C:\Windows\Tasks\KuaiZip_Update.job	kuaizip_setup_2206473764_beiao_004.exe
File created	C:\Windows\Tasks\PV_UPDATE2.job	IAbtukweZabckantu4092521131beiao001.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	Dism.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

5356 5272 WerFault.exe KuaiZip.exe
5812 5784 WerFault.exe KuaiZip.exe

pid	pid_target	process	target process
5356	5272	WerFault.exe	KuaiZip.exe
5812	5784	WerFault.exe	KuaiZip.exe

Modifies Internet Explorer settings 1 TTPs 13 IoCs

adware spyware

Modify Registry

T1112

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeLDSGameHall.exebrowser_broker.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	LDSGameHall.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_OBJECT\LDSGameHall.exe = "1"	LDSGameHall.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT	LDSGameHall.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT\LDSGameHall.exe = "1"	LDSGameHall.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\LDSGameHall.exe = "11001"	LDSGameHall.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_OBJECT	LDSGameHall.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING	LDSGameHall.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\LDSGameHall.exe = "1"	LDSGameHall.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALIGNED_TIMERS	LDSGameHall.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALIGNED_TIMERS\LDSGameHall.exe = "1"	LDSGameHall.exe

Modifies data under HKEY_USERS 43 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeDism.exeregsvr32.exeMicrosoftEdgeCP.exeregsvr32.exeregsvr32.exeMicrosoftEdgeCP.exeregsvr32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.jpeg\ShellEx	Dism.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tiff\ShellEx\{20690236-7CA3-442C-AAB7-617C1C4C14EF}	Dism.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QZipShell.KYDropHandler\CLSID\ = "{C9487131-EF4C-40D9-BA70-E85356CAF67E}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{987EE386-F13E-4C53-9036-94264DFE033C}	Dism.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6E}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dib\ShellEx\{20690236-7CA3-442C-AAB7-617C1C4C14EF}\ = "{B82F0AB0-90D7-480D-892D-850A92E9BA34}"	Dism.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{86C4C3BA-4EA4-4CF8-98B9-6B07B477B835}\1.0\0\win64	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E18ACF9-8A61-4A6C-A770-6F739037317F}\InprocServer32\ = "C:\\MobileEmuMaster\\GameMemoryOpt_x64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.apk\ = "apkfile_ldsgame"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\ContextMenuExt	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3DCCD550-7586-40D2-A51D-D2F98EC06B3C}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C9487131-EF4C-40D9-BA70-E85356CAF67E}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\KuaiZip.kz\shellex\DropHandler\ = "{C9487131-EF4C-40D9-BA70-E85356CAF67E}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QZipShell.ContextMenuExt\CLSID\ = "{903D855A-D671-4A8E-A592-9168755917DB}"	Dism.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\ = "IShellApkInfo"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B82F0AB0-90D7-480D-892D-850A92E9BA34}\TypeLib	Dism.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cur\ShellEx	Dism.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3DCCD550-7586-40D2-A51D-D2F98EC06B3C}\VersionIndependentProgID\ = "QZipShell.DragDropMenu"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{987EE386-F13E-4C53-9036-94264DFE033C}\1.0\HELPDIR	Dism.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QZipShell.KzShlobj\ = "KzShlobj Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\KuaiZip.zip\shellex\DropHandler\ = "{C9487131-EF4C-40D9-BA70-E85356CAF67E}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F0E55AF-FD4C-4DA2-909C-5DB8A86B1E70}\TypeLib	Dism.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage	MicrosoftEdge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QZipShell.ContextMenuExt.1\ = "ContextMenuExt Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QZipShell.DragDropMenu.1\CLSID\ = "{3DCCD550-7586-40D2-A51D-D2F98EC06B3C}"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShellExt.ShellIcon	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShellExt.ShellIcon\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B82F0AB0-90D7-480D-892D-850A92E9BA34}\TypeLib\ = "{7170FF0E-D5F0-4F74-AD05-413FD2ABA949}"	Dism.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wmf\ShellEx\{20690236-7CA3-442C-AAB7-617C1C4C14EF}\ = "{B82F0AB0-90D7-480D-892D-850A92E9BA34}"	Dism.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dng\ShellEx\{20690236-7CA3-442C-AAB7-617C1C4C14EF}\ = "{B82F0AB0-90D7-480D-892D-850A92E9BA34}"	Dism.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QZipShell.KzShlobj.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QZipShell.PropertyExt\ = "PropertyExt Class"	Dism.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	MicrosoftEdge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E18ACF9-8A61-4A6C-A770-6F739037317F}\ = "Ludashi GameMaster"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\apkfile_ldsgame\ShellEx\{00021500-0000-0000-C000-000000000046}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QZipShell.KzShlobj\ = "KzShlobj Class"	Dism.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QZipShell.PropertyExt	Dism.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionIn = "{996A1E91-3646-4310-B719-31EDBE671882}"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.gif\ShellEx\{20690236-7CA3-442C-AAB7-617C1C4C14EF}\ = "{B82F0AB0-90D7-480D-892D-850A92E9BA34}"	Dism.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3BDBA554-25E2-4928-8C07-46CCD2F26A01}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{903D855A-D671-4A8E-A592-9168755917DB}\TypeLib\ = "{987EE386-F13E-4C53-9036-94264DFE033C}"	Dism.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7E295879-A877-4B93-B59B-107420372AA1}\VersionIndependentProgID\ = "QZipShell.PropertyExt"	Dism.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6E}\NumMethods\ = "16"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\ContextMenuExt\ = "{6ADF19E3-77A3-4395-ADB4-9FD7D351EB3E}"	regsvr32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B72164C = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dng\ShellEx\{20690236-7CA3-442C-AAB7-617C1C4C14EF}	Dism.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QZipShell.KYDropHandler.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{32FE7CB4-3936-41AF-BF31-6F8FC8F86AC9}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B82F0AB0-90D7-480D-892D-850A92E9BA34}\InprocServer32	Dism.exe

Modifies system certificate store 2 TTPs 11 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

ldsgamemaster.exeLDSGameHall.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	ldsgamemaster.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46	LDSGameHall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 0f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb0b000000010000002a0000005300650063007400690067006f0020002800550054004e0020004f0062006a0065006300740029000000090000000100000022000000302006082b06010505070303060a2b0601040182370a030406082b060105050703086200000001000000200000006fff78e400a70c11011cd85977c459fb5af96a3df0540820d0f4b8607875e58f140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d81d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf67087e0000000100000008000000000063f58926d701030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d4620000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8	LDSGameHall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	LDSGameHall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	ldsgamemaster.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	ldsgamemaster.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d4304000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	ldsgamemaster.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c00000001000000040000000008000004000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	ldsgamemaster.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 190000000100000010000000e843ac3b52ec8c297fa948c9b1fb2819030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d467e0000000100000008000000000063f58926d7011d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf6708140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d86200000001000000200000006fff78e400a70c11011cd85977c459fb5af96a3df0540820d0f4b8607875e58f090000000100000022000000302006082b06010505070303060a2b0601040182370a030406082b060105050703080b000000010000002a0000005300650063007400690067006f0020002800550054004e0020004f0062006a00650063007400290000000f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb20000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8	LDSGameHall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	LDSGameHall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	LDSGameHall.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

FastDownloader.exe1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exeInst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe

pid	process
4436	FastDownloader.exe
4436	FastDownloader.exe
4436	FastDownloader.exe
4436	FastDownloader.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe

Suspicious behavior: LoadsDriver 2 IoCs

Processes:

pid process

628
628
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

MicrosoftEdgeCP.exe

pid process

4304 MicrosoftEdgeCP.exe

pid	process
628
628

pid	process
4304	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

Processes:

1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeldsgamemaster.exeSoftMgrInst.exeAUDIODG.EXELDSGameHall.exe

description	pid	process
Token: SeDebugPrivilege	4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
Token: SeRestorePrivilege	4212	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
Token: SeDebugPrivilege	1588	MicrosoftEdge.exe
Token: SeDebugPrivilege	1588	MicrosoftEdge.exe
Token: SeDebugPrivilege	1588	MicrosoftEdge.exe
Token: SeDebugPrivilege	1588	MicrosoftEdge.exe
Token: SeDebugPrivilege	2204	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2204	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2204	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2204	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3788	ldsgamemaster.exe
Token: SeDebugPrivilege	3788	ldsgamemaster.exe
Token: SeManageVolumePrivilege	4596	SoftMgrInst.exe
Token: SeDebugPrivilege	3788	ldsgamemaster.exe
Token: SeDebugPrivilege	3788	ldsgamemaster.exe
Token: SeDebugPrivilege	3788	ldsgamemaster.exe
Token: SeDebugPrivilege	3788	ldsgamemaster.exe
Token: SeDebugPrivilege	3788	ldsgamemaster.exe
Token: SeDebugPrivilege	3788	ldsgamemaster.exe
Token: SeDebugPrivilege	3788	ldsgamemaster.exe
Token: SeDebugPrivilege	3788	ldsgamemaster.exe
Token: SeDebugPrivilege	3788	ldsgamemaster.exe
Token: SeDebugPrivilege	3788	ldsgamemaster.exe
Token: SeDebugPrivilege	3788	ldsgamemaster.exe
Token: SeDebugPrivilege	1588	MicrosoftEdge.exe
Token: SeDebugPrivilege	3788	ldsgamemaster.exe
Token: SeDebugPrivilege	3788	ldsgamemaster.exe
Token: 33	4464	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4464	AUDIODG.EXE
Token: 33	4152	LDSGameHall.exe
Token: SeIncBasePriorityPrivilege	4152	LDSGameHall.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

ldsgamemaster.exe

pid	process
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

ldsgamemaster.exe

pid	process
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe
3788	ldsgamemaster.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

