6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212

Analysis

max time kernel
48s
max time network
147s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-10-2022 21:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe
Size

635KB
MD5

1afed583472f201f3d82fad8b8d24bb1
SHA1

47969a14c08e0d0034ca12313ae25bfecf57fafb
SHA256

6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212
SHA512

53094bcf92020843ee3cb9fbf395102f69d0db367657f27de06993c40872f932b9e30174c8e253b39f53d12091c410185fa43e12b9709625046217b989e7d5b9
SSDEEP

12288:gs17p2j1eNT+dhJtqEE637SvmiCzcjj/qh2GTKlRC7AhCAR:gsWMT+dDAEE637SvmiCzcjj/qh2GTKl1

Score

8^/10

bootkit discovery persistence upx

Malware Config

Signatures

Downloads MZ/PE file

Drops file in Drivers directory 11 IoCs

Processes:

duba_3_295.exe

description	ioc	process
File created	C:\Windows\system32\drivers\kisnetmxp.sys	duba_3_295.exe
File created	C:\Windows\system32\drivers\ksapi.sys	duba_3_295.exe
File created	C:\Windows\system32\drivers\ksskrpr.sys	duba_3_295.exe
File created	C:\Windows\system32\drivers\bc.sys	duba_3_295.exe
File created	C:\Windows\system32\drivers\kisknl64.sys	duba_3_295.exe
File created	C:\Windows\system32\drivers\kisnetm.sys	duba_3_295.exe
File created	C:\Windows\system32\drivers\kisnetm64.sys	duba_3_295.exe
File opened for modification	C:\Windows\SysWOW64\drivers\KAVBase.sys	duba_3_295.exe
File opened for modification	C:\Windows\system32\drivers\bc.sys	duba_3_295.exe
File created	C:\Windows\system32\drivers\kisknl.sys	duba_3_295.exe
File created	C:\Windows\system32\drivers\ksapi64.sys	duba_3_295.exe

Executes dropped EXE 16 IoCs

Processes:

setup_30004.exeQQPCDownload72844.exe360se_nanaxt9.exesetup.exeduba_3_295.exeBFVCenter-y4bd[[AB013]].exeSoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exekavlog2.exekxetray.exekxescore.exekislive.exekxescore.exekxetray.exerag1446260.exesetup.exeFileAssociationsTool.exe

pid	process
1236	setup_30004.exe
764	QQPCDownload72844.exe
1956	360se_nanaxt9.exe
1492	setup.exe
756	duba_3_295.exe
268	BFVCenter-y4bd[[AB013]].exe
1648	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
864	kavlog2.exe
584	kxetray.exe
1816	kxescore.exe
868	kislive.exe
1956	kxescore.exe
2064	kxetray.exe
2220	rag1446260.exe
2648	setup.exe
2852	FileAssociationsTool.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

duba_3_295.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32\ = "c:\\program files (x86)\\kingsoft\\kingsoft antivirus\\kavmenu64.dll"	duba_3_295.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32\ThreadingModel = "Apartment"	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32	duba_3_295.exe

Sets file execution options in registry 2 TTPs 28 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

duba_3_295.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KSETUPWIZ.EXE	duba_3_295.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UNINST.EXE	duba_3_295.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KSIGNSP.EXE	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kxetray.exe	duba_3_295.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCOMREGSVRV8.EXE	duba_3_295.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KDRVMGR.EXE	duba_3_295.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISCALL.EXE	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kislive.exe	duba_3_295.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVLOG2.EXE	duba_3_295.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KXETRAY.EXE	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kisaddin.exe	duba_3_295.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISADDIN.EXE	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kxescore.exe	duba_3_295.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KSCAN.EXE	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uninst.exe	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavlog2.exe	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kismain.exe	duba_3_295.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRECYCLE.EXE	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ksetupwiz.exe	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scomregsvrv8.exe	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kdrvmgr.exe	duba_3_295.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISLIVE.EXE	duba_3_295.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISMAIN.EXE	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\krecycle.exe	duba_3_295.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KXESCORE.EXE	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kiscall.exe	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kscan.exe	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ksignsp.exe	duba_3_295.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Program Files\duba_3_295.exe	upx
C:\Program Files\duba_3_295.exe	upx
C:\Program Files\duba_3_295.exe	upx
behavioral1/memory/756-97-0x0000000000400000-0x0000000000520000-memory.dmp	upx
behavioral1/memory/2220-170-0x0000000000400000-0x000000000052E000-memory.dmp	upx
behavioral1/memory/756-239-0x0000000000400000-0x0000000000520000-memory.dmp	upx
behavioral1/memory/2220-282-0x0000000000400000-0x000000000052E000-memory.dmp	upx
behavioral1/memory/756-322-0x0000000000400000-0x0000000000520000-memory.dmp	upx
behavioral1/memory/2220-386-0x0000000000400000-0x000000000052E000-memory.dmp	upx

Loads dropped DLL 64 IoCs

Processes:

6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exesetup_30004.exeQQPCDownload72844.exe360se_nanaxt9.exesetup.exeBFVCenter-y4bd[[AB013]].exeduba_3_295.exekavlog2.exekxetray.exekxescore.exekxescore.exekislive.exekxetray.exe

pid	process
1912	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe
1236	setup_30004.exe
1236	setup_30004.exe
1912	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe
764	QQPCDownload72844.exe
1236	setup_30004.exe
764	QQPCDownload72844.exe
1236	setup_30004.exe
1236	setup_30004.exe
1236	setup_30004.exe
1236	setup_30004.exe
1236	setup_30004.exe
1236	setup_30004.exe
1236	setup_30004.exe
1912	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe
1956	360se_nanaxt9.exe
1492	setup.exe
1492	setup.exe
1492	setup.exe
1912	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe
1912	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe
268	BFVCenter-y4bd[[AB013]].exe
756	duba_3_295.exe
756	duba_3_295.exe
756	duba_3_295.exe
756	duba_3_295.exe
756	duba_3_295.exe
756	duba_3_295.exe
756	duba_3_295.exe
756	duba_3_295.exe
756	duba_3_295.exe
1912	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe
756	duba_3_295.exe
756	duba_3_295.exe
756	duba_3_295.exe
864	kavlog2.exe
756	duba_3_295.exe
756	duba_3_295.exe
864	kavlog2.exe
756	duba_3_295.exe
584	kxetray.exe
584	kxetray.exe
584	kxetray.exe
1956	kxescore.exe
1956	kxescore.exe
1816	kxescore.exe
1816	kxescore.exe
868	kislive.exe
868	kislive.exe
1956	kxescore.exe
1956	kxescore.exe
2064	kxetray.exe
2064	kxetray.exe
868	kislive.exe
2064	kxetray.exe
1956	kxescore.exe
868	kislive.exe
868	kislive.exe
1956	kxescore.exe
1956	kxescore.exe
1912	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe
1956	kxescore.exe
1956	kxescore.exe
1956	kxescore.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

duba_3_295.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	duba_3_295.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kxesc = "\"c:\\program files (x86)\\kingsoft\\kingsoft antivirus\\kxetray.exe\" -autorun"	duba_3_295.exe

Checks for any installed AV software in registry 1 TTPs 4 IoCs

Security Software Discovery

T1063

Processes:

BFVCenter-y4bd[[AB013]].exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avira\Launcher	BFVCenter-y4bd[[AB013]].exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Launcher	BFVCenter-y4bd[[AB013]].exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AhnLab\V3IS80	BFVCenter-y4bd[[AB013]].exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AhnLab\V3IS80	BFVCenter-y4bd[[AB013]].exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 2 IoCs

Processes:

duba_3_295.exe

description	ioc	process
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\desktop.ini	duba_3_295.exe
File opened for modification	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\desktop.ini	duba_3_295.exe

Writes to the Master Boot Record (MBR) 1 TTPs 5 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

Processes:

6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exeQQPCDownload72844.exeBFVCenter-y4bd[[AB013]].exesetup.exe

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe
File opened for modification	\??\PhysicalDrive0	QQPCDownload72844.exe
File opened for modification	\??\PhysicalDrive0
File opened for modification	\??\PhysicalDrive0	BFVCenter-y4bd[[AB013]].exe
File opened for modification	\??\PhysicalDrive0	setup.exe

Drops file in System32 directory 5 IoCs

Processes:

kavlog2.exekxescore.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\KAVEventLog.EVT	kavlog2.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	kxescore.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	kxescore.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	kxescore.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	kxescore.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 30 IoCs

Processes:

BFVCenter-y4bd[[AB013]].exe

pid	process
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe

Drops file in Program Files directory 64 IoCs

Processes:

SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exeBFVCenter-y4bd[[AB013]].exeduba_3_295.exe

description	ioc	process
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\window\btn_cycleplay_disable.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\codecs\ogm.dll	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\Baofeng\BFVKanDianYing\msvcr110.dll	BFVCenter-y4bd[[AB013]].exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\window\btn_refresh_hover.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\Frames\dlna_btn_refresh_pressed.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\icon\3gp2.ico	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFVServer.exe	BFVCenter-y4bd[[AB013]].exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\knetworkpanel.dll	duba_3_295.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CommonCtl\btn_soundadd_normal.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\Frames\dlna_btn_refresh_normal.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kshmpg.dll	duba_3_295.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CenterConsole\btn_treecycle_disable.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CenterConsole\vico_new.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kscan.exe	duba_3_295.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\Frames\btn_reverse_normal.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\codecs\Real\cook.dll	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CommonCtl\btn_sound_hover.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CommonCtl\sliderbar_rightpart_center.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\VideoConsolePlugin.dll	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\Frames\btn_episode_hover.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\Frames\btn_fullshow_disable.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CommonCtl\sliderbar_slider_disable.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kdf.exe	duba_3_295.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CenterConsole\btn_gotop_disable.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\upload\downloaed_flag.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\upload\us_network_err.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\Frames\btn_down_pressed.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CommonCtl\btn_playerAdd_pressed.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\Frames\btn_play_hover.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\upload\btn_openfloder_pressed.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\window\btn_title_hover.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\Baofeng\BFVKanDianYing\IconWindowUI.dll	BFVCenter-y4bd[[AB013]].exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\Frames\btn_rotate_right_hover.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\Frames\btn_rotate_right_hover.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\icon\mp4.ico	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\SohuPlugin.dll	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CommonCtl\btn_soundless_normal.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\Frames\btn_down_pressed.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\Frames\btn_speedhide_hover.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CenterConsole\ToolBar_Spliter.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\window\btn_unstick_pressed.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\Frames\btn_rotate_left_pressed.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CommonCtl\scroll_sliderbg_normal.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CommonCtl\btn_soundless_pressed.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\window\r_min-nomal.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\window\win_normal_lb.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\Frames\btn_1x_disable.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CommonCtl\btn_maintap_normal.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CommonCtl\btn_maintap_sel.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\Frames\btn_tool_set_pressed.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\codecs\ijl15.dll	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\SoHuAutoDetector.dll	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\loading\gugao.swf	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\Frames\btn_hideconsole_hover.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\window\btn_stick_disable.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\window\btn_title_normal.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\upload\btn_pause_hover.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CommonCtl\cs_yuan.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\menu\middle_right.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CommonCtl\scroll_arrowleft_pressed.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CenterConsole\search_bk.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\SHControl.dll	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\uninstall\trash_scan.png	duba_3_295.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\window\btn_cycleplay_pressed.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 6 IoCs

installer

Processes:

resource	yara_rule
\Program Files\setup_30004.exe	nsis_installer_1
\Program Files\setup_30004.exe	nsis_installer_2
C:\Program Files\setup_30004.exe	nsis_installer_1
C:\Program Files\setup_30004.exe	nsis_installer_2
C:\Program Files\setup_30004.exe	nsis_installer_1
C:\Program Files\setup_30004.exe	nsis_installer_2

Modifies data under HKEY_USERS 43 IoCs

Processes:

kxescore.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	kxescore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	kxescore.exe

Modifies registry class 57 IoCs

Processes:

setup.exeduba_3_295.exeFileAssociationsTool.exekxescore.exekxetray.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1CF8F61-AB1D-11d4-ABBD-0050BACEC828}\ProcKey = "RzNBMlVLLUswUDBORC1MMEVGU1UtRkg1MzAw"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32	duba_3_295.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\duba_64bit\ = "{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}"	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\duba_32bit\ = "{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}"	duba_3_295.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1CF8F61-AB1D-11d4-ABBD-0050BACEC828}\RzNBMlVLLUswUDBORC1MMEVGU1UtRkg1MzAw\ProcKind = "5"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\duba_64bit\ = "{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}"	duba_3_295.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers\duba_32bit\ = "{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}"	duba_3_295.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idex = "e8a23e4d5e2051bd4d1fb1c2b298794b"	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1CF8F61-AB1D-11d4-ABBD-0050BACEC828}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SHPlayer.exe\shell\open\ = "使用搜狐影音播放"	FileAssociationsTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32\ThreadingModel = "Apartment"	duba_3_295.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers\duba_64bit\ = "{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}"	duba_3_295.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}\ = "CKavMenuShell Class"	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\duba_32bit	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}	duba_3_295.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32\ = "c:\\program files (x86)\\kingsoft\\kingsoft antivirus\\kavmenu64.dll"	duba_3_295.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idno = "1"	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SHPlayer.exe\shell	FileAssociationsTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\Shellex\ContextMenuHandlers\duba_64bit	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\Shellex\ContextMenuHandlers\duba_64bit	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers	duba_3_295.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\svrid	duba_3_295.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1CF8F61-AB1D-11d4-ABBD-0050BACEC828}\RzNBMlVLLUswUDBORC1MMEVGU1UtRkg1MzAw\ProcInfo = "1664765960"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1CF8F61-AB1D-11d4-ABBD-0050BACEC828}\RzNBMlVLLUswUDBORC1MMEVGU1UtRkg1MzAw\ProcDll = "1696388360"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SHPlayer.exe\ = "媒体文件"	FileAssociationsTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}\InprocServer32\ThreadingModel = "Apartment"	duba_3_295.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\duba_32bit\ = "{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}"	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\duba_32bit	duba_3_295.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\duba_32bit\ = "{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}"	duba_3_295.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idno = "0"	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers\duba_32bit	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SHPlayer.exe\shell\open	FileAssociationsTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SHPlayer.exe\shell\open\command\ = "\"C:\\Program Files (x86)\\搜狐影音\\SHPlayer.exe\" \"%1\""	FileAssociationsTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\duba_64bit\ = "{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}"	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers\duba_64bit	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	duba_3_295.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}\InprocServer32\ = "c:\\program files (x86)\\kingsoft\\kingsoft antivirus\\kavmenu.dll"	duba_3_295.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SHPlayer.exe\shell\ = "open"	FileAssociationsTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}\InprocServer32	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}	kxescore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SHPlayer.exe\shell\open\command	FileAssociationsTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\Shellex\ContextMenuHandlers\duba_64bit	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1CF8F61-AB1D-11d4-ABBD-0050BACEC828}\RzNBMlVLLUswUDBORC1MMEVGU1UtRkg1MzAw	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\duba_32bit	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}	kxetray.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SHPlayer.exe	FileAssociationsTool.exe

Suspicious behavior: EnumeratesProcesses 53 IoCs

Processes:

6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exeQQPCDownload72844.exeduba_3_295.exeSoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exekxescore.exeBFVCenter-y4bd[[AB013]].exe

pid	process
1912	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe
764	QQPCDownload72844.exe
764	QQPCDownload72844.exe
756	duba_3_295.exe
756	duba_3_295.exe
1648	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
1648	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
1648	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
1648	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
1648	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
1648	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
1648	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
1648	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
1648	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
1648	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
1648	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
1648	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
1648	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
1648	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
1648	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
1648	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
1648	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
1648	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
1956	kxescore.exe
1912	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe
268	BFVCenter-y4bd[[AB013]].exe
1956	kxescore.exe
1956	kxescore.exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe
268	BFVCenter-y4bd[[AB013]].exe

Suspicious behavior: LoadsDriver 2 IoCs

Processes:

pid process

460
460

pid	process
460
460

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

setup_30004.exe360se_nanaxt9.exeduba_3_295.exeBFVCenter-y4bd[[AB013]].exekislive.exekxescore.exe

description	pid	process
Token: SeDebugPrivilege	1236	setup_30004.exe
Token: 33	1956	360se_nanaxt9.exe
Token: SeIncBasePriorityPrivilege	1956	360se_nanaxt9.exe
Token: SeDebugPrivilege	756	duba_3_295.exe
Token: SeDebugPrivilege	268	BFVCenter-y4bd[[AB013]].exe
Token: SeDebugPrivilege	868	kislive.exe
Token: SeDebugPrivilege	1956	kxescore.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

QQPCDownload72844.exekxetray.exe

pid process

764 QQPCDownload72844.exe
2064 kxetray.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

QQPCDownload72844.exekxetray.exe

pid process

764 QQPCDownload72844.exe
2064 kxetray.exe

pid	process
764	QQPCDownload72844.exe
2064	kxetray.exe

pid	process
764	QQPCDownload72844.exe
2064	kxetray.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe360se_nanaxt9.exeduba_3_295.exekxetray.exerag1446260.exe