FastDownloader.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeLDSGameHall.exe

pid	process
4436	FastDownloader.exe
4436	FastDownloader.exe
1588	MicrosoftEdge.exe
4304	MicrosoftEdgeCP.exe
4304	MicrosoftEdgeCP.exe
4152	LDSGameHall.exe
4152	LDSGameHall.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

FastDownloader.exeLDSGameMasterInstRoad_211501.exeMicrosoftEdgeCP.exeldsgamemaster.exeInst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exeIAbtukweZabckantu4092521131beiao001.exekuaizip_setup_2206473764_beiao_004.exeRegSvr32.exeRegSvr32.exeupdate.exe

description	pid	process	target process
PID 4436 wrote to memory of 4212	4436	FastDownloader.exe	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
PID 4436 wrote to memory of 4212	4436	FastDownloader.exe	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
PID 4436 wrote to memory of 4212	4436	FastDownloader.exe	1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
PID 4436 wrote to memory of 644	4436	FastDownloader.exe	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
PID 4436 wrote to memory of 644	4436	FastDownloader.exe	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
PID 4436 wrote to memory of 644	4436	FastDownloader.exe	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
PID 4436 wrote to memory of 1464	4436	FastDownloader.exe	LDSGameMasterInstRoad_211501.exe
PID 4436 wrote to memory of 1464	4436	FastDownloader.exe	LDSGameMasterInstRoad_211501.exe
PID 4436 wrote to memory of 1464	4436	FastDownloader.exe	LDSGameMasterInstRoad_211501.exe
PID 1464 wrote to memory of 3788	1464	LDSGameMasterInstRoad_211501.exe	ldsgamemaster.exe
PID 1464 wrote to memory of 3788	1464	LDSGameMasterInstRoad_211501.exe	ldsgamemaster.exe
PID 1464 wrote to memory of 3788	1464	LDSGameMasterInstRoad_211501.exe	ldsgamemaster.exe
PID 4304 wrote to memory of 2204	4304	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4304 wrote to memory of 2204	4304	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4304 wrote to memory of 2204	4304	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3788 wrote to memory of 4596	3788	ldsgamemaster.exe	SoftMgrInst.exe
PID 3788 wrote to memory of 4596	3788	ldsgamemaster.exe	SoftMgrInst.exe
PID 3788 wrote to memory of 4596	3788	ldsgamemaster.exe	SoftMgrInst.exe
PID 644 wrote to memory of 1536	644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe	jQrNqLvTuHbKiJmO.exe
PID 644 wrote to memory of 1536	644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe	jQrNqLvTuHbKiJmO.exe
PID 644 wrote to memory of 1536	644	Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe	jQrNqLvTuHbKiJmO.exe
PID 4436 wrote to memory of 4232	4436	FastDownloader.exe	kuaizip_setup_2206473764_beiao_004.exe
PID 4436 wrote to memory of 4232	4436	FastDownloader.exe	kuaizip_setup_2206473764_beiao_004.exe
PID 4436 wrote to memory of 4232	4436	FastDownloader.exe	kuaizip_setup_2206473764_beiao_004.exe
PID 4436 wrote to memory of 4164	4436	FastDownloader.exe	IAbtukweZabckantu4092521131beiao001.exe
PID 4436 wrote to memory of 4164	4436	FastDownloader.exe	IAbtukweZabckantu4092521131beiao001.exe
PID 4436 wrote to memory of 4164	4436	FastDownloader.exe	IAbtukweZabckantu4092521131beiao001.exe
PID 4164 wrote to memory of 2388	4164	IAbtukweZabckantu4092521131beiao001.exe	regsvr32.exe
PID 4164 wrote to memory of 2388	4164	IAbtukweZabckantu4092521131beiao001.exe	regsvr32.exe
PID 4164 wrote to memory of 2388	4164	IAbtukweZabckantu4092521131beiao001.exe	regsvr32.exe
PID 4164 wrote to memory of 4452	4164	IAbtukweZabckantu4092521131beiao001.exe	regsvr32.exe
PID 4164 wrote to memory of 4452	4164	IAbtukweZabckantu4092521131beiao001.exe	regsvr32.exe
PID 4164 wrote to memory of 4452	4164	IAbtukweZabckantu4092521131beiao001.exe	regsvr32.exe
PID 4164 wrote to memory of 2188	4164	IAbtukweZabckantu4092521131beiao001.exe	regsvr32.exe
PID 4164 wrote to memory of 2188	4164	IAbtukweZabckantu4092521131beiao001.exe	regsvr32.exe
PID 4164 wrote to memory of 2188	4164	IAbtukweZabckantu4092521131beiao001.exe	regsvr32.exe
PID 3788 wrote to memory of 2216	3788	ldsgamemaster.exe	MobileEmuHelper.exe
PID 3788 wrote to memory of 2216	3788	ldsgamemaster.exe	MobileEmuHelper.exe
PID 3788 wrote to memory of 2216	3788	ldsgamemaster.exe	MobileEmuHelper.exe
PID 3788 wrote to memory of 3904	3788	ldsgamemaster.exe	RegSvr32.exe
PID 3788 wrote to memory of 3904	3788	ldsgamemaster.exe	RegSvr32.exe
PID 3788 wrote to memory of 3904	3788	ldsgamemaster.exe	RegSvr32.exe
PID 3788 wrote to memory of 3816	3788	ldsgamemaster.exe	RegSvr32.exe
PID 3788 wrote to memory of 3816	3788	ldsgamemaster.exe	RegSvr32.exe
PID 3788 wrote to memory of 3816	3788	ldsgamemaster.exe	RegSvr32.exe
PID 4232 wrote to memory of 1424	4232	kuaizip_setup_2206473764_beiao_004.exe	regsvr32.exe
PID 4232 wrote to memory of 1424	4232	kuaizip_setup_2206473764_beiao_004.exe	regsvr32.exe
PID 4232 wrote to memory of 1424	4232	kuaizip_setup_2206473764_beiao_004.exe	regsvr32.exe
PID 3904 wrote to memory of 3600	3904	RegSvr32.exe	regsvr32.exe
PID 3904 wrote to memory of 3600	3904	RegSvr32.exe	regsvr32.exe
PID 3816 wrote to memory of 1796	3816	RegSvr32.exe	regsvr32.exe
PID 3816 wrote to memory of 1796	3816	RegSvr32.exe	regsvr32.exe
PID 4232 wrote to memory of 1384	4232	kuaizip_setup_2206473764_beiao_004.exe	regsvr32.exe
PID 4232 wrote to memory of 1384	4232	kuaizip_setup_2206473764_beiao_004.exe	regsvr32.exe
PID 4232 wrote to memory of 1384	4232	kuaizip_setup_2206473764_beiao_004.exe	regsvr32.exe
PID 4232 wrote to memory of 208	4232	kuaizip_setup_2206473764_beiao_004.exe	regsvr32.exe
PID 4232 wrote to memory of 208	4232	kuaizip_setup_2206473764_beiao_004.exe	regsvr32.exe
PID 4232 wrote to memory of 208	4232	kuaizip_setup_2206473764_beiao_004.exe	regsvr32.exe
PID 4164 wrote to memory of 1532	4164	IAbtukweZabckantu4092521131beiao001.exe	update.exe
PID 4164 wrote to memory of 1532	4164	IAbtukweZabckantu4092521131beiao001.exe	update.exe
PID 4164 wrote to memory of 1532	4164	IAbtukweZabckantu4092521131beiao001.exe	update.exe
PID 1532 wrote to memory of 2892	1532	update.exe	Dism.exe
PID 1532 wrote to memory of 2892	1532	update.exe	Dism.exe
PID 4164 wrote to memory of 4348	4164	IAbtukweZabckantu4092521131beiao001.exe	PhotoViewer.exe

C:\Users\Admin\AppData\Local\Temp\FastDownloader.exe
"C:\Users\Admin\AppData\Local\Temp\FastDownloader.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4436

C:\Download\1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
C:\Download\\1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
2⤵
- Executes dropped EXE
- Checks computer location settings
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4212

C:\Users\Admin\AppData\Local\Temp\lB7Y1NZCM6GxgXGX\Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:644

C:\Users\Admin\AppData\Local\Temp\{66113423-0036-4c5e-BD0F-9536D404CB00}\jQrNqLvTuHbKiJmO.exe
"C:\Users\Admin\AppData\Local\Temp\{66113423-0036-4c5e-BD0F-9536D404CB00}\jQrNqLvTuHbKiJmO.exe" EV0MXR9dGV0cXRpdGF0cXT9dHF0fXS5dHF0YXQRdHF05XQxdH10oXRxdGV1tXRxdEF0MXRxdKl0cXRldFF0cXRRdHF0cXSldHF0YXRBdHF0EXQxdH10uXRxdGl0qXRxdDl0MXR9dNl0cXRldbV0cXRBdKl0cXSVdHF0ZXRhdHF1QXVddEF06XRxdb10cXRldHF0cXRBdDF0cXTpdHF0eXW1dHF0JXRxdH10rXRxdGl0YXRxdB10cXR9dEF0cXRpdNl0cXQRdOl0cXWRdHF0bXRhdHF05XSpdH10fXRxdGV0EXRxdDF0MXR9dGl0cXRVdPl0cXQxdDF0fXQpdHF0bXRhdHF1QXVddDF06XR9da10cXRhdGF0cXQ9dKl0fXQtdHF0YXRhdHF0EXSpdH10zXRxdGF0UXRxdOF06XR9dH10cXRhdBF0cXTldKl0fXR9dHF0bXRhdHF0IXQxdH10eXRxdGl0uXRxdDF0MXR9dFV0cXRldHF0cXQxdDF0fXTVdHF0bXRhdHF1QXVddDF06XR9dbF0cXRhdGF0cXQ9dOl0fXW5dHF0YXRhdHF0IXQxdH10PXRxdGF0UXRxdOV0qXR9dH10cXRhdOl0cXQxdDF0fXR9dHF0bXRRdHF0MXQxdH10eXRxdGl06XRxdDF0MXR9dFF0cXRtdGF0cXQxdDF0fXQddHF0bXRhdHF1QXVddDF06XR9dN10cXRhdGF0cXQ9dDF0fXW5dHF0YXRhdHF0ZXQxdHF0WXRxdGl0UXRxdOV0qXR9dHl0cXRpdMl0cXQxdDF0fXRVdHF0YXQhdHF0MXQxdH100XRxdGF0YXRxdDF06XR9dN10cXRhdGF0cXQ9dOl0fXQ9dHF0YXRhdHF1QXVddCl06XR9dD10cXRhdFF0cXTldHF0fXR9dHF0YXTpdHF0MXQxdH10fXRxdG106XRxdDF0MXR9dHl0cXRVdPl0cXQxdDF0fXRtdHF0aXRBdHF0MXQxdH108XRxdFV0+XRxdDF06XR9dDF0cXRhdGF0cXQ9dKl0fXW5dHF0YXRhdHF1QXVddCF06XR9dD10cXRhdFF0cXRBdKl0fXR9dHF0YXQRdHF0/XSpdH10fXRxdGl0IXRxdDF0MXR9dHl0cXRtdPl0cXQxdDF0fXRVdHF0aXS5dHF0MXQxdH10PXRxdG10YXRxdDF06XR9dLV0cXRhdGF0cXQ9dDF0fXTddHF0YXRhdHF1QXVddGV0MXRxdFl0cXRpdCF0cXQhdDF0fXR5dHF0YXRRdHF0MXQxdH10aXRxdFV0+XRxdDF0MXR9dE10cXRVdPl0cXQxdDF0cXSRdHF0YXRhdHF0PXRxdH10fXRxdGF0YXRxdBF0MXR9dD10cXRhdFF0cXTldDF0fXR9dHF0YXT5dHF1QXVddPF0qXR9dH10cXRhdKl0cXQddKl0fXR5dHF0aXS5dHF0MXQxdH10VXRxdFV0+XRxdDF0MXR9dNF0cXRhdGF0cXQxdDF0fXR9dHF0YXRhdHF0MXQxdHF1kXRxdGV1tXRxdGV0MXRxdFl0cXR5dHF0cXRFdDF0fXRhdHF0aXSpdHF1QXVddP10cXR9dCl0cXRpdCF0cXT5dOl0cXWRdHF0ZXRRdHF0QXRxdHF0qXRxdGV0YXRxdEF06XRxdaV0cXRldNl0cXRRdHF0cXSldHF0YXQhdHF04XRxdH11tXRxdGV1tXRxdCV0cXR9dD10cXRhdGF0cXTldHF0fXR9dHF0YXTpdHF1QXVddCV0MXR9dH10cXRpdGF0cXQhdDF0fXR5dHF0VXRBdHF0MXQxdH10VXRxdG10IXRxdDF0MXR9dNF0cXRpdPl0cXQxdOl0cXSpdHF0YXRhdHF0MXSpdHF0qXRxdGF0YXRxdBF0MXR9dD10cXRhdFF0cXTldDF0fXR9dHF0YXTpdHF1QXVddCV0MXR9dH10cXRpdDF0cXQxdDF0fXR5dHF0aXTpdHF0MXQxdH10VXRxdFV0+XRxdDF0MXR9dNF0cXRhdGF0cXQxdDF0cXWhdHF0YXRhdHF0PXRxdH10TXRxdGF0YXRxdCl0cXR9dbl0cXRhdGF0cXThdHF0fXR9dHF0YXQRdHF1QXVddEl0cXR9dH10cXRhdbV0cXQhdDF0fXR9dHF0aXT5dHF0MXQxdH10ZXRxdGV0cXRxdDF0MXRxdE10cXRxdMl0cXQldHF0fXQ9dHF0YXRRdHF0/XSpdH10fXRxdGF0+XRxdEl0cXR9dH10cXRpdFF0cXQhdDF0fXR5dHF0aXSpdHF1QXVddDF0MXR9dFF0cXRhdGF0cXQxdDF0fXQddHF0bXRhdHF0MXTpdH10oXRxdGF0YXRxdD10qXR9dC10cXRhdGF0cXQhdHF0fXQ9dHF0YXRRdHF0/XSpdH10fXRxdGF06XRxdCF0MXR9dH10cXRpdDF0cXQxdDF0fXR5dHF0VXT5dHF1QXVddDF0MXR9dGF0cXRpdZV0cXQxdDF0fXRBdHF0VXT5dHF0MXQxdH11vXRxdGF0YXRxdD10qXR9dM10cXRhdGF0cXQpdDF0fXQ9dHF0YXRRdHF05XTpdH10fXRxdGF0QXRxdE10cXR9dH10cXRhdbV0cXTldKl0fXR9dHF0ZXRRdHF1QXVddDF0MXR9dGF0cXRhdGF0cXQxdDF0cXRNdHF0cXTJdHF0JXRxdH10zXRxdGF0UXRxdPF06XR9dH10cXRhdPl0cXRNdHF0fXR9dHF0YXSpdHF05XSpdH10fXRxdHl1lXRxdDF0MXR9dFF0cXRhdbV0cXQxdDF0fXTddHF0aXT5dHF1QXVddDF06XR9dLF0cXRhdGF0cXQ9dHF0cXSpdHF0YXRhdHF0EXTpdH10fXRxdGF0UXRxdOV0cXR9dH10cXRhdEF0cXQpdDF0fXR9dHF0aXRRdHF0MXQxdH10eXRxdFV0yXRxdDF0MXR9dGF0cXRldHF0cXQxdDF0fXTRdHF0aXT5dHF1QXVddDF0MXR9dbl0cXRhdGF0cXQ9dHF0fXRtdHF0YXRhdHF0KXQxdH10zXRxdGF0UXRxdPF0qXR9dH10cXRhdDF0cXQpdDF0fXR9dHF0YXWldHF0MXQxdH10eXRxdGl02XRxdDF0MXR9dGF0cXRhdbV0cXQxdDF0cXRNdHF0cXTJdHF1QXVddCV0qXR9dD10cXRhdFF0cXT9dDF0fXR9dHF0YXRhdHF0MXQxdH10fXRxdHF1tXRxdHl06XRxdOl0cXR5dbV0cXQ9dOl0fXS5dHF0aXRhdHF0HXSpdH10nXRxdGV1tXRxdEF0cXRxdHF0cXRxdYF1gXVBdV10=
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
PID:1536

C:\Users\Admin\AppData\Local\Temp\{986355D8-72AF-4392-8DF2-64A562613055}\tMpOjCxXuRyCrKpX.exe
"C:\Users\Admin\AppData\Local\Temp\{986355D8-72AF-4392-8DF2-64A562613055}\tMpOjCxXuRyCrKpX.exe" FF0cXRxdKV0cXRhdbV0cXTldDF0fXW1dHF0aXQhdHF04XRxdHF1kXRxdFV0uXRxdEl0MXRxdJ10cXRhdCF0cXQ9dDF0cXW1dHF0ZXTZdHF0SXQxdH10aXRxdHl1tXRxdE106XRxdbV0cXRldEF0cXRBdHF0cXSldHF0ZXQxdHF1QXVddE106XR9dMV0cXRldHF0cXRFdDF0cXWhdHF0ZXRRdHF0QXRxdHF0qXRxdHl1tXRxdEF0qXRxdbV0cXRldNl0cXQ9dDF0fXRldHF0YXRBdHF0TXRxdHF1pXRxdGF0YXRxdEF0cXRxdbl0cXRldEF0cXTtdDF0cXTpdHF0eXW1dHF1QXVddDF0qXR9dNV0cXRpdKl0cXT9dHF0fXRddHF0aXQxdHF0NXQxdHF0nXRxdGV0YXRxdEF0MXRxdJF0cXRldBF0cXRBdHF0cXSVdHF0eXRxdHF0RXQxdH10MXRxdFV0UXRxdP10qXR9dNl0cXRVdCF0cXQRdKl0fXW1dHF0ZXW1dHF1QXVddEF06XRxdOl0cXR5dbV0cXQ9dHF0fXS5dHF0aXSpdHF0LXTpdH10xXRxdFV0UXRxdDV0MXRxdJF0cXRldHF0cXRBdHF0cXSVdHF0ZXRRdHF0SXRxdHF1oXRxdHl0cXRxdEV0MXR9dF10cXRpdaV0cXT5dKl0fXW1dHF0YXWldHF1QXVddBF0MXR9dKV0cXRpdCF0cXQ1dDF0fXS5dHF0YXRhdHF05XQxdH10MXRxdFV0UXRxdC10cXR9dLF0cXRldEF0cXQVdKl0fXTtdHF0ZXRBdHF0QXQxdHF0lXRxdGV0UXRxdE106XRxdKl0cXRldGF0cXQVdKl0fXTtdHF0ZXRBdHF1QXVddB106XRxdb10cXRldNl0cXRNdOl0fXTFdHF0ZXT5dHF0QXSpdHF1uXRxdGV0MXRxdE106XRxdJV0cXRldBF0cXQRdKl0cXW9dHF0aXRBdHF0TXTpdHF1sXRxdGV0+XRxdEF06XR9dO10cXRtdZV0cXRNdOl0cXWldHF0ZXQRdHF1QXVddEF0MXRxdb10cXRpdBF0cXRBdOl0fXTFdHF0ZXRBdHF0QXSpdHF0nXRxdGV0EXRxdEF0qXRxdKl0cXRldFF0cXQddDF0cXW9dHF0ZXRBdHF0TXTpdH10xXRxdG11lXRxdBV0qXRxdKl0cXRldNl0cXRJdDF0cXSRdHF0eXWldHF1QXVddB10MXR9daV0cXRpdCF0cXRxdHF0cXWBdUF1XXQ==
4⤵
- Executes dropped EXE
PID:4220