description	pid	process	target process
PID 1912 wrote to memory of 1236	1912	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	setup_30004.exe
PID 1912 wrote to memory of 1236	1912	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	setup_30004.exe
PID 1912 wrote to memory of 1236	1912	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	setup_30004.exe
PID 1912 wrote to memory of 1236	1912	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	setup_30004.exe
PID 1912 wrote to memory of 1236	1912	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	setup_30004.exe
PID 1912 wrote to memory of 1236	1912	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	setup_30004.exe
PID 1912 wrote to memory of 1236	1912	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	setup_30004.exe
PID 1912 wrote to memory of 764	1912	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	QQPCDownload72844.exe
PID 1912 wrote to memory of 764	1912	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	QQPCDownload72844.exe
PID 1912 wrote to memory of 764	1912	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	QQPCDownload72844.exe
PID 1912 wrote to memory of 764	1912	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	QQPCDownload72844.exe
PID 1912 wrote to memory of 1956	1912	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	360se_nanaxt9.exe
PID 1912 wrote to memory of 1956	1912	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	360se_nanaxt9.exe
PID 1912 wrote to memory of 1956	1912	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	360se_nanaxt9.exe
PID 1912 wrote to memory of 1956	1912	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	360se_nanaxt9.exe
PID 1912 wrote to memory of 1956	1912	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	360se_nanaxt9.exe
PID 1912 wrote to memory of 1956	1912	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	360se_nanaxt9.exe
PID 1912 wrote to memory of 1956	1912	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	360se_nanaxt9.exe
PID 1956 wrote to memory of 1492	1956	360se_nanaxt9.exe	setup.exe
PID 1956 wrote to memory of 1492	1956	360se_nanaxt9.exe	setup.exe
PID 1956 wrote to memory of 1492	1956	360se_nanaxt9.exe	setup.exe
PID 1956 wrote to memory of 1492	1956	360se_nanaxt9.exe	setup.exe
PID 1956 wrote to memory of 1492	1956	360se_nanaxt9.exe	setup.exe
PID 1956 wrote to memory of 1492	1956	360se_nanaxt9.exe	setup.exe
PID 1956 wrote to memory of 1492	1956	360se_nanaxt9.exe	setup.exe
PID 1912 wrote to memory of 756	1912	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	duba_3_295.exe
PID 1912 wrote to memory of 756	1912	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	duba_3_295.exe
PID 1912 wrote to memory of 756	1912	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	duba_3_295.exe
PID 1912 wrote to memory of 756	1912	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	duba_3_295.exe
PID 1912 wrote to memory of 268	1912	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	BFVCenter-y4bd[[AB013]].exe
PID 1912 wrote to memory of 268	1912	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	BFVCenter-y4bd[[AB013]].exe
PID 1912 wrote to memory of 268	1912	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	BFVCenter-y4bd[[AB013]].exe
PID 1912 wrote to memory of 268	1912	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	BFVCenter-y4bd[[AB013]].exe
PID 1912 wrote to memory of 1648	1912	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
PID 1912 wrote to memory of 1648	1912	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
PID 1912 wrote to memory of 1648	1912	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
PID 1912 wrote to memory of 1648	1912	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
PID 756 wrote to memory of 864	756	duba_3_295.exe	kavlog2.exe
PID 756 wrote to memory of 864	756	duba_3_295.exe	kavlog2.exe
PID 756 wrote to memory of 864	756	duba_3_295.exe	kavlog2.exe
PID 756 wrote to memory of 864	756	duba_3_295.exe	kavlog2.exe
PID 756 wrote to memory of 584	756	duba_3_295.exe	kxetray.exe
PID 756 wrote to memory of 584	756	duba_3_295.exe	kxetray.exe
PID 756 wrote to memory of 584	756	duba_3_295.exe	kxetray.exe
PID 756 wrote to memory of 584	756	duba_3_295.exe	kxetray.exe
PID 756 wrote to memory of 1816	756	duba_3_295.exe	kxescore.exe
PID 756 wrote to memory of 1816	756	duba_3_295.exe	kxescore.exe
PID 756 wrote to memory of 1816	756	duba_3_295.exe	kxescore.exe
PID 756 wrote to memory of 1816	756	duba_3_295.exe	kxescore.exe
PID 756 wrote to memory of 868	756	duba_3_295.exe	kislive.exe
PID 756 wrote to memory of 868	756	duba_3_295.exe	kislive.exe
PID 756 wrote to memory of 868	756	duba_3_295.exe	kislive.exe
PID 756 wrote to memory of 868	756	duba_3_295.exe	kislive.exe
PID 584 wrote to memory of 2064	584	kxetray.exe	kxetray.exe
PID 584 wrote to memory of 2064	584	kxetray.exe	kxetray.exe
PID 584 wrote to memory of 2064	584	kxetray.exe	kxetray.exe
PID 584 wrote to memory of 2064	584	kxetray.exe	kxetray.exe
PID 1912 wrote to memory of 2220	1912	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	rag1446260.exe
PID 1912 wrote to memory of 2220	1912	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	rag1446260.exe
PID 1912 wrote to memory of 2220	1912	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	rag1446260.exe
PID 1912 wrote to memory of 2220	1912	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	rag1446260.exe
PID 2220 wrote to memory of 2648	2220	rag1446260.exe	setup.exe
PID 2220 wrote to memory of 2648	2220	rag1446260.exe	setup.exe
PID 2220 wrote to memory of 2648	2220	rag1446260.exe	setup.exe

C:\Users\Admin\AppData\Local\Temp\6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe
"C:\Users\Admin\AppData\Local\Temp\6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1912

C:\Program Files\setup_30004.exe
"C:\Program Files\setup_30004.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1236

C:\Program Files\QQPCDownload72844.exe
"C:\Program Files\QQPCDownload72844.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:764

C:\Users\Admin\AppData\Roaming\tencent\QQPCMgr\Download\QQPCMgr_Setup.exe
"C:\Users\Admin\AppData\Roaming\tencent\QQPCMgr\Download\QQPCMgr_Setup.exe" /S ##silence=1&handle=328020&update=1&supply=72844&forceinstall=1&qqpcmgr=0&recommand=3&DefaultIE="http://www.hao123.com/?tn=90757827_hao_pg"
3⤵
PID:2008

C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~6cfe2e\TestMSVCR.exe
"C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~6cfe2e\TestMSVCR.exe" (null)
4⤵
PID:3496

C:\Program Files\360se_nanaxt9.exe
"C:\Program Files\360se_nanaxt9.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1956

C:\Users\Admin\AppData\Local\Temp\360se6CR_FA5E6.tmp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\360se6CR_FA5E6.tmp\setup.exe" --exe-path="C:\Program Files\360se_nanaxt9.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1492

C:\Program Files\duba_3_295.exe
"C:\Program Files\duba_3_295.exe"
2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Registers COM server for autorun
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:756

\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe
"c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe" /start kxescore
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1816

\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kislive.exe
"c:\program files (x86)\kingsoft\kingsoft antivirus\kislive.exe" /autorun /std /skipcs3
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:868

\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxetray.exe
"c:\program files (x86)\kingsoft\kingsoft antivirus\kxetray.exe" /autorun /hidefloatwin /silentinstrcmd
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:584

\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxetray.exe
"c:\program files (x86)\kingsoft\kingsoft antivirus\kxetray.exe" /autorun /hidefloatwin /silentinstrcmd
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2064

\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kwsprotect64.exe
"kwsprotect64.exe" (null)
5⤵
PID:2660

\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kavlog2.exe
"c:\program files (x86)\kingsoft\kingsoft antivirus\kavlog2.exe" -install
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:864

C:\Program Files\BFVCenter-y4bd[[AB013]].exe
"C:\Program Files\BFVCenter-y4bd[[AB013]].exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:268

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s "C:\Program Files (x86)\Baofeng\BFVKanDianYing\npBFVWebPlugin.dll"
3⤵
PID:2508

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s "C:\Program Files (x86)\Baofeng\BFVKanDianYing\npBFVWebPlugin64.dll"
3⤵
PID:2536

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\Baofeng\BFVKanDianYing\npBFVWebPlugin64.dll"
4⤵
PID:2748

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s "C:\Program Files (x86)\Baofeng\BFVKanDianYing\UGCFlash.dll"
3⤵
PID:2444

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s "C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFVShellIcon64.dll"
3⤵
PID:2724

C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFVServer.exe
"C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFVServer.exe" /Module="AllTask" /From="Install"
3⤵
PID:3780

C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFVDesktop.exe
"C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFVDesktop.exe" /Run=0 /From=2
3⤵
PID:3880

C:\Program Files (x86)\Baofeng\BFVKanDianYing\HistoryConverter.exe
"C:\Program Files (x86)\Baofeng\BFVKanDianYing\HistoryConverter.exe"
3⤵
PID:4008

C:\Program Files\SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
"C:\Program Files\SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1648

C:\Program Files (x86)\搜狐影音\FileAssociationsTool.exe
"C:\Program Files (x86)\搜狐影音\FileAssociationsTool.exe" /PreventPinning "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\搜狐影音\卸载搜狐影音.lnk"
3⤵
- Executes dropped EXE
- Modifies registry class
PID:2852

C:\Program Files (x86)\搜狐影音\FileAssociationsTool.exe
"C:\Program Files (x86)\搜狐影音\FileAssociationsTool.exe" /ModifyTaskbar "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\搜狐影音.lnk"
3⤵
PID:3036

C:\Program Files (x86)\搜狐影音\FileAssociationsTool.exe
"C:\Program Files (x86)\搜狐影音\FileAssociationsTool.exe" /EnableAutoRun
3⤵
PID:1332

C:\Program Files (x86)\搜狐影音\FileAssociationsTool.exe
"C:\Program Files (x86)\搜狐影音\FileAssociationsTool.exe" /ModifyMainShortcut
3⤵
PID:2136

C:\Program Files (x86)\搜狐影音\FileAssociationsTool.exe
"C:\Program Files (x86)\搜狐影音\FileAssociationsTool.exe" /F
3⤵
PID:1484

C:\Program Files (x86)\搜狐影音\FileAssociationsTool.exe
"C:\Program Files (x86)\搜狐影音\FileAssociationsTool.exe" /TIFOX
3⤵
PID:2144

C:\Program Files (x86)\搜狐影音\FileAssociationsTool.exe
"C:\Program Files (x86)\搜狐影音\FileAssociationsTool.exe" /ChangeSohuVARunToSHplayerRun
3⤵
PID:2192

C:\Program Files (x86)\搜狐影音\FileAssociationsTool.exe
"C:\Program Files (x86)\搜狐影音\FileAssociationsTool.exe" /ReleaseSWF
3⤵
PID:2280

C:\Program Files (x86)\搜狐影音\FileAssociationsTool.exe
"C:\Program Files (x86)\搜狐影音\FileAssociationsTool.exe" /InstallSuccess 0
3⤵
PID:2396

C:\Program Files (x86)\搜狐影音\SHRes.exe
"C:\Program Files (x86)\搜狐影音\SHRes.exe" /RegServer
3⤵
PID:2176

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s "C:\Program Files (x86)\搜狐影音\SoHuAutoDetector.dll"
3⤵
PID:2780

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s "C:\Program Files (x86)\搜狐影音\SHUploadFile.dll"
3⤵
PID:2784

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s "C:\Program Files (x86)\搜狐影音\SohuDetector.dll"
3⤵
PID:2936

C:\Program Files (x86)\搜狐影音\SHPlayer.exe
"C:\Program Files (x86)\搜狐影音\SHPlayer.exe" /auto
3⤵
PID:3008

C:\Program Files (x86)\搜狐影音\SohuVA.exe
"C:\Program Files (x86)\搜狐影音\SohuVA.exe"
3⤵
PID:2304