C:\Users\Admin\AppData\Local\Temp\lB7Y1NZCM6GxgXGX\LDSGameMasterInstRoad_211501.exe
LDSGameMasterInstRoad_211501.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1464

C:\Users\Admin\AppData\Local\Temp\ldsgamemaster.exe
"C:\Users\Admin\AppData\Local\Temp\ldsgamemaster.exe" /PID="211501" /S /FROM=inst
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3788

C:\MobileEmuMaster\SoftMgr\SoftMgrInst.exe
"C:\MobileEmuMaster\SoftMgr\SoftMgrInst.exe" --hwnd=131840 --from=LDSGameMaster --new=true --log
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4596

C:\MobileEmuMaster\Utils\MobileEmuHelper.exe
C:\MobileEmuMaster\Utils\MobileEmuHelper.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
PID:2216

C:\Windows\SysWOW64\RegSvr32.exe
"C:\Windows\System32\RegSvr32.exe" /s /i "C:\MobileEmuMaster\GameMemoryOpt_x64.dll"
4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3904

C:\Windows\system32\regsvr32.exe
/s /i "C:\MobileEmuMaster\GameMemoryOpt_x64.dll"
5⤵
- Loads dropped DLL
- Modifies registry class
PID:3600

C:\Windows\SysWOW64\RegSvr32.exe
"C:\Windows\System32\RegSvr32.exe" /s /i "C:\MobileEmuMaster\Plugin\ShellExt_x64.dll"
4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3816

C:\Windows\system32\regsvr32.exe
/s /i "C:\MobileEmuMaster\Plugin\ShellExt_x64.dll"
5⤵
- Loads dropped DLL
- Modifies registry class
PID:1796

C:\MobileEmuMaster\LDSGameHall\LDSGameHall.exe
"C:\MobileEmuMaster\LDSGameHall\LDSGameHall.exe" /DisplayMode="hide" /From="inst" /HideBoot /NewInstall /PID="211501" /Push /SubPID="211501"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4152

C:\MobileEmuMaster\update.exe
"C:\MobileEmuMaster\update.exe" checkupdate
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:1532

C:\Windows\SysWOW64\Dism.exe
/Online /Get-FeatureInfo:Microsoft-Hyper-V
5⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Windows directory
- Modifies registry class
PID:2892

C:\MobileEmuMaster\LDSGameHall\LDSGameRun.exe
"C:\MobileEmuMaster\LDSGameHall\LDSGameRun.exe"
5⤵
PID:5452

C:\Users\Admin\AppData\Local\Temp\lB7Y1NZCM6GxgXGX\kuaizip_setup_2206473764_beiao_004.exe
kuaizip_setup_2206473764_beiao_004.exe
2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4232

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s /u C:\Users\Admin\AppData\Roaming\快压\X64\KuaiZipShell.dll
3⤵
PID:1424

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s /u C:\Users\Admin\AppData\Roaming\快压\X86\kuaizipUpdateChecker.dll
3⤵
PID:208

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s /u C:\Users\Admin\AppData\Roaming\快压\X64\KuaiZipShellProp.dll
3⤵
PID:1384

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s C:\Users\Admin\AppData\Roaming\快压\X64\KuaiZipShell.dll
3⤵
- Loads dropped DLL
PID:4632

C:\Windows\system32\regsvr32.exe
/s C:\Users\Admin\AppData\Roaming\快压\X64\KuaiZipShell.dll
4⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Modifies registry class
PID:4708

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s C:\Users\Admin\AppData\Roaming\快压\X64\KuaiZipShellProp.dll
3⤵
- Loads dropped DLL
PID:3480

C:\Windows\system32\regsvr32.exe
/s C:\Users\Admin\AppData\Roaming\快压\X64\KuaiZipShellProp.dll
4⤵
PID:2892

C:\Users\Admin\AppData\Roaming\快压\X86\KuaiZip.exe
"C:\Users\Admin\AppData\Roaming\快压\X86\KuaiZip.exe" -instsvr
3⤵
PID:5272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5272 -s 616
4⤵
- Program crash
PID:5356

C:\Users\Admin\AppData\Roaming\快压\X86\KuaiZip.exe
"C:\Users\Admin\AppData\Roaming\快压\X86\KuaiZip.exe" -AssociateAll
3⤵
PID:5784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5784 -s 588
4⤵
- Program crash
PID:5812

C:\Users\Admin\AppData\Roaming\快压\X86\KZReport.exe
"C:\Users\Admin\AppData\Roaming\快压\X86\KZReport.exe"
3⤵
PID:5964

C:\Users\Admin\AppData\Local\Temp\lB7Y1NZCM6GxgXGX\IAbtukweZabckantu4092521131beiao001.exe
IAbtukweZabckantu4092521131beiao001.exe
2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4164

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s /u C:\Users\Admin\AppData\Roaming\PhotoViewer\ShellExt64.dll
3⤵
PID:2388

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s /u C:\Users\Admin\AppData\Roaming\PhotoViewer\PVShellExt64.dll
3⤵
PID:4452

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s /u C:\Users\Admin\AppData\Roaming\PhotoViewer\Checker.dll
3⤵
PID:2188

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s C:\Users\Admin\AppData\Roaming\PhotoViewer\PreviewExt64.dll
3⤵
PID:1532

C:\Windows\system32\regsvr32.exe
/s C:\Users\Admin\AppData\Roaming\PhotoViewer\PreviewExt64.dll
4⤵
PID:2892

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s C:\Users\Admin\AppData\Roaming\PhotoViewer\PVShellExt64.dll
3⤵
PID:4348

C:\Windows\system32\regsvr32.exe
/s C:\Users\Admin\AppData\Roaming\PhotoViewer\PVShellExt64.dll
4⤵
- Loads dropped DLL
- Modifies registry class
PID:4964

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s C:\Users\Admin\AppData\Roaming\PhotoViewer\Checker.dll
3⤵
- Loads dropped DLL
PID:5044

C:\Users\Admin\AppData\Roaming\PhotoViewer\PhotoViewer.exe
"C:\Users\Admin\AppData\Roaming\PhotoViewer\PhotoViewer.exe" -unregdigitext
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4348

C:\Users\Admin\AppData\Roaming\PhotoViewer\PhotoViewer.exe
"C:\Users\Admin\AppData\Roaming\PhotoViewer\PhotoViewer.exe" -regall
3⤵
- Executes dropped EXE
PID:5196

C:\Users\Admin\AppData\Roaming\PhotoViewer\PhotoViewer.exe
"C:\Users\Admin\AppData\Roaming\PhotoViewer\PhotoViewer.exe" -deloldshellext
3⤵
PID:5540

C:\Users\Admin\AppData\Roaming\PhotoViewer\PdfReader.exe
"C:\Users\Admin\AppData\Roaming\PhotoViewer\PdfReader.exe" -regall
3⤵
PID:5884

C:\Users\Admin\AppData\Roaming\PhotoViewer\Report.exe
"C:\Users\Admin\AppData\Roaming\PhotoViewer\Report.exe"
3⤵
PID:6056

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1588

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:2080

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4304

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2204

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4248

\??\c:\windows\syswow64\svchost.exe
c:\windows\syswow64\svchost.exe -k netsvcs -s SpSvc
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3524

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k PhotoviewerService
1⤵
PID:2880

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k PhotoviewerService
1⤵
- Loads dropped DLL
PID:4160

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4464

C:\Users\Admin\AppData\Roaming\PhotoViewer\PhotoViewer.exe
"C:\Users\Admin\AppData\Roaming\PhotoViewer\PhotoViewer.exe" -regcapturehotkey
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5132

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k kuaizipupdatesvc
1⤵
PID:5744

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k kuaizipupdatesvc
1⤵
PID:5756

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Registry Run Keys / Startup Folder

T1060

Bootkit

T1067

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Security Software Discovery

T1063

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Download\1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
MD5
205704aecf5e101edac0902981a5b0c2

SHA1
2b50544ec9c7395bb4f20b197086791caf1b6c0a

SHA256
e7cb8bf11ca70ffdfbae2243a1213e89ab5967556598bfa2a52da10e5dc8a556

SHA512
1c52daab6c50b6746152d1964b973c0561d66d33ceb8a6a1b3edf1b8881e4632ca25a794805b863d91846d7eecad03376628931dc9a8b73653287c0137439e72

Download Submit
C:\Download\1__3112633__3f7372633d6c6d266c733d6e34623664373335303965__68616f2e3336302e636e__0c6f.exe
MD5
205704aecf5e101edac0902981a5b0c2

SHA1
2b50544ec9c7395bb4f20b197086791caf1b6c0a

SHA256
e7cb8bf11ca70ffdfbae2243a1213e89ab5967556598bfa2a52da10e5dc8a556

SHA512
1c52daab6c50b6746152d1964b973c0561d66d33ceb8a6a1b3edf1b8881e4632ca25a794805b863d91846d7eecad03376628931dc9a8b73653287c0137439e72

Download Submit
C:\MobileEmuMaster\360P2SP.dll
MD5
96c74f16a2b94f33ce54df012e1a9143

SHA1
c685b6a26b4abffa25399beea2eb45dc7869bc0a

SHA256
9dfc5349404e386f87c44419f8ff83e2dc0666f3ef3278860d872e10af9766a5

SHA512
e186578e68ed40e91b3167a6d7f594f390d614c44b83f5d17213421cff12649c3a8a4f1dc47c8479bd0a20e303f90be8c5526325086db20e960024af1996fb65

Download Submit
C:\MobileEmuMaster\360base.dll
MD5
84beb92b22b17841b326e4df2d31117b

SHA1
ef3a1cb3f64e3a9084f047c777f3ce29e761aa09

SHA256
51f68c7e9e40694ff4cc49d23a2e406b5feba6f0aa9f998bdd8030065c90a9da

SHA512
4d4b29e84daa5e999a35723bddb32019a306fdefec660fc53244385d960e55a94a9855093fc146e3fa0110f8dc6a264ef4c6802386c19175b7464c629f6fe8e9

Download Submit
C:\MobileEmuMaster\360net.dll
MD5
48e996402b35f914dc869f8f529e2444

SHA1
fdcbf945a79ca75b0fc663d3de6ce86ca4a50d2f

SHA256
8c2a4ef1b9ac458d48b2944f90f90527f5b0650aa1107e808bf7716a8d894250

SHA512
233bad9580a906547958643befc1e2bc0707e0a39531fdb74b91212b7514d429e6dd63d589228d42ca2fea4fb3f7cbbf438f3ade94e0832bb83ee42bd6018b3b

Download Submit
C:\MobileEmuMaster\ComputerZ.set
MD5
df9f17820b778bc39e747ce6ce734c16

SHA1
e86c95a901814e1e55622aff184383af347d32f9

SHA256
224e8948ab79ce33e527d5c0bc0ccf16f88f61b2ee46fe42d56fd9cc7ebfce6f

SHA512
20d939775031edd2e71ff4b770d2633bfd49b4397af7bb6b037b161e049e180c42f3842eb3af05a9b57a041c1138d8907cfe5ade5502fa4fe0885f6027ec6bfd

Download Submit
C:\MobileEmuMaster\Downloads\Temp\LDSGameMasterHall_7.1.3587.2260.zip
MD5
2b95366d7b1bbe99b0c0ae15b6c52f98

SHA1
34dd42707315df6863045d6ca78fdf57deb64cc5

SHA256
064e38538ab0cc6c6c0aca1d09fe1cdc0d0d42baf813f568dbb6db459a683c54

SHA512
c39543692ab9e50d403f51c7054324853d9cb11238a9e479cf16748339d7744cadd9d1623d5a278ad935b41f8817dc65b7445a88ed50aa2d078e62b2c8f41939

Download Submit
C:\MobileEmuMaster\GameMemoryOpt_x64.dll
MD5
bc2d763dd2bec9614755bd36072cd961

SHA1
296a7853a1d8914463c7a52a1c15cd7f828c0ffe

SHA256
3b468042286b79c42ce97746f2cce549ba0d6ec8ee7c7589d34b4d3d8b56621c

SHA512
af9cd9cb8f9cfdadf4cb00ddd534e6aff98f74ee0b41b7d40cf5c029e6423d0397748e2987a1764f59c0663cb0cd30283b023f5f93244e9884a4521eee6ae37e

Download Submit
C:\MobileEmuMaster\LDSGameHall\LDSGameHall.exe
MD5
6b6a5c6d232fe5ca76f8e5959239c04b

SHA1
74e7445dbfbfb7b32c846894c74e3d0fd61187d8

SHA256
04e8df5523afa217693e38ccd7158a379e989814259e75eb2dfb57e3faf592e0

SHA512
f5e0e4fbb75a7b2ebbe6a06c3c42f5d11682323dc33776bbf8450f95ecf1eefd6d3e51c984ff4a9a657def02abdf4a8e8a48127324b14d5ab8cd4a904cee66a1

Download Submit
C:\MobileEmuMaster\LiveUpd360.dll
MD5
299f4394db122aa9dd9328b4337e1f72

SHA1
34bccbc1132513424c589bf61300d69d4f8a105f

SHA256
9b0ffaeec2131cf8813751805208c34b61c6874fcbc88c751f1c9f642f4b4f35

SHA512
80ffea81b7b25fa4f3a4ca6a672fb8cbabd166f10d7a3498bd691082727ea8ede16774b91d2f51ebdee614918e5a478c6ca2124e8a676d16903b2cdbca8b0414

Download Submit
C:\MobileEmuMaster\PDown.dll
MD5
611eef942e78702fbe407d544986de78

SHA1
1280da24a46ab08c8a6c5d62780767c56369c793

SHA256
684783eebce759a34094964a99de1a67b1da6f23d603bbea722e549a6068b280

SHA512
90575f3b8550436106694f8c41952dd4303c1e2c53ae9b7a0bc29deda3ab3ca70885bfecedb64d9d86766b3b48078013a4ec1d33db9fcda2ded91722da6e9683

Download Submit
C:\MobileEmuMaster\Plugin\ShellExt_x64.dll
MD5
0d83f9c3fd4686065c2b043cafc6cbef

SHA1
21d1d93bd079269d5b80685caac952d097fead21

SHA256
653aba53aa7825b89065daccf985fce3e7386d5891f1ace71e79f2cd326c4ed8

SHA512
271cfecb7badd32b968d2d3535edca6ab08ce37e863371c079d34f8f5c0cea2f3b668ae42aa10343ca3878ce402481c20427c002261a0d0d21da56b51c978c17

Download Submit
C:\MobileEmuMaster\SoftMgr\SoftMgrInst.exe
MD5
15254ec0bae2cda3b4a73317ed1aed0c

SHA1
1b8e1adb34f3e9f2127ad4099fe7c1a733b63f55

SHA256
33fce3de689e28c4066e468867cc5e9163fbb3071bb1b031dbe95f60ddb745d7

SHA512
16503dd3ae32273f8b4f102ec8f0070093f14aec04f05aa2e83babdf6b2eaf5e986c417c952062390a05e4c8d2546d553fd97675a13445d446b5e54270c3632e

Download Submit
C:\MobileEmuMaster\SoftMgr\SoftMgrInst.exe
MD5
15254ec0bae2cda3b4a73317ed1aed0c

SHA1
1b8e1adb34f3e9f2127ad4099fe7c1a733b63f55

SHA256
33fce3de689e28c4066e468867cc5e9163fbb3071bb1b031dbe95f60ddb745d7

SHA512
16503dd3ae32273f8b4f102ec8f0070093f14aec04f05aa2e83babdf6b2eaf5e986c417c952062390a05e4c8d2546d553fd97675a13445d446b5e54270c3632e

Download Submit
C:\MobileEmuMaster\Utils\MobileEmuHelper.exe
MD5
1f266a53fc25184a794ef9e146db91d7

SHA1
1e9dae1c280a5481aebe84a6c41676f4d9de3e68

SHA256
40c92be5a8e199cfe62f966f3d945c0728c403e4c117a06fb9a84a9e7888fac2

SHA512
6492f16b1914ce4779273ff9bda42fda69d7392d091321504ec28141398e3629ba9a035cf83082a0d526936c3eee9f5e9ef2508e9c5401a62daded614fb992a9

Download Submit
C:\MobileEmuMaster\Utils\MobileEmuHelper.exe
MD5
1f266a53fc25184a794ef9e146db91d7

SHA1
1e9dae1c280a5481aebe84a6c41676f4d9de3e68

SHA256
40c92be5a8e199cfe62f966f3d945c0728c403e4c117a06fb9a84a9e7888fac2

SHA512
6492f16b1914ce4779273ff9bda42fda69d7392d091321504ec28141398e3629ba9a035cf83082a0d526936c3eee9f5e9ef2508e9c5401a62daded614fb992a9

Download Submit
C:\MobileEmuMaster\computerz.set
MD5
ca1717b26d8af76eab0f24a1f6135776

SHA1
c07b3745f0bc3d5b1dce7628d05b96b195c5b359

SHA256
58cc724472e3ebe3d1ddde9150700b461a3b8fb9db0a1ca3b8e8f7f164762b37

SHA512
d7833a55d328ea36cf06658ebc232b145cbbc958e8f638be196c52f90f2a4365fc7113737a7dbe1557e6c0bc789afbd8052e2b23098f75c4c69764be3f95d392

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C18B7A4A1C49A0D62FB269C7C94152C2_08D399040323FEDFE613061B3D08802D
MD5
0a0a55355ad788becb2f71097ca09324

SHA1
aa2d0a6b6ade059d53f7187ce4565d5f9d791e9e

SHA256
cc585c82fc73e2e68d5999d972a022df27777f1823e2476f60a36a918a496d94

SHA512
f3c10d34eb5d885c1d93a6a5730166ea9265b7aba05d5623cb14b073b7b52b82be547109bd6258875fa617a51bcc03dc412e4d330f28c877207365e03ddc0b59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C18B7A4A1C49A0D62FB269C7C94152C2_08D399040323FEDFE613061B3D08802D
MD5
44a8ee6b88927a3295765f6904989abe

SHA1
d50f531afaaa1f92a865b822f471e0b5bd9bf6a8

SHA256
cd73aec88f42dce4120cab257689b8995c6c263796f106deb9c19bbfc5cb0c82

SHA512
08d75421dfd3e0a6c1abfa57af667aaf156799ce2820af22a9becb34ce5bfecf8645bc0e7e6e2f34c422416ab6a12205b40375436a8804ee49698e2d5add135a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\WNUUJJNC\setupbeta[1].exe
MD5
cc0e076dac7b777350ed2423ceea914e

SHA1
75f80d17e883a5e04741202a36388cbb0b26570d

SHA256
4dd9574a41a94c95ad2f819280fea9346c12eab1b9173db7103c902ba971e21f

SHA512
bfea88ae6986f12b7124f00e03e82b18b7d18beaa93505c2c478745912d39ec67593db4557cfdb5383a02f81cae3efb3375e80ebb49fc65a923f2770752a2f4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\lB7Y1NZCM6GxgXGX\IAbtukweZabckantu4092521131beiao001.exe
MD5
0e307ee2c92f54d826ff38a0fffe73c2