C:\Program Files\rag1446260.exe
"C:\Program Files\rag1446260.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220

C:\Users\Admin\AppData\Local\Temp\RsdSfxTmp\setup.exe
C:\Users\Admin\AppData\Local\Temp\RsdSfxTmp\setup.exe /S
3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Modifies registry class
PID:2648

C:\Program Files (x86)\Rising\RSD\popwndexe.exe
"C:\Program Files (x86)\Rising\RSD\popwndexe.exe"
4⤵
PID:2784

C:\Program Files (x86)\Rising\RAG\tray.exe
"C:\Program Files (x86)\Rising\RAG\tray.exe" -system
4⤵
PID:3016

C:\Program Files (x86)\Rising\RAG\tray_proxy(5941).exe
"C:\Program Files (x86)\Rising\RAG\tray_proxy(5941).exe" -system
5⤵
PID:864

C:\Program Files (x86)\Rising\RSD\rsstub.exe
/update /subkey RAG /lang 936 /silence
6⤵
PID:2880

\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe
"c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe" /service kxescore
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1956

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFVShellIcon64.dll"
1⤵
PID:612

C:\Program Files (x86)\Rising\RSD\RsMgrSvc.exe
"C:\Program Files (x86)\Rising\RSD\RsMgrSvc.exe"
1⤵
PID:2284

C:\Program Files (x86)\Rising\RSD\updater.exe
"C:\Program Files (x86)\Rising\RSD\updater.exe" /silence /lang 936 /subkey RAG
2⤵
PID:2192

C:\Program Files (x86)\搜狐影音\SHRes.exe
"C:\Program Files (x86)\搜狐影音\SHRes.exe" -Embedding
1⤵
PID:2280

C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFVServer.exe
"C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFVServer.exe" /Module="ShellRun"
1⤵
PID:2116

C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFDownloadProc.exe
"C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFDownloadProc.exe"
2⤵
PID:1020

C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFVDesktop.exe
"C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFVDesktop.exe" /Run=0 /From=1
1⤵
PID:3552

C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFVServer.exe
"C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFVServer.exe" /Module="DesktopNoUI"
2⤵
PID:3712

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Bootkit

T1067

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Security Software Discovery

T1063

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\kingsoft\kingsoft antivirus\kavlog2.exe
Filesize
511KB

MD5
dd1443f153f7cf554addb404aff623f8

SHA1
893f24f463d03b3b19e952b85ae06daffcc466d1

SHA256
b943b7e8cdb2decca1eaf2db1683a670fc72024be8eb95f9308adec8abc50887

SHA512
6fc1062f258684a20fce9fff8cf0ee88218aca1bb2e65c4a07f6ac7624fc1536e267538ec35f37d2356eec37258f29c13203d55a6e477d1231a5f5e8e6cd19bd

Download Submit
C:\Program Files (x86)\kingsoft\kingsoft antivirus\kislive.exe
Filesize
1.1MB

MD5
04eeb71a179940aca8073ddaa5bf4350

SHA1
02f7c99c4a2784b2db466b20c6e9c02cccc733b6

SHA256
acd8f6de1355fa40d4703149eeae1887c3f4ee0474f65c7aa257db38924e1385

SHA512
049a164a916863f037f88288faab7ce6f92d555fac4e819d6b79ed787c583f0a0d821ef173440c481f4d2a39ee1547437c6471e2e2b37cf53ad6701ede452f21

Download Submit
C:\Program Files (x86)\kingsoft\kingsoft antivirus\kxescore.exe
Filesize
277KB

MD5
479263a138a81ac646a04a7ca1060821

SHA1
7bdd2ab8f03fd82d9c8e4e3c9af9ea1a365cd6d3

SHA256
bcd9860da984d0cf04a7ddbe7586c9b0d7207864abe203e80ade6f386d83b36d

SHA512
136121c3f1db93788021e910df1308ced47072a2a076e6d68773a5a1795ca62a075bf3d21dd318ce185dc7ddb6336c5300a71866f5c32f64a69e80931dea63d7

Download Submit
C:\Program Files (x86)\kingsoft\kingsoft antivirus\kxescore.exe
Filesize
277KB

MD5
479263a138a81ac646a04a7ca1060821

SHA1
7bdd2ab8f03fd82d9c8e4e3c9af9ea1a365cd6d3

SHA256
bcd9860da984d0cf04a7ddbe7586c9b0d7207864abe203e80ade6f386d83b36d

SHA512
136121c3f1db93788021e910df1308ced47072a2a076e6d68773a5a1795ca62a075bf3d21dd318ce185dc7ddb6336c5300a71866f5c32f64a69e80931dea63d7

Download Submit
C:\Program Files (x86)\kingsoft\kingsoft antivirus\kxetray.exe
Filesize
1.4MB

MD5
cee09dac2393fb81c34ea3c5ced75d31

SHA1
e2d5c7720c65b4dcd7f740104fc9f8890b68a494

SHA256
156920cf11f82d22ef2339b4a9525b2905ee496be6630c2a926eef39c3c77570

SHA512
c4710de9bc6c9f8c37ceebd600a9e9ac7c6c9dfa60d24ef4f36374cff3dc4054e6ca99e5ea9c41eed70d772d1acebf7da9ebd3b8c9ff93bcecacc8099554574f

Download Submit
C:\Program Files\360se_nanaxt9.exe
Filesize
25.3MB

MD5
fa129e1b7e66dc8f0b05ab8fd2dec7ca

SHA1
961eb8011bbb0f45e39956edf285f68b342637b5

SHA256
695cc7294d59e530bcf4d27518dff2dfae965139956bf118905d853b27d16e65

SHA512
a9186b4bdbd17459107b7ae3dd3cd3ceb454d98cd54d470e6abe981550495b8ad6eae52f076e09d34e4fd02421f4a264ffc7ccb486f9d1eaf6ad38b5290f34bb

Download Submit
C:\Program Files\360se_nanaxt9.exe
Filesize
25.3MB

MD5
fa129e1b7e66dc8f0b05ab8fd2dec7ca

SHA1
961eb8011bbb0f45e39956edf285f68b342637b5

SHA256
695cc7294d59e530bcf4d27518dff2dfae965139956bf118905d853b27d16e65

SHA512
a9186b4bdbd17459107b7ae3dd3cd3ceb454d98cd54d470e6abe981550495b8ad6eae52f076e09d34e4fd02421f4a264ffc7ccb486f9d1eaf6ad38b5290f34bb

Download Submit
C:\Program Files\BFVCenter-y4bd[[AB013]].exe
Filesize
6.5MB

MD5
e005aa1806b9f4b59d382535f9a22e56

SHA1
f010d5342ee42b2fd6897a3f03d7282ddadc7547

SHA256
515db6ce7c3fa8366fda9650a30c958cedd76fd252179c9ae6f44bb7a462d508

SHA512
a10a4bd10d7e944f28a3c7004e977455bd0abb0b11475dafe24fcc75d6d6e65be6350a3655732b1f569170d89a4d5e838f5ef6a2dd0c272b73522039cbff46ff

Download Submit
C:\Program Files\QQPCDownload72844.exe
Filesize
1.4MB

MD5
e948aaa5b0102fb00ee1706e2d25f3fa

SHA1
52c612c67a64428f73d58c91dc7134f0fec5bc8e

SHA256
c2375af1c6f99100952f95d47790819f3c2aac33f1b25b3a046c8354306700fb

SHA512
27e8119e7d295041bfd2a26435fef081964077a7460584b28a9349ca42a2cbee0d689ce1e22a2b7b91c039d54360f12dc032101ccec5db6d15e33e37c6289c62

Download Submit
C:\Program Files\QQPCDownload72844.exe
Filesize
1.4MB

MD5
e948aaa5b0102fb00ee1706e2d25f3fa

SHA1
52c612c67a64428f73d58c91dc7134f0fec5bc8e

SHA256
c2375af1c6f99100952f95d47790819f3c2aac33f1b25b3a046c8354306700fb

SHA512
27e8119e7d295041bfd2a26435fef081964077a7460584b28a9349ca42a2cbee0d689ce1e22a2b7b91c039d54360f12dc032101ccec5db6d15e33e37c6289c62

Download Submit
C:\Program Files\SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
Filesize
16.0MB

MD5
4ca9c323294a61f85d7f272de3c9fdfe

SHA1
ac19c4a07ac58c74d1f5e8640d247affa9f2bef3

SHA256
81195b7a7d9b33c4cc75c4a58ab2ea0c68acb151e0fc6635aab4f6ce30cf3102

SHA512
b3d43fde85a5c40b07e561ce136a00521165feefe7b582a90afdfd94b5104fa2d2830cb7bd881002e4934e2335c74d0949156b8e6dabbb0e800724c6aec7cf70

Download Submit
C:\Program Files\duba_3_295.exe
Filesize
17.3MB

MD5
61d05e0ec49e0113c9b179a75f8721b0

SHA1
1b4a94a327df622e38218cccc036044fe91c5e99

SHA256
cdab7deb216875304970d76d55086a277cac500ad4d760c544d38b7b70fb7222

SHA512
f9215882254cd956802e2bdfb1acd7be0747456ff65bb1acd37d9c89bf9a1a4638ba7f4ac9c2786ef883446417e4b856fa93189b608e8b55bf5f0f892026cdca

Download Submit
C:\Program Files\duba_3_295.exe
Filesize
17.3MB

MD5
61d05e0ec49e0113c9b179a75f8721b0

SHA1
1b4a94a327df622e38218cccc036044fe91c5e99

SHA256
cdab7deb216875304970d76d55086a277cac500ad4d760c544d38b7b70fb7222

SHA512
f9215882254cd956802e2bdfb1acd7be0747456ff65bb1acd37d9c89bf9a1a4638ba7f4ac9c2786ef883446417e4b856fa93189b608e8b55bf5f0f892026cdca