SHA1
14bd5e2d94c0dcdc0720d181e7b831621bac5b8a

SHA256
c22845e937cb25faefbf29692bf2a1257c464e38db453ad64126c0732758e38a

SHA512
c594b6938d2c5ff673ffe1a048c89007deeb41af0922e11c3a166cb10931fc3bfc9222f507e4d96cdb4bc1cabbc0942e882bfcfe3817f66930f51fbb2017f1eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\lB7Y1NZCM6GxgXGX\IAbtukweZabckantu4092521131beiao001.exe
MD5
0e307ee2c92f54d826ff38a0fffe73c2

SHA1
14bd5e2d94c0dcdc0720d181e7b831621bac5b8a

SHA256
c22845e937cb25faefbf29692bf2a1257c464e38db453ad64126c0732758e38a

SHA512
c594b6938d2c5ff673ffe1a048c89007deeb41af0922e11c3a166cb10931fc3bfc9222f507e4d96cdb4bc1cabbc0942e882bfcfe3817f66930f51fbb2017f1eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\lB7Y1NZCM6GxgXGX\Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
MD5
a4b2ddd3af44fa63bf4b68ee6bf2ce7b

SHA1
e3c817ab77ad65f7cff1e51a2d0ffcc2ea4a9b6c

SHA256
8e9f79413596b65dea30f6948ed67b256e023d6ac2a2b9975ab7b28a9c42203f

SHA512
4c846168d1c96882792a11181c0700b185659c0069bd8adef48fc87b26fecc669735e586df4f49655eeb6e154a006db9f43aa8e8d6c41e3b4340dcb2348419d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\lB7Y1NZCM6GxgXGX\Inst3__3112601__3f7372633d6c6d266c733d6e30316264363462333966__68616f2e3336302e636e__0c97.exe
MD5
a4b2ddd3af44fa63bf4b68ee6bf2ce7b

SHA1
e3c817ab77ad65f7cff1e51a2d0ffcc2ea4a9b6c

SHA256
8e9f79413596b65dea30f6948ed67b256e023d6ac2a2b9975ab7b28a9c42203f

SHA512
4c846168d1c96882792a11181c0700b185659c0069bd8adef48fc87b26fecc669735e586df4f49655eeb6e154a006db9f43aa8e8d6c41e3b4340dcb2348419d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\lB7Y1NZCM6GxgXGX\LDSGameMasterInstRoad_211501.exe
MD5
8e5a83388b85007dd02a41b512ada556

SHA1
0cf9f44f21c4b8cd7a4735e483d5d919cd3d5f43

SHA256
d3709b4ff018f33e486b99ef6873dec91bed41cb240c630de754e9b4cc30bd1d

SHA512
133f2ae0c7aaa38c9cfd3ecb7ed13e1d43b8ba59dc517d1e54c0c13759220db4093f4e1ad4f85e42fcc22d62073d0d2f12bce06bea504e2cf0c32536b2e2cc1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\lB7Y1NZCM6GxgXGX\LDSGameMasterInstRoad_211501.exe
MD5
8e5a83388b85007dd02a41b512ada556

SHA1
0cf9f44f21c4b8cd7a4735e483d5d919cd3d5f43

SHA256
d3709b4ff018f33e486b99ef6873dec91bed41cb240c630de754e9b4cc30bd1d

SHA512
133f2ae0c7aaa38c9cfd3ecb7ed13e1d43b8ba59dc517d1e54c0c13759220db4093f4e1ad4f85e42fcc22d62073d0d2f12bce06bea504e2cf0c32536b2e2cc1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\lB7Y1NZCM6GxgXGX\kuaizip_setup_2206473764_beiao_004.exe
MD5
8c1462a745592a9daa91be509f79706e

SHA1
85a436735679d82ce74bddc4be0e38c8872fdb81

SHA256
59dbfbaa7c7fc22fff2a5b942dddf41fedb4a807e93ba66287e61747a47caed1

SHA512
b312ff858e04aa65037251c619a3887c26d824dd927a5e9f0838c7f5ad4c1e5bb1dfe56e508b9e98c0f76730af33a5fbe49b224d783be20ed6b15ee3b8e09bdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\lB7Y1NZCM6GxgXGX\kuaizip_setup_2206473764_beiao_004.exe
MD5
8c1462a745592a9daa91be509f79706e

SHA1
85a436735679d82ce74bddc4be0e38c8872fdb81

SHA256
59dbfbaa7c7fc22fff2a5b942dddf41fedb4a807e93ba66287e61747a47caed1

SHA512
b312ff858e04aa65037251c619a3887c26d824dd927a5e9f0838c7f5ad4c1e5bb1dfe56e508b9e98c0f76730af33a5fbe49b224d783be20ed6b15ee3b8e09bdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\ldsgamemaster.exe
MD5
565838545b2f422521bb70f322b78af0

SHA1
d1d9d07bebe2afbff3ed72502e28fbc671f39377

SHA256
05444227c19ceaf5f9c267fc435f6c8ec7e7a12f9909114e0c79bb4d41d388cb

SHA512
0e1e6cdf5c039cf74763ae92f9f55d10fb97c6542346bdfa028eb60af2264c886238b721c7785d5b9db508652b1a4c5d2da61c801757d9f7c1392e6e0965cbcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\ldsgamemaster.exe
MD5
565838545b2f422521bb70f322b78af0

SHA1
d1d9d07bebe2afbff3ed72502e28fbc671f39377

SHA256
05444227c19ceaf5f9c267fc435f6c8ec7e7a12f9909114e0c79bb4d41d388cb

SHA512
0e1e6cdf5c039cf74763ae92f9f55d10fb97c6542346bdfa028eb60af2264c886238b721c7785d5b9db508652b1a4c5d2da61c801757d9f7c1392e6e0965cbcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\pGgOlEwZxViAbGyA\360ini.dll
MD5
858ff2e53ae66c38346c3eab2496392c

SHA1
9c7eb03d090e62aa9ba68ce8be545b6481a2e40d

SHA256
4484071a243b9201fd772e3f19cdd94ff4326c5ee9b05f1afbfaebfb1bbaab62

SHA512
d2ada0d070e2df51c1392aa6f95e9d26d8de9b1d0260b85656a58a06f7958f3054f1d1a811c4aafbde79018701161fd6857afe5b7f878be5695d1654382594e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\{66113423-0036-4c5e-BD0F-9536D404CB00}\jQrNqLvTuHbKiJmO.exe
MD5
a6d17f4577051c8bcc85cde4c0858f9f

SHA1
1c2dfee9897789d846cc52850e9fc26dcc063af3

SHA256
aff2ce0f7eb40f0a719098a354b11d0847d9ddeccc16b5a6246c82b34e85482e

SHA512
c0032c80a19b0756d64dd02c7bc7a17bfc4653ce90d93f67bda90cd7ed7f696b6fe251b7a946d88df5eb3d1924c2fc4675507b0a93cd250262077db703d37036

Download Submit
C:\Users\Admin\AppData\Local\Temp\{66113423-0036-4c5e-BD0F-9536D404CB00}\jQrNqLvTuHbKiJmO.exe
MD5
a6d17f4577051c8bcc85cde4c0858f9f

SHA1
1c2dfee9897789d846cc52850e9fc26dcc063af3

SHA256
aff2ce0f7eb40f0a719098a354b11d0847d9ddeccc16b5a6246c82b34e85482e

SHA512
c0032c80a19b0756d64dd02c7bc7a17bfc4653ce90d93f67bda90cd7ed7f696b6fe251b7a946d88df5eb3d1924c2fc4675507b0a93cd250262077db703d37036

Download Submit
C:\Users\Admin\AppData\Roaming\PhotoViewer\PreviewExt64.dll
MD5
59110719d911f03023f7f48162e65b39

SHA1
4a34dea9e31a55a2ce716cf95ce5fff4173fa0ff

SHA256
d9b40d64f880e8f518f7511d187a804c5b94e5abe2496ee701a4156e1763980c

SHA512
58c864fb01f5b8605d534025e49e6b7ecdba660f88d4ac34071254bbad7ffe3e88341a0f9cba285c26ad28f8390a63d47b77276a71dc18b9c0fe53ecab895856

Download Submit
C:\Users\Admin\Desktop\灭神2神魔传说.lnk
MD5
feaf6f14af84a7b56c46b50fdbf970ae

SHA1
bc6bf95f6b518a81a26161f0d82751f3cd9fc872

SHA256
08fe114e5d30188f7932bb87cfb0bb366dd271a773d07f6a2f94a6e8b9d06f66

SHA512
6df85a69c248642a32cc28319e2a12368a2bb8e75e460bd9e0bab343e9123171efb1f1f346968816f73c9f381a0e664a46e0eaa04e1f6d40026f10f46bf33471

Download Submit
\??\c:\mobileemumaster\utils\spsvc.dll
MD5
fe9719ed7ed5f3038e682a9e8349507f

SHA1
d27d0f323483fab288a81757fedfb05de8ac3cf4

SHA256
3f014ddca4a013c48302e92de2273787989d08015cfae6ffbbb68dffba4e0ec8

SHA512
b38f4ac3b5418fb83d77fe7333ea6d4ca47c57aeca5b5bc696b4cc04d49bfd6f9e947e3cfe4df33af7cb33cab9557556c3c3ed87d7dc6826c0b671f507c043ad

Download Submit
\MobileEmuMaster\360Base.dll
MD5
84beb92b22b17841b326e4df2d31117b

SHA1
ef3a1cb3f64e3a9084f047c777f3ce29e761aa09

SHA256
51f68c7e9e40694ff4cc49d23a2e406b5feba6f0aa9f998bdd8030065c90a9da

SHA512
4d4b29e84daa5e999a35723bddb32019a306fdefec660fc53244385d960e55a94a9855093fc146e3fa0110f8dc6a264ef4c6802386c19175b7464c629f6fe8e9

Download Submit
\MobileEmuMaster\360Base.dll
MD5
84beb92b22b17841b326e4df2d31117b

SHA1
ef3a1cb3f64e3a9084f047c777f3ce29e761aa09

SHA256
51f68c7e9e40694ff4cc49d23a2e406b5feba6f0aa9f998bdd8030065c90a9da

SHA512
4d4b29e84daa5e999a35723bddb32019a306fdefec660fc53244385d960e55a94a9855093fc146e3fa0110f8dc6a264ef4c6802386c19175b7464c629f6fe8e9

Download Submit
\MobileEmuMaster\360Net.dll
MD5
48e996402b35f914dc869f8f529e2444

SHA1
fdcbf945a79ca75b0fc663d3de6ce86ca4a50d2f

SHA256
8c2a4ef1b9ac458d48b2944f90f90527f5b0650aa1107e808bf7716a8d894250

SHA512
233bad9580a906547958643befc1e2bc0707e0a39531fdb74b91212b7514d429e6dd63d589228d42ca2fea4fb3f7cbbf438f3ade94e0832bb83ee42bd6018b3b

Download Submit
\MobileEmuMaster\360Net.dll
MD5
48e996402b35f914dc869f8f529e2444

SHA1
fdcbf945a79ca75b0fc663d3de6ce86ca4a50d2f

SHA256
8c2a4ef1b9ac458d48b2944f90f90527f5b0650aa1107e808bf7716a8d894250

SHA512
233bad9580a906547958643befc1e2bc0707e0a39531fdb74b91212b7514d429e6dd63d589228d42ca2fea4fb3f7cbbf438f3ade94e0832bb83ee42bd6018b3b

Download Submit
\MobileEmuMaster\360P2SP.dll
MD5
96c74f16a2b94f33ce54df012e1a9143

SHA1
c685b6a26b4abffa25399beea2eb45dc7869bc0a

SHA256
9dfc5349404e386f87c44419f8ff83e2dc0666f3ef3278860d872e10af9766a5

SHA512
e186578e68ed40e91b3167a6d7f594f390d614c44b83f5d17213421cff12649c3a8a4f1dc47c8479bd0a20e303f90be8c5526325086db20e960024af1996fb65

Download Submit
\MobileEmuMaster\GameMemoryOpt_x64.dll
MD5
bc2d763dd2bec9614755bd36072cd961

SHA1
296a7853a1d8914463c7a52a1c15cd7f828c0ffe

SHA256
3b468042286b79c42ce97746f2cce549ba0d6ec8ee7c7589d34b4d3d8b56621c

SHA512
af9cd9cb8f9cfdadf4cb00ddd534e6aff98f74ee0b41b7d40cf5c029e6423d0397748e2987a1764f59c0663cb0cd30283b023f5f93244e9884a4521eee6ae37e

Download Submit
\MobileEmuMaster\GameMemoryOpt_x64.dll
MD5
bc2d763dd2bec9614755bd36072cd961

SHA1
296a7853a1d8914463c7a52a1c15cd7f828c0ffe

SHA256
3b468042286b79c42ce97746f2cce549ba0d6ec8ee7c7589d34b4d3d8b56621c

SHA512
af9cd9cb8f9cfdadf4cb00ddd534e6aff98f74ee0b41b7d40cf5c029e6423d0397748e2987a1764f59c0663cb0cd30283b023f5f93244e9884a4521eee6ae37e

Download Submit
\MobileEmuMaster\LiveUpd360.dll
MD5
299f4394db122aa9dd9328b4337e1f72

SHA1
34bccbc1132513424c589bf61300d69d4f8a105f

SHA256
9b0ffaeec2131cf8813751805208c34b61c6874fcbc88c751f1c9f642f4b4f35

SHA512
80ffea81b7b25fa4f3a4ca6a672fb8cbabd166f10d7a3498bd691082727ea8ede16774b91d2f51ebdee614918e5a478c6ca2124e8a676d16903b2cdbca8b0414

Download Submit
\MobileEmuMaster\LiveUpd360.dll
MD5
299f4394db122aa9dd9328b4337e1f72

SHA1
34bccbc1132513424c589bf61300d69d4f8a105f

SHA256
9b0ffaeec2131cf8813751805208c34b61c6874fcbc88c751f1c9f642f4b4f35

SHA512
80ffea81b7b25fa4f3a4ca6a672fb8cbabd166f10d7a3498bd691082727ea8ede16774b91d2f51ebdee614918e5a478c6ca2124e8a676d16903b2cdbca8b0414

Download Submit
\MobileEmuMaster\PDown.dll
MD5
611eef942e78702fbe407d544986de78

SHA1
1280da24a46ab08c8a6c5d62780767c56369c793

SHA256
684783eebce759a34094964a99de1a67b1da6f23d603bbea722e549a6068b280

SHA512
90575f3b8550436106694f8c41952dd4303c1e2c53ae9b7a0bc29deda3ab3ca70885bfecedb64d9d86766b3b48078013a4ec1d33db9fcda2ded91722da6e9683

Download Submit
\MobileEmuMaster\Plugin\ShellExt_x64.dll
MD5
0d83f9c3fd4686065c2b043cafc6cbef

SHA1
21d1d93bd079269d5b80685caac952d097fead21

SHA256
653aba53aa7825b89065daccf985fce3e7386d5891f1ace71e79f2cd326c4ed8

SHA512
271cfecb7badd32b968d2d3535edca6ab08ce37e863371c079d34f8f5c0cea2f3b668ae42aa10343ca3878ce402481c20427c002261a0d0d21da56b51c978c17

Download Submit
\MobileEmuMaster\Plugin\ShellExt_x64.dll
MD5
0d83f9c3fd4686065c2b043cafc6cbef

SHA1
21d1d93bd079269d5b80685caac952d097fead21

SHA256
653aba53aa7825b89065daccf985fce3e7386d5891f1ace71e79f2cd326c4ed8

SHA512
271cfecb7badd32b968d2d3535edca6ab08ce37e863371c079d34f8f5c0cea2f3b668ae42aa10343ca3878ce402481c20427c002261a0d0d21da56b51c978c17

Download Submit
\MobileEmuMaster\Utils\ArCtrl.dll
MD5
68ab43ec86d02a6ea3a82f8abcb3144b

SHA1
48f3dbee1d445bae77d713124dd573d9481cf68a

SHA256
92f31d38813bca69cfe1b83205cc1e87a8131cf293a41200f66b01b28d269ee1

SHA512
bdf5deab1b2987deba6f137e4b28d9bd1e2525bd297011ef23dfbf96290695fecf6881d04a6e4eb736100e5c30c555615844d878279a728f4b7dc18aa8f29b4a

Download Submit
\MobileEmuMaster\Utils\InstExt.dll
MD5
07528edcb847bcdc0baf9d2d7b602222

SHA1
ce8689e6e0f142777595539255c789a49b662f46

SHA256
5be40ad83bb43e13c077afbf58564829ea35b63c56cc5abf36c17dad9ece3b43

SHA512
bfc09af4c54f6c9068e9afdb2f0e08f7816c8bae7159e53fd55300cfd95f931d9b397653b23e5c5c78a3d1aafacf41b78a5f7905f9c635999921cd1a06d827e4

Download Submit
\MobileEmuMaster\Utils\SpSvc.dll
MD5
fe9719ed7ed5f3038e682a9e8349507f

SHA1
d27d0f323483fab288a81757fedfb05de8ac3cf4

SHA256
3f014ddca4a013c48302e92de2273787989d08015cfae6ffbbb68dffba4e0ec8

SHA512
b38f4ac3b5418fb83d77fe7333ea6d4ca47c57aeca5b5bc696b4cc04d49bfd6f9e947e3cfe4df33af7cb33cab9557556c3c3ed87d7dc6826c0b671f507c043ad

Download Submit
\MobileEmuMaster\Utils\SpSvc.dll
MD5
fe9719ed7ed5f3038e682a9e8349507f

SHA1
d27d0f323483fab288a81757fedfb05de8ac3cf4

SHA256
3f014ddca4a013c48302e92de2273787989d08015cfae6ffbbb68dffba4e0ec8

SHA512
b38f4ac3b5418fb83d77fe7333ea6d4ca47c57aeca5b5bc696b4cc04d49bfd6f9e947e3cfe4df33af7cb33cab9557556c3c3ed87d7dc6826c0b671f507c043ad

Download Submit
\Users\Admin\AppData\Local\Temp\360Base.dll
MD5
ab00bed7cb2b7a8290e247fc34aaa5ff

SHA1
d6014e2920d9b587a8e12ae1ba0f1e1fc9edffa8

SHA256
ceffaedc050688e8dcc11ec30b703c63fefbfcf479558604fdb0ea42bcb497c0

SHA512
fbe3bf5e142d689bb15d05503fcf5c807aad5bcb99a02dc99590589ee66f7942a0d8365d470041972212dbdf9c232ab4bbab25e79d7bcd43f001a95d9012cca6

Download Submit
\Users\Admin\AppData\Local\Temp\360net.dll
MD5
48e996402b35f914dc869f8f529e2444

SHA1
fdcbf945a79ca75b0fc663d3de6ce86ca4a50d2f

SHA256
8c2a4ef1b9ac458d48b2944f90f90527f5b0650aa1107e808bf7716a8d894250

SHA512
233bad9580a906547958643befc1e2bc0707e0a39531fdb74b91212b7514d429e6dd63d589228d42ca2fea4fb3f7cbbf438f3ade94e0832bb83ee42bd6018b3b