Download Submit
C:\Program Files\setup_30004.exe
Filesize
630KB

MD5
272edafd76205919cd3f5218cd14d247

SHA1
6a45cf0768211067a5924dc8cc1555a4ccc6831a

SHA256
73b2afe10f7935444a1712d94765f5f762a0dddbbb09353a0f605376696a1546

SHA512
357cb57d6658b3b8632e9e8564b5b3ccafb0703ac0d4d0c1f0e5fb040db7829108f93d2c6f28cd73878a598d54924977a75d120fffc91d46c153d5ec229de4f2

Download Submit
C:\Program Files\setup_30004.exe
Filesize
630KB

MD5
272edafd76205919cd3f5218cd14d247

SHA1
6a45cf0768211067a5924dc8cc1555a4ccc6831a

SHA256
73b2afe10f7935444a1712d94765f5f762a0dddbbb09353a0f605376696a1546

SHA512
357cb57d6658b3b8632e9e8564b5b3ccafb0703ac0d4d0c1f0e5fb040db7829108f93d2c6f28cd73878a598d54924977a75d120fffc91d46c153d5ec229de4f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\360se6CR_FA5E6.tmp\setup.exe
Filesize
1.8MB

MD5
42043d782d0a5411a2617d74163f1580

SHA1
bc1d19785ae3042254f7852d63e9ee341bcc96a6

SHA256
4044e4624ef67cfbba14dea9354fcae4b2723f5514d01e89d776659d0372d58e

SHA512
4e56c30fee1cbdc577c2a1632df6b8805a33e0124532db309da7f5bc94b8a0c071c0c402a84cd78cfff57b73e5fd61d8d33fee361a9867619f4348f39727506e

Download Submit
C:\Users\Admin\AppData\Local\Temp\360se6CR_FA5E6.tmp\setup.exe
Filesize
1.8MB

MD5
42043d782d0a5411a2617d74163f1580

SHA1
bc1d19785ae3042254f7852d63e9ee341bcc96a6

SHA256
4044e4624ef67cfbba14dea9354fcae4b2723f5514d01e89d776659d0372d58e

SHA512
4e56c30fee1cbdc577c2a1632df6b8805a33e0124532db309da7f5bc94b8a0c071c0c402a84cd78cfff57b73e5fd61d8d33fee361a9867619f4348f39727506e

Download Submit
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\MSVCP80.dll
Filesize
536KB

MD5
4c8a880eabc0b4d462cc4b2472116ea1

SHA1
d0a27f553c0fe0e507c7df079485b601d5b592e6

SHA256
2026f3c4f830dff6883b88e2647272a52a132f25eb42c0d423e36b3f65a94d08

SHA512
6a6cce8c232f46dab9b02d29be5e0675cc1e968e9c2d64d0abc008d20c0a7baeb103a5b1d9b348fa1c4b3af9797dbcb6e168b14b545fb15c2ccd926c3098c31c

Download Submit
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\MSVCR80.dll
Filesize
612KB

MD5
e4fece18310e23b1d8fee993e35e7a6f

SHA1
9fd3a7f0522d36c2bf0e64fc510c6eea3603b564

SHA256
02bdde38e4c6bd795a092d496b8d6060cdbe71e22ef4d7a204e3050c1be44fa9

SHA512
2fb5f8d63a39ba5e93505df3a643d14e286fe34b11984cbed4b88e8a07517c03efb3a7bf9d61cf1ec73b0a20d83f9e6068e61950a61d649b8d36082bb034ddfc

Download Submit
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\operation\cas\kfmt.datx
Filesize
157KB

MD5
a965a83cea91aea3d44a52b35c17aa8d

SHA1
afd5212f408012f3ee7847a15f0d3de0db093ed2

SHA256
8caf49e6f2297796c83a248999ced214289a91b0ab3a4d468e2a2d0a6f1bfa1d

SHA512
8acafa6b7a66be073060070985a2295c8ae10f8b388bcb8a81f625e7ea741befb45a2100ace858421bc2a7cff1b737994ee507b66f0dbf0579cc76456c17c05d

Download Submit
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\operation\cas\kinfoc.dll
Filesize
166KB

MD5
170899a660d5d4a350edf80c77334136

SHA1
8119313e8a998ad83ee6a13ef88b6fa1c2a0fcae

SHA256
3672f758b4e875a66b2d95721c89a5ddd7d0eef27b10db254f321041c9f6cf43

SHA512
a87f2fe159f5cae36feda263f10473c7a0df0ddb5c4b82ded1d55b43d4223a4d03ce2a5b7254400d89cff2583f28c793dad2e8cc19cf98a54c42644f08ff7fd3

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kavlog2.exe
Filesize
511KB

MD5
dd1443f153f7cf554addb404aff623f8

SHA1
893f24f463d03b3b19e952b85ae06daffcc466d1

SHA256
b943b7e8cdb2decca1eaf2db1683a670fc72024be8eb95f9308adec8abc50887

SHA512
6fc1062f258684a20fce9fff8cf0ee88218aca1bb2e65c4a07f6ac7624fc1536e267538ec35f37d2356eec37258f29c13203d55a6e477d1231a5f5e8e6cd19bd

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kavlog2.exe
Filesize
511KB

MD5
dd1443f153f7cf554addb404aff623f8

SHA1
893f24f463d03b3b19e952b85ae06daffcc466d1

SHA256
b943b7e8cdb2decca1eaf2db1683a670fc72024be8eb95f9308adec8abc50887

SHA512
6fc1062f258684a20fce9fff8cf0ee88218aca1bb2e65c4a07f6ac7624fc1536e267538ec35f37d2356eec37258f29c13203d55a6e477d1231a5f5e8e6cd19bd

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kavmenu.dll
Filesize
69KB

MD5
c8ed4b3af03d82cc3fe2f8c42c22326c

SHA1
78a2e216262b8f1b35e408685cf20f2fa4685d8f

SHA256
1c73f57c31845d3719644f815ca9df1efb18cfc3dfc2dc1b4afddb71261afb31

SHA512
34e6cf09afa68875be24005f90be35bb7c490ac9d2f63befadfdd1902136c383ee903442c9df572e2ccd0b7ea1be10857401c76c5b6923c28f8eaecab5b3c45c

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kislive.exe
Filesize
1.1MB

MD5
04eeb71a179940aca8073ddaa5bf4350

SHA1
02f7c99c4a2784b2db466b20c6e9c02cccc733b6

SHA256
acd8f6de1355fa40d4703149eeae1887c3f4ee0474f65c7aa257db38924e1385

SHA512
049a164a916863f037f88288faab7ce6f92d555fac4e819d6b79ed787c583f0a0d821ef173440c481f4d2a39ee1547437c6471e2e2b37cf53ad6701ede452f21

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kislive.exe
Filesize
1.1MB

MD5
04eeb71a179940aca8073ddaa5bf4350

SHA1
02f7c99c4a2784b2db466b20c6e9c02cccc733b6

SHA256
acd8f6de1355fa40d4703149eeae1887c3f4ee0474f65c7aa257db38924e1385

SHA512
049a164a916863f037f88288faab7ce6f92d555fac4e819d6b79ed787c583f0a0d821ef173440c481f4d2a39ee1547437c6471e2e2b37cf53ad6701ede452f21

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kismain.exe
Filesize
337KB

MD5
bb1ce6771f3bdfa3db16106e6802cf45

SHA1
9303e90c1782df8dd383ae75235e400e4a75df25

SHA256
b30440a7fe3f2cef818e9769df7aea5af5bd150058630299c34836f0eeec0270

SHA512
d412665027d7ad1b110a9e62b8ef2d1ab500b559865bb2cfa6584347993bb1e5634e442b158b3a8cbbf2df62d5ccd81714ac3e7f97246aca7b700991147893c2

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kismain.exe
Filesize
337KB

MD5
bb1ce6771f3bdfa3db16106e6802cf45

SHA1
9303e90c1782df8dd383ae75235e400e4a75df25

SHA256
b30440a7fe3f2cef818e9769df7aea5af5bd150058630299c34836f0eeec0270

SHA512
d412665027d7ad1b110a9e62b8ef2d1ab500b559865bb2cfa6584347993bb1e5634e442b158b3a8cbbf2df62d5ccd81714ac3e7f97246aca7b700991147893c2

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\krecycle.exe
Filesize
495KB

MD5
c423991edd1e101d7c1aa7f2fe5d6670

SHA1
1f19d1c7e6f9189b2cdc875cc4b5c9afcf976e51

SHA256
f6cf76ca159237d0661b94d49d50657363db2df2f1b15188a60ef207c09a9ca4

SHA512
73640c9f8342ba3d51649726e85bad9510860ca836f8de21df27d9163ae0a6092a66fe8b10c3870f1ec3084a5ea1cb2917af50572b865a15d8faa8306fb9df9f

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kxescore.exe
Filesize
277KB

MD5
479263a138a81ac646a04a7ca1060821

SHA1
7bdd2ab8f03fd82d9c8e4e3c9af9ea1a365cd6d3

SHA256
bcd9860da984d0cf04a7ddbe7586c9b0d7207864abe203e80ade6f386d83b36d

SHA512
136121c3f1db93788021e910df1308ced47072a2a076e6d68773a5a1795ca62a075bf3d21dd318ce185dc7ddb6336c5300a71866f5c32f64a69e80931dea63d7

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kxescore.exe
Filesize
277KB

MD5
479263a138a81ac646a04a7ca1060821

SHA1
7bdd2ab8f03fd82d9c8e4e3c9af9ea1a365cd6d3

SHA256
bcd9860da984d0cf04a7ddbe7586c9b0d7207864abe203e80ade6f386d83b36d

SHA512
136121c3f1db93788021e910df1308ced47072a2a076e6d68773a5a1795ca62a075bf3d21dd318ce185dc7ddb6336c5300a71866f5c32f64a69e80931dea63d7

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kxetray.exe
Filesize
1.4MB

MD5
cee09dac2393fb81c34ea3c5ced75d31

SHA1
e2d5c7720c65b4dcd7f740104fc9f8890b68a494

SHA256
156920cf11f82d22ef2339b4a9525b2905ee496be6630c2a926eef39c3c77570

SHA512
c4710de9bc6c9f8c37ceebd600a9e9ac7c6c9dfa60d24ef4f36374cff3dc4054e6ca99e5ea9c41eed70d772d1acebf7da9ebd3b8c9ff93bcecacc8099554574f

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kxetray.exe
Filesize
1.4MB

MD5
cee09dac2393fb81c34ea3c5ced75d31

SHA1
e2d5c7720c65b4dcd7f740104fc9f8890b68a494

SHA256
156920cf11f82d22ef2339b4a9525b2905ee496be6630c2a926eef39c3c77570

SHA512
c4710de9bc6c9f8c37ceebd600a9e9ac7c6c9dfa60d24ef4f36374cff3dc4054e6ca99e5ea9c41eed70d772d1acebf7da9ebd3b8c9ff93bcecacc8099554574f

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\msvcp80.dll
Filesize
536KB

MD5
4c8a880eabc0b4d462cc4b2472116ea1

SHA1
d0a27f553c0fe0e507c7df079485b601d5b592e6

SHA256
2026f3c4f830dff6883b88e2647272a52a132f25eb42c0d423e36b3f65a94d08

SHA512
6a6cce8c232f46dab9b02d29be5e0675cc1e968e9c2d64d0abc008d20c0a7baeb103a5b1d9b348fa1c4b3af9797dbcb6e168b14b545fb15c2ccd926c3098c31c

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\msvcp80.dll
Filesize
536KB

MD5
4c8a880eabc0b4d462cc4b2472116ea1

SHA1
d0a27f553c0fe0e507c7df079485b601d5b592e6

SHA256
2026f3c4f830dff6883b88e2647272a52a132f25eb42c0d423e36b3f65a94d08

SHA512
6a6cce8c232f46dab9b02d29be5e0675cc1e968e9c2d64d0abc008d20c0a7baeb103a5b1d9b348fa1c4b3af9797dbcb6e168b14b545fb15c2ccd926c3098c31c

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\msvcr80.dll
Filesize
612KB

MD5
e4fece18310e23b1d8fee993e35e7a6f

SHA1
9fd3a7f0522d36c2bf0e64fc510c6eea3603b564

SHA256
02bdde38e4c6bd795a092d496b8d6060cdbe71e22ef4d7a204e3050c1be44fa9

SHA512
2fb5f8d63a39ba5e93505df3a643d14e286fe34b11984cbed4b88e8a07517c03efb3a7bf9d61cf1ec73b0a20d83f9e6068e61950a61d649b8d36082bb034ddfc

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\msvcr80.dll
Filesize
612KB

MD5
e4fece18310e23b1d8fee993e35e7a6f

SHA1
9fd3a7f0522d36c2bf0e64fc510c6eea3603b564

SHA256
02bdde38e4c6bd795a092d496b8d6060cdbe71e22ef4d7a204e3050c1be44fa9

SHA512
2fb5f8d63a39ba5e93505df3a643d14e286fe34b11984cbed4b88e8a07517c03efb3a7bf9d61cf1ec73b0a20d83f9e6068e61950a61d649b8d36082bb034ddfc

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\operation\cas\kinfoc.dll
Filesize
166KB

MD5
170899a660d5d4a350edf80c77334136

SHA1
8119313e8a998ad83ee6a13ef88b6fa1c2a0fcae

SHA256
3672f758b4e875a66b2d95721c89a5ddd7d0eef27b10db254f321041c9f6cf43

SHA512
a87f2fe159f5cae36feda263f10473c7a0df0ddb5c4b82ded1d55b43d4223a4d03ce2a5b7254400d89cff2583f28c793dad2e8cc19cf98a54c42644f08ff7fd3

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\security\ksde\kisknl.sys
Filesize
259KB

MD5
1636dd864151388451acb8b2fc1fccb8

SHA1
06e3ac51140a1f7c35f79f8c69e997919838bd01

SHA256
859bdfd8e8f067c3d2328e3cc910d906d07298fd2a5ffc9e89f22df61c499126

SHA512
694911e645fc982ec31aba9283c5e247a93d05b378a3e6eee1374d7f405257bef0e665f58fe29f1dd8417169373a772b6015548c1dc4643266a457b283dcaf10

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\security\ksde\kisknl.sys
Filesize
259KB

MD5
1636dd864151388451acb8b2fc1fccb8

SHA1
06e3ac51140a1f7c35f79f8c69e997919838bd01

SHA256
859bdfd8e8f067c3d2328e3cc910d906d07298fd2a5ffc9e89f22df61c499126

SHA512
694911e645fc982ec31aba9283c5e247a93d05b378a3e6eee1374d7f405257bef0e665f58fe29f1dd8417169373a772b6015548c1dc4643266a457b283dcaf10

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\uni0nst.exe
Filesize
842KB

MD5
c833984034607e01850987d075f4c3b9

SHA1
c5cb941666198a1678c88faf22be0a1b0b007813

SHA256
c6027958286a3f1a0e5ff5e104d461c6a1df7e1d0a828ab78fffa506ee2cc294

SHA512
918e3fee2fae74e8f278277774d8237c658b3d7c994ec20640c81667e66671a3029bdf7ff8e9fcfdbff8f1b2d8f98bd5492d5a3200d516a47db19a2ecce72d59

Download Submit
\Program Files\360se_nanaxt9.exe
Filesize
25.3MB

MD5
fa129e1b7e66dc8f0b05ab8fd2dec7ca

SHA1
961eb8011bbb0f45e39956edf285f68b342637b5

SHA256
695cc7294d59e530bcf4d27518dff2dfae965139956bf118905d853b27d16e65

SHA512
a9186b4bdbd17459107b7ae3dd3cd3ceb454d98cd54d470e6abe981550495b8ad6eae52f076e09d34e4fd02421f4a264ffc7ccb486f9d1eaf6ad38b5290f34bb

Download Submit
\Program Files\360se_nanaxt9.exe
Filesize
25.3MB

MD5
fa129e1b7e66dc8f0b05ab8fd2dec7ca

SHA1
961eb8011bbb0f45e39956edf285f68b342637b5

SHA256
695cc7294d59e530bcf4d27518dff2dfae965139956bf118905d853b27d16e65

SHA512
a9186b4bdbd17459107b7ae3dd3cd3ceb454d98cd54d470e6abe981550495b8ad6eae52f076e09d34e4fd02421f4a264ffc7ccb486f9d1eaf6ad38b5290f34bb

Download Submit
\Program Files\BFVCenter-y4bd[[AB013]].exe
Filesize
6.5MB

MD5
e005aa1806b9f4b59d382535f9a22e56

SHA1
f010d5342ee42b2fd6897a3f03d7282ddadc7547

SHA256
515db6ce7c3fa8366fda9650a30c958cedd76fd252179c9ae6f44bb7a462d508

SHA512
a10a4bd10d7e944f28a3c7004e977455bd0abb0b11475dafe24fcc75d6d6e65be6350a3655732b1f569170d89a4d5e838f5ef6a2dd0c272b73522039cbff46ff

Download Submit
\Program Files\QQPCDownload72844.exe
Filesize
1.4MB

MD5
e948aaa5b0102fb00ee1706e2d25f3fa

SHA1
52c612c67a64428f73d58c91dc7134f0fec5bc8e

SHA256
c2375af1c6f99100952f95d47790819f3c2aac33f1b25b3a046c8354306700fb

SHA512
27e8119e7d295041bfd2a26435fef081964077a7460584b28a9349ca42a2cbee0d689ce1e22a2b7b91c039d54360f12dc032101ccec5db6d15e33e37c6289c62

Download Submit
\Program Files\SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
Filesize
16.0MB

MD5
4ca9c323294a61f85d7f272de3c9fdfe

SHA1
ac19c4a07ac58c74d1f5e8640d247affa9f2bef3

SHA256
81195b7a7d9b33c4cc75c4a58ab2ea0c68acb151e0fc6635aab4f6ce30cf3102

SHA512
b3d43fde85a5c40b07e561ce136a00521165feefe7b582a90afdfd94b5104fa2d2830cb7bd881002e4934e2335c74d0949156b8e6dabbb0e800724c6aec7cf70

Download Submit
\Program Files\duba_3_295.exe
Filesize
17.3MB

MD5
61d05e0ec49e0113c9b179a75f8721b0

SHA1
1b4a94a327df622e38218cccc036044fe91c5e99

SHA256
cdab7deb216875304970d76d55086a277cac500ad4d760c544d38b7b70fb7222

SHA512
f9215882254cd956802e2bdfb1acd7be0747456ff65bb1acd37d9c89bf9a1a4638ba7f4ac9c2786ef883446417e4b856fa93189b608e8b55bf5f0f892026cdca

Download Submit
\Program Files\setup_30004.exe
Filesize
630KB

MD5
272edafd76205919cd3f5218cd14d247

SHA1
6a45cf0768211067a5924dc8cc1555a4ccc6831a

SHA256
73b2afe10f7935444a1712d94765f5f762a0dddbbb09353a0f605376696a1546

SHA512
357cb57d6658b3b8632e9e8564b5b3ccafb0703ac0d4d0c1f0e5fb040db7829108f93d2c6f28cd73878a598d54924977a75d120fffc91d46c153d5ec229de4f2