Download Submit
\Users\Admin\AppData\Local\Temp\pGgOlEwZxViAbGyA\360ini.dll
MD5
858ff2e53ae66c38346c3eab2496392c

SHA1
9c7eb03d090e62aa9ba68ce8be545b6481a2e40d

SHA256
4484071a243b9201fd772e3f19cdd94ff4326c5ee9b05f1afbfaebfb1bbaab62

SHA512
d2ada0d070e2df51c1392aa6f95e9d26d8de9b1d0260b85656a58a06f7958f3054f1d1a811c4aafbde79018701161fd6857afe5b7f878be5695d1654382594e4

Download Submit
\Users\Admin\AppData\Local\Temp\pGgOlEwZxViAbGyA\360ini.dll
MD5
858ff2e53ae66c38346c3eab2496392c

SHA1
9c7eb03d090e62aa9ba68ce8be545b6481a2e40d

SHA256
4484071a243b9201fd772e3f19cdd94ff4326c5ee9b05f1afbfaebfb1bbaab62

SHA512
d2ada0d070e2df51c1392aa6f95e9d26d8de9b1d0260b85656a58a06f7958f3054f1d1a811c4aafbde79018701161fd6857afe5b7f878be5695d1654382594e4

Download Submit
\Users\Admin\AppData\Local\Temp\{2B2CCDFF-38A5-4aea-A01B-7184E7EE85C7}.tmp\360NetUL.dll
MD5
cd03029957ebc78c0ca7a6c02a9ca846

SHA1
0044114b8073781479044f0294701be9611be2ac

SHA256
139fdd92e6ddf1aac0761a68502b374daa32e82039621018511dc491ed9b4048

SHA512
14c641cb9536def0ddc1969d50b97b83a23017c97373e3ad74d3fbf9825ac81f3fdf8169281c8ad4cebd45d9c9ae05f752d553ba4653e620889b274479cb7c32

Download Submit
\Users\Admin\AppData\Local\Temp\{2B2CCDFF-38A5-4aea-A01B-7184E7EE85C7}.tmp\NetBridge.dll
MD5
8786d469338c30e0ba9fedfc62bd5197

SHA1
5fb12028ceae9772f938e1b98b699f0e02e32718

SHA256
beeaf8b72f7008e9adabacfcd85e32a50747a0dfb5c86802aeb973bd1f5c3d2f

SHA512
5db1e5b78e62cda81a63e8e712e720f87a7c7a539237a55a9098c076f9fb4e0b5adb83383c23657b4ccc90c117e55e3946a399cdf3d15cb94444b203d9d6c45c

Download Submit
\Users\Admin\AppData\Local\Temp\{2B2CCDFF-38A5-4aea-A01B-7184E7EE85C7}.tmp\Utils\LDSBasic.dll
MD5
cc7b7a2d031fbef005b82bc5221e6046

SHA1
61b9cf646825c37e5262ab5b2ecc755d72770393

SHA256
28f4e42556497b05a017309c69c7e62683a043ab1c452170056a1b5f77175633

SHA512
ec67289b40e88acb946c18890e40e53322b386ce17c351c5fbbebccae84b6d16c2df79ebe79a143d1276101151544aa24a65bdd3101cfd096390034aa70d3e29

Download Submit
\Users\Admin\AppData\Local\Temp\{6C2880F3-9025-4ffc-9525-A05A0A86E38C}.tmp\7z.dll
MD5
b902e3ce824b63d3220bff0150097f83

SHA1
efb511c687b1376b683cac4dfe26e044535aa8d3

SHA256
bc19ccc142de96f79288a7edd5468b5e9a96a35a64c888a6e9a9733933c4ae51

SHA512
ace3714e3d5c1409636478564c4ea1828c97cbeacea0e1ab95ec353e898bafcef0c682c780cbfa49589a480d36f0962c805508f4df1b430efb5955c9290b9656

Download Submit
\Users\Admin\AppData\Local\Temp\{7CCEC02F-CBC3-4ee6-B3C9-99920988DE51}\{93FD7CBC-1108-43af-BD8C-D71476037EFF}.tmp
MD5
baff1377615c22fab1a72611e4eb4f5e

SHA1
0ff1b09d1e6b2ed584a78f17c4f8de16707e41c3

SHA256
78cdb6d5f13fb5b760b4a5c2973883d9ed47b02272d46b325530f52d4bc914f2

SHA512
f2ae1bfede8a1dad826531d8107a55dc883dcdef749fd88dc4a44afdaf6f746457458c2129f3be41026d1ddd4cc2357df9f55c97099fa387665ee90b3693b034

Download Submit
\Users\Admin\AppData\Roaming\PhotoViewer\PreviewExt64.dll
MD5
59110719d911f03023f7f48162e65b39

SHA1
4a34dea9e31a55a2ce716cf95ce5fff4173fa0ff

SHA256
d9b40d64f880e8f518f7511d187a804c5b94e5abe2496ee701a4156e1763980c

SHA512
58c864fb01f5b8605d534025e49e6b7ecdba660f88d4ac34071254bbad7ffe3e88341a0f9cba285c26ad28f8390a63d47b77276a71dc18b9c0fe53ecab895856

Download Submit
\Users\Admin\AppData\Roaming\PhotoViewer\PreviewExt64.dll
MD5
59110719d911f03023f7f48162e65b39

SHA1
4a34dea9e31a55a2ce716cf95ce5fff4173fa0ff

SHA256
d9b40d64f880e8f518f7511d187a804c5b94e5abe2496ee701a4156e1763980c

SHA512
58c864fb01f5b8605d534025e49e6b7ecdba660f88d4ac34071254bbad7ffe3e88341a0f9cba285c26ad28f8390a63d47b77276a71dc18b9c0fe53ecab895856

Download Submit
memory/208-207-0x0000000000000000-mapping.dmp

Download
memory/644-121-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

Filesize
4KB

Download
memory/644-118-0x0000000000000000-mapping.dmp

Download
memory/1384-204-0x0000000000000000-mapping.dmp

Download
memory/1424-195-0x0000000000000000-mapping.dmp

Download
memory/1464-122-0x0000000000000000-mapping.dmp

Download
memory/1464-127-0x0000000002430000-0x0000000002431000-memory.dmp

Filesize
4KB

Download
memory/1532-208-0x0000000000000000-mapping.dmp

Download
memory/1532-225-0x0000000000000000-mapping.dmp

Download
memory/1536-158-0x0000000000000000-mapping.dmp

Download
memory/1796-203-0x0000000000000000-mapping.dmp

Download
memory/2188-181-0x0000000000000000-mapping.dmp

Download
memory/2216-184-0x0000000000000000-mapping.dmp

Download
memory/2388-177-0x0000000000000000-mapping.dmp

Download
memory/2892-221-0x0000000000000000-mapping.dmp

Download
memory/2892-226-0x0000000000000000-mapping.dmp

Download
memory/2892-211-0x0000000000000000-mapping.dmp

Download
memory/3480-220-0x0000000000000000-mapping.dmp

Download
memory/3600-200-0x0000000000000000-mapping.dmp

Download
memory/3788-129-0x0000000000000000-mapping.dmp

Download
memory/3816-194-0x0000000000000000-mapping.dmp

Download
memory/3904-193-0x0000000000000000-mapping.dmp

Download
memory/4152-229-0x0000000005050000-0x0000000005051000-memory.dmp

Filesize
4KB

Download
memory/4152-219-0x0000000000000000-mapping.dmp

Download
memory/4164-171-0x0000000010000000-0x00000000100E0000-memory.dmp

Filesize
896KB

Download
memory/4164-168-0x0000000000000000-mapping.dmp

Download
memory/4212-117-0x0000000000F90000-0x0000000000F91000-memory.dmp

Filesize
4KB

Download
memory/4212-114-0x0000000000000000-mapping.dmp

Download
memory/4220-218-0x0000000000000000-mapping.dmp

Download
memory/4232-163-0x0000000000000000-mapping.dmp

Download
memory/4232-165-0x0000000010000000-0x00000000101D5000-memory.dmp

Filesize
1.8MB

Download
memory/4348-213-0x0000000000000000-mapping.dmp

Download
memory/4348-222-0x0000000000000000-mapping.dmp

Download
memory/4452-180-0x0000000000000000-mapping.dmp

Download
memory/4596-150-0x0000000003020000-0x0000000003093000-memory.dmp

Filesize
460KB

Download
memory/4596-146-0x0000000000FA0000-0x0000000000FA1000-memory.dmp

Filesize
4KB

Download
memory/4596-138-0x0000000000000000-mapping.dmp

Download
memory/4596-155-0x00000000033A0000-0x00000000033E8000-memory.dmp

Filesize
288KB

Download
memory/4632-215-0x0000000000000000-mapping.dmp

Download
memory/4708-217-0x0000000000000000-mapping.dmp

Download
memory/4964-214-0x0000000000000000-mapping.dmp

Download
memory/5044-216-0x0000000000000000-mapping.dmp

Download
memory/5196-227-0x0000000000000000-mapping.dmp

Download
memory/5272-228-0x0000000000000000-mapping.dmp

Download
memory/5452-230-0x0000000000000000-mapping.dmp

Download
memory/5540-231-0x0000000000000000-mapping.dmp

Download
memory/5784-232-0x0000000000000000-mapping.dmp

Download
memory/5884-233-0x0000000000000000-mapping.dmp

Download
memory/5964-234-0x0000000000000000-mapping.dmp

Download
memory/6056-235-0x0000000000000000-mapping.dmp

Download