Download Submit
\ProgramData\Baofeng\BFVKanDianYing\Profiles\temp\360ini.dll
Filesize
2.3MB

MD5
34f1d27d71ca894fdf587dbfb7aa52bd

SHA1
b1ad562154cf347fc3748e0c3a0eb7f8ff54e049

SHA256
7006e0c9157833fefa08ad2a4a5c11d4de43ae75a156a2a642822bd67598f7ea

SHA512
e24e557e6abec9a713dc0f2b4da960aeab9baf58003bb9adf50cf9bb220b58f6a0b566dec2920cb49371ce5d8603fdaa36d68247e1c1a95ff6ca41ed4cd73613

Download Submit
\Users\Admin\AppData\Local\Temp\360se6CR_FA5E6.tmp\setup.exe
Filesize
1.8MB

MD5
42043d782d0a5411a2617d74163f1580

SHA1
bc1d19785ae3042254f7852d63e9ee341bcc96a6

SHA256
4044e4624ef67cfbba14dea9354fcae4b2723f5514d01e89d776659d0372d58e

SHA512
4e56c30fee1cbdc577c2a1632df6b8805a33e0124532db309da7f5bc94b8a0c071c0c402a84cd78cfff57b73e5fd61d8d33fee361a9867619f4348f39727506e

Download Submit
\Users\Admin\AppData\Local\Temp\TencentDownload\~6c2a7b\QQPCDownload.dll
Filesize
1.1MB

MD5
f96c6ba297f9060ae99ae771a5a2758a

SHA1
d6152884fd74a62c6374b4d9a042f01830b788c0

SHA256
663e6203632b60544f10f35b21c7638e40c34b099f9ba2690ac96f3a5bcaf1e9

SHA512
8c9d28d9fc7d31e20a39c32cb9d0432d3a91eadd7942b73f7df73b82a12a2f79a5c18e58b70f42c952249cd635293a177dd656e12903dc00125769d04c13fc3e

Download Submit
\Users\Admin\AppData\Local\Temp\TencentDownload\~6c2a7b\qmdr\dr.dll
Filesize
73KB

MD5
4f53e6f3881ff3e1ee1cc0dc0561410f

SHA1
31388b4d64164eaa5b79ee30bf22840f6b5955a2

SHA256
967bfd76354486919fd252a8bcb3d787af495a0a58bfb8a216b3776cdc2dfc43

SHA512
a652d85e36143e45bafc105f7f385b1dfa25cc83d7bb1c2b167999ec95f4dd27fc43ea91e14abc26f78395a202159807dbfd85394b30061b64fea285aab64921

Download Submit
\Users\Admin\AppData\Local\Temp\nst27BF.tmp\System.dll
Filesize
11KB

MD5
a436db0c473a087eb61ff5c53c34ba27

SHA1
65ea67e424e75f5065132b539c8b2eda88aa0506

SHA256
75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49

SHA512
908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

Download Submit
\Users\Admin\AppData\Local\Temp\nst27BF.tmp\nsDialogs.dll
Filesize
9KB

MD5
e75ae7cfe06ff9692d98a934f6aa2d3c

SHA1
d5fd4a59a39630c4693ce656bbbc0a55ede0a500

SHA256
1f861aeb145ebbb9a2628414e6dca6b06d0bfb252f2de624b86814cfec8097d0

SHA512
ab4998f8f6bbb60321d0c2aa941d4e85319901960297059bf0832cf84b18dfbb120c3aa71963b46d3be3b7c9602434cb23f9a961c00de02403b3f266b294d41b

Download Submit
\Users\Admin\AppData\Local\Temp\nst27BF.tmp\nsisdl.dll
Filesize
14KB

MD5
86b723938b48dc670de8f1016c2fe603

SHA1
ff432e1f5d2b8423872719520e9df4da401755c3

SHA256
a238cb788e8077442358626fee022d0eb72fc228a5b11c101ab568662db27798

SHA512
0a291d76fd950b6f4c725ba377aef42dd2ecfa2a2e7837cf6c98dfba8f4e6f30985a0d0028900d0528501b38f92ccca6353ab20acda2d3349db30021e78a2a5d

Download Submit
\Users\Admin\AppData\Local\Temp\nst27BF.tmp\nsisdl.dll
Filesize
14KB

MD5
86b723938b48dc670de8f1016c2fe603

SHA1
ff432e1f5d2b8423872719520e9df4da401755c3

SHA256
a238cb788e8077442358626fee022d0eb72fc228a5b11c101ab568662db27798

SHA512
0a291d76fd950b6f4c725ba377aef42dd2ecfa2a2e7837cf6c98dfba8f4e6f30985a0d0028900d0528501b38f92ccca6353ab20acda2d3349db30021e78a2a5d

Download Submit
\Users\Admin\AppData\Local\Temp\nst27BF.tmp\nsisdl.dll
Filesize
14KB

MD5
86b723938b48dc670de8f1016c2fe603

SHA1
ff432e1f5d2b8423872719520e9df4da401755c3

SHA256
a238cb788e8077442358626fee022d0eb72fc228a5b11c101ab568662db27798

SHA512
0a291d76fd950b6f4c725ba377aef42dd2ecfa2a2e7837cf6c98dfba8f4e6f30985a0d0028900d0528501b38f92ccca6353ab20acda2d3349db30021e78a2a5d

Download Submit
\Users\Admin\AppData\Local\Temp\nst27BF.tmp\nsisdl.dll
Filesize
14KB

MD5
86b723938b48dc670de8f1016c2fe603

SHA1
ff432e1f5d2b8423872719520e9df4da401755c3

SHA256
a238cb788e8077442358626fee022d0eb72fc228a5b11c101ab568662db27798

SHA512
0a291d76fd950b6f4c725ba377aef42dd2ecfa2a2e7837cf6c98dfba8f4e6f30985a0d0028900d0528501b38f92ccca6353ab20acda2d3349db30021e78a2a5d

Download Submit
\Users\Admin\AppData\Local\Temp\nst27BF.tmp\nsisdl.dll
Filesize
14KB

MD5
86b723938b48dc670de8f1016c2fe603

SHA1
ff432e1f5d2b8423872719520e9df4da401755c3

SHA256
a238cb788e8077442358626fee022d0eb72fc228a5b11c101ab568662db27798

SHA512
0a291d76fd950b6f4c725ba377aef42dd2ecfa2a2e7837cf6c98dfba8f4e6f30985a0d0028900d0528501b38f92ccca6353ab20acda2d3349db30021e78a2a5d

Download Submit
\Users\Admin\AppData\Local\Temp\nst27BF.tmp\nsisdl.dll
Filesize
14KB

MD5
86b723938b48dc670de8f1016c2fe603

SHA1
ff432e1f5d2b8423872719520e9df4da401755c3

SHA256
a238cb788e8077442358626fee022d0eb72fc228a5b11c101ab568662db27798

SHA512
0a291d76fd950b6f4c725ba377aef42dd2ecfa2a2e7837cf6c98dfba8f4e6f30985a0d0028900d0528501b38f92ccca6353ab20acda2d3349db30021e78a2a5d

Download Submit
\Users\Admin\AppData\Local\Temp\nst27BF.tmp\nsisdl.dll
Filesize
14KB

MD5
86b723938b48dc670de8f1016c2fe603

SHA1
ff432e1f5d2b8423872719520e9df4da401755c3

SHA256
a238cb788e8077442358626fee022d0eb72fc228a5b11c101ab568662db27798

SHA512
0a291d76fd950b6f4c725ba377aef42dd2ecfa2a2e7837cf6c98dfba8f4e6f30985a0d0028900d0528501b38f92ccca6353ab20acda2d3349db30021e78a2a5d

Download Submit
\Users\Admin\AppData\Local\Temp\nst27BF.tmp\nsisdl.dll
Filesize
14KB

MD5
86b723938b48dc670de8f1016c2fe603

SHA1
ff432e1f5d2b8423872719520e9df4da401755c3

SHA256
a238cb788e8077442358626fee022d0eb72fc228a5b11c101ab568662db27798

SHA512
0a291d76fd950b6f4c725ba377aef42dd2ecfa2a2e7837cf6c98dfba8f4e6f30985a0d0028900d0528501b38f92ccca6353ab20acda2d3349db30021e78a2a5d

Download Submit
\Users\Admin\AppData\Roaming\360se6\Application\unpack_360se.exe
Filesize
5.6MB

MD5
494b8dd3216518a3a6bd0a37ba0129e0

SHA1
a5b2aad00d03d2685655cb1d218fb1ac1b3f4ab0

SHA256
8f1f2581521faf12547db1a0332d50b0c7dae1c043b856ff5ef4cbb30a73ad30

SHA512
fec83f15e72c1b29166aa2c51db598886ec2d71a2b040c40008be4901cb274d13ae6a495239e6fc9bd486460d5a145d6d44cabb39872d26f5ecd0117cd1fc563

Download Submit
\Users\Admin\AppData\Roaming\360se6\Application\unpack_360se.exe
Filesize
5.6MB

MD5
494b8dd3216518a3a6bd0a37ba0129e0

SHA1
a5b2aad00d03d2685655cb1d218fb1ac1b3f4ab0

SHA256
8f1f2581521faf12547db1a0332d50b0c7dae1c043b856ff5ef4cbb30a73ad30

SHA512
fec83f15e72c1b29166aa2c51db598886ec2d71a2b040c40008be4901cb274d13ae6a495239e6fc9bd486460d5a145d6d44cabb39872d26f5ecd0117cd1fc563

Download Submit
memory/268-99-0x0000000000000000-mapping.dmp

Download
memory/584-125-0x0000000000000000-mapping.dmp

Download
memory/612-266-0x0000000000000000-mapping.dmp

Download
memory/756-107-0x0000000003EF0000-0x0000000003F79000-memory.dmp

Filesize
548KB

Download
memory/756-274-0x0000000003EF0000-0x0000000003F79000-memory.dmp

Filesize
548KB

Download
memory/756-272-0x0000000003EF0000-0x0000000003F79000-memory.dmp

Filesize
548KB

Download
memory/756-97-0x0000000000400000-0x0000000000520000-memory.dmp

Filesize
1.1MB

Download
memory/756-92-0x0000000000000000-mapping.dmp

Download
memory/756-239-0x0000000000400000-0x0000000000520000-memory.dmp

Filesize
1.1MB

Download
memory/756-322-0x0000000000400000-0x0000000000520000-memory.dmp

Filesize
1.1MB

Download
memory/756-108-0x0000000003EF0000-0x0000000003F79000-memory.dmp

Filesize
548KB

Download
memory/764-70-0x0000000003220000-0x0000000003231000-memory.dmp

Filesize
68KB

Download
memory/764-63-0x0000000000000000-mapping.dmp

Download
memory/864-320-0x0000000000000000-mapping.dmp

Download
memory/864-117-0x0000000000000000-mapping.dmp

Download
memory/868-135-0x0000000000000000-mapping.dmp

Download
memory/868-148-0x00000000023C0000-0x00000000023DA000-memory.dmp

Filesize
104KB

Download
memory/868-151-0x0000000002A10000-0x0000000002ADD000-memory.dmp

Filesize
820KB

Download
memory/1020-312-0x0000000000000000-mapping.dmp

Download
memory/1236-56-0x0000000000000000-mapping.dmp

Download
memory/1332-226-0x0000000000000000-mapping.dmp

Download
memory/1484-232-0x0000000000000000-mapping.dmp

Download
memory/1492-83-0x0000000000000000-mapping.dmp

Download
memory/1648-116-0x0000000000000000-mapping.dmp

Download
memory/1816-131-0x0000000000000000-mapping.dmp

Download
memory/1912-238-0x0000000002D00000-0x0000000002E20000-memory.dmp

Filesize
1.1MB

Download
memory/1912-54-0x00000000763F1000-0x00000000763F3000-memory.dmp

Filesize
8KB

Download
memory/1912-168-0x0000000002D00000-0x0000000002E2E000-memory.dmp

Filesize
1.2MB

Download
memory/1912-280-0x0000000002D00000-0x0000000002E2E000-memory.dmp

Filesize
1.2MB

Download
memory/1912-96-0x0000000002D00000-0x0000000002E20000-memory.dmp

Filesize
1.1MB

Download
memory/1956-289-0x0000000001220000-0x0000000001231000-memory.dmp

Filesize
68KB

Download
memory/1956-191-0x00000000014D0000-0x00000000014EA000-memory.dmp

Filesize
104KB

Download
memory/1956-180-0x00000000014B0000-0x00000000014C2000-memory.dmp

Filesize
72KB

Download
memory/1956-179-0x0000000001220000-0x0000000001231000-memory.dmp

Filesize
68KB

Download
memory/1956-182-0x00000000012FF000-0x0000000001304000-memory.dmp

Filesize
20KB

Download
memory/1956-181-0x00000000012F0000-0x0000000001301000-memory.dmp

Filesize
68KB

Download
memory/1956-149-0x00000000003E0000-0x00000000003EE000-memory.dmp

Filesize
56KB

Download
memory/1956-190-0x00000000012F0000-0x0000000001301000-memory.dmp

Filesize
68KB

Download
memory/1956-189-0x0000000001220000-0x0000000001231000-memory.dmp

Filesize
68KB

Download
memory/1956-177-0x0000000003090000-0x00000000031B2000-memory.dmp

Filesize
1.1MB

Download
memory/1956-173-0x00000000035B0000-0x0000000003704000-memory.dmp

Filesize
1.3MB

Download
memory/1956-200-0x0000000002230000-0x0000000002249000-memory.dmp

Filesize
100KB

Download
memory/1956-167-0x0000000002A60000-0x0000000002B10000-memory.dmp

Filesize
704KB

Download
memory/1956-154-0x00000000011F0000-0x000000000121B000-memory.dmp

Filesize
172KB

Download
memory/1956-79-0x0000000000000000-mapping.dmp

Download
memory/1956-152-0x0000000001140000-0x000000000116A000-memory.dmp

Filesize
168KB

Download
memory/2008-334-0x0000000000000000-mapping.dmp

Download
memory/2064-213-0x00000000060A0000-0x00000000062CE000-memory.dmp

Filesize
2.2MB

Download
memory/2064-183-0x0000000003CC0000-0x0000000003DE2000-memory.dmp

Filesize
1.1MB

Download
memory/2064-206-0x0000000002BF0000-0x0000000002BFA000-memory.dmp

Filesize
40KB

Download
memory/2064-331-0x0000000002BE0000-0x0000000002BF1000-memory.dmp

Filesize
68KB

Download
memory/2064-209-0x0000000002BE0000-0x0000000002BF1000-memory.dmp

Filesize
68KB

Download
memory/2064-211-0x0000000002BE0000-0x0000000002BF1000-memory.dmp

Filesize
68KB

Download
memory/2064-330-0x0000000002BE0000-0x0000000002BF1000-memory.dmp

Filesize
68KB

Download
memory/2064-212-0x0000000002BE0000-0x0000000002BF1000-memory.dmp

Filesize
68KB

Download
memory/2064-210-0x0000000002BE0000-0x0000000002BF1000-memory.dmp

Filesize
68KB

Download
memory/2064-147-0x0000000000000000-mapping.dmp

Download
memory/2064-202-0x00000000043B0000-0x000000000447D000-memory.dmp

Filesize
820KB

Download
memory/2064-203-0x0000000004A20000-0x0000000004BA1000-memory.dmp

Filesize
1.5MB

Download
memory/2064-199-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2064-162-0x0000000002610000-0x00000000027A3000-memory.dmp

Filesize
1.6MB

Download
memory/2064-332-0x0000000002BE0000-0x0000000002BF1000-memory.dmp

Filesize
68KB

Download
memory/2064-171-0x00000000027B0000-0x0000000002A18000-memory.dmp

Filesize
2.4MB

Download
memory/2064-333-0x0000000002BE0000-0x0000000002BF1000-memory.dmp

Filesize
68KB

Download
memory/2064-174-0x0000000002140000-0x0000000002158000-memory.dmp

Filesize
96KB

Download
memory/2064-187-0x0000000003980000-0x00000000039AB000-memory.dmp

Filesize
172KB

Download
memory/2064-185-0x0000000003950000-0x000000000397A000-memory.dmp

Filesize
168KB

Download
memory/2136-230-0x0000000000000000-mapping.dmp

Download
memory/2144-234-0x0000000000000000-mapping.dmp

Download
memory/2176-265-0x0000000000000000-mapping.dmp

Download
memory/2192-345-0x0000000000000000-mapping.dmp

Download
memory/2192-236-0x0000000000000000-mapping.dmp

Download
memory/2220-282-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/2220-386-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/2220-156-0x0000000000000000-mapping.dmp

Download
memory/2220-170-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/2280-241-0x0000000000000000-mapping.dmp

Download
memory/2304-283-0x0000000000000000-mapping.dmp

Download
memory/2396-248-0x0000000000000000-mapping.dmp

Download
memory/2444-253-0x0000000000000000-mapping.dmp

Download
memory/2508-250-0x0000000000000000-mapping.dmp

Download
memory/2536-252-0x0000000000000000-mapping.dmp

Download
memory/2648-198-0x0000000000E50000-0x0000000000F7E000-memory.dmp

Filesize
1.2MB

Download
memory/2648-194-0x0000000000330000-0x0000000000374000-memory.dmp

Filesize
272KB

Download
memory/2648-309-0x0000000000E50000-0x0000000000F7E000-memory.dmp

Filesize
1.2MB

Download
memory/2648-192-0x0000000000000000-mapping.dmp

Download
memory/2660-256-0x0000000000000000-mapping.dmp

Download
memory/2724-260-0x0000000000000000-mapping.dmp

Download
memory/2748-262-0x0000000000000000-mapping.dmp

Download
memory/2780-270-0x0000000000000000-mapping.dmp

Download
memory/2784-273-0x0000000000000000-mapping.dmp

Download
memory/2784-290-0x0000000000000000-mapping.dmp

Download
memory/2852-207-0x0000000000000000-mapping.dmp

Download
memory/2880-324-0x0000000000000000-mapping.dmp

Download
memory/2936-276-0x0000000000000000-mapping.dmp

Download
memory/3008-397-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/3008-359-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/3008-357-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/3008-404-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/3008-361-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/3008-363-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/3008-365-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/3008-367-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/3008-372-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/3008-374-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/3008-376-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/3008-380-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/3008-382-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/3008-384-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/3008-387-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/3008-407-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/3008-389-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/3008-395-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/3008-278-0x0000000000000000-mapping.dmp

Download
memory/3008-399-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/3008-470-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/3008-354-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/3008-402-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/3008-409-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/3008-413-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/3008-465-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/3008-416-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/3008-459-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/3008-419-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/3008-424-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/3008-421-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/3008-428-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/3008-432-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/3008-437-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/3008-441-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/3008-443-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/3008-454-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/3036-224-0x0000000000000000-mapping.dmp

Download
memory/3496-412-0x0000000000000000-mapping.dmp

Download
memory/3496-415-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3712-451-0x0000000000000000-mapping.dmp

Download
memory/3780-461-0x0000000000000000-mapping.dmp

Download
memory/3880-494-0x0000000000000000-mapping.dmp

Download