6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212

Analysis

max time kernel
97s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2022 21:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe
Size

635KB
MD5

1afed583472f201f3d82fad8b8d24bb1
SHA1

47969a14c08e0d0034ca12313ae25bfecf57fafb
SHA256

6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212
SHA512

53094bcf92020843ee3cb9fbf395102f69d0db367657f27de06993c40872f932b9e30174c8e253b39f53d12091c410185fa43e12b9709625046217b989e7d5b9
SSDEEP

12288:gs17p2j1eNT+dhJtqEE637SvmiCzcjj/qh2GTKlRC7AhCAR:gsWMT+dDAEE637SvmiCzcjj/qh2GTKl1

Score

9^/10

bootkit discovery evasion persistence upx

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

QQPCMgr_Setup.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ QQPCMgr_Setup.exe
Downloads MZ/PE file

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	QQPCMgr_Setup.exe

Drops file in Drivers directory 11 IoCs

Processes:

duba_3_295.exe

description	ioc	process
File created	C:\Windows\system32\drivers\kisnetmxp.sys	duba_3_295.exe
File created	C:\Windows\system32\drivers\ksapi.sys	duba_3_295.exe
File created	C:\Windows\system32\drivers\ksskrpr.sys	duba_3_295.exe
File opened for modification	C:\Windows\SysWOW64\drivers\KAVBase.sys	duba_3_295.exe
File created	C:\Windows\system32\drivers\kisknl64.sys	duba_3_295.exe
File created	C:\Windows\system32\drivers\kisnetm.sys	duba_3_295.exe
File created	C:\Windows\system32\drivers\kisnetm64.sys	duba_3_295.exe
File created	C:\Windows\system32\drivers\bc.sys	duba_3_295.exe
File opened for modification	C:\Windows\system32\drivers\bc.sys	duba_3_295.exe
File created	C:\Windows\system32\drivers\kisknl.sys	duba_3_295.exe
File created	C:\Windows\system32\drivers\ksapi64.sys	duba_3_295.exe

Executes dropped EXE 17 IoCs

Processes:

setup_30004.exeQQPCDownload72844.exeQQPCMgr_Setup.exeTestMSVCR.exeInstAsm.exe360se_nanaxt9.exesetup.exeduba_3_295.exeBFVCenter-y4bd[[AB013]].exeSoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exerag1446260.exesetup.exekavlog2.exekxetray.exekxescore.exekislive.exekxescore.exe

pid	process
1276	setup_30004.exe
620	QQPCDownload72844.exe
3560	QQPCMgr_Setup.exe
1524	TestMSVCR.exe
3660	InstAsm.exe
752	360se_nanaxt9.exe
4340	setup.exe
4480	duba_3_295.exe
3312	BFVCenter-y4bd[[AB013]].exe
1608	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
1568	rag1446260.exe
3292	setup.exe
4112	kavlog2.exe
4652	kxetray.exe
3832	kxescore.exe
2248	kislive.exe
2276	kxescore.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

duba_3_295.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32	duba_3_295.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32\ = "c:\\program files (x86)\\kingsoft\\kingsoft antivirus\\kavmenu64.dll"	duba_3_295.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32\ThreadingModel = "Apartment"	duba_3_295.exe

Sets file execution options in registry 2 TTPs 28 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

duba_3_295.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kxetray.exe	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kisaddin.exe	duba_3_295.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KSCAN.EXE	duba_3_295.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KSETUPWIZ.EXE	duba_3_295.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KXESCORE.EXE	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\krecycle.exe	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kdrvmgr.exe	duba_3_295.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KXETRAY.EXE	duba_3_295.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KDRVMGR.EXE	duba_3_295.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KISCALL.EXE	duba_3_295.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KISLIVE.EXE	duba_3_295.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KISMAIN.EXE	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uninst.exe	duba_3_295.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KRECYCLE.EXE	duba_3_295.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KSIGNSP.EXE	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scomregsvrv8.exe	duba_3_295.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SCOMREGSVRV8.EXE	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kislive.exe	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kismain.exe	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ksignsp.exe	duba_3_295.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KAVLOG2.EXE	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kscan.exe	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ksetupwiz.exe	duba_3_295.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\UNINST.EXE	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavlog2.exe	duba_3_295.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KISADDIN.EXE	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kiscall.exe	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kxescore.exe	duba_3_295.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Program Files\duba_3_295.exe	upx
C:\Program Files\duba_3_295.exe	upx
behavioral2/memory/4480-191-0x0000000000400000-0x0000000000520000-memory.dmp	upx
C:\Program Files\rag1446260.exe	upx
C:\Program Files\rag1446260.exe	upx
behavioral2/memory/1568-202-0x0000000000400000-0x000000000052E000-memory.dmp	upx
behavioral2/memory/4480-242-0x0000000000400000-0x0000000000520000-memory.dmp	upx
behavioral2/memory/1568-273-0x0000000000400000-0x000000000052E000-memory.dmp	upx
behavioral2/memory/4480-300-0x0000000000400000-0x0000000000520000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe

Loads dropped DLL 64 IoCs

Processes:

setup_30004.exeQQPCDownload72844.exeQQPCMgr_Setup.exesetup.exeBFVCenter-y4bd[[AB013]].exeduba_3_295.exesetup.exekavlog2.exekxetray.exekxescore.exekislive.exe

pid	process
1276	setup_30004.exe
1276	setup_30004.exe
1276	setup_30004.exe
1276	setup_30004.exe
1276	setup_30004.exe
1276	setup_30004.exe
1276	setup_30004.exe
1276	setup_30004.exe
1276	setup_30004.exe
620	QQPCDownload72844.exe
1276	setup_30004.exe
1276	setup_30004.exe
1276	setup_30004.exe
1276	setup_30004.exe
1276	setup_30004.exe
1276	setup_30004.exe
1276	setup_30004.exe
1276	setup_30004.exe
620	QQPCDownload72844.exe
620	QQPCDownload72844.exe
1276	setup_30004.exe
1276	setup_30004.exe
3560	QQPCMgr_Setup.exe
3560	QQPCMgr_Setup.exe
4340	setup.exe
4340	setup.exe
3312	BFVCenter-y4bd[[AB013]].exe
4480	duba_3_295.exe
3292	setup.exe
3292	setup.exe
3292	setup.exe
3292	setup.exe
3292	setup.exe
3292	setup.exe
3292	setup.exe
4340	setup.exe
4340	setup.exe
3292	setup.exe
4112	kavlog2.exe
4112	kavlog2.exe
4652	kxetray.exe
4652	kxetray.exe
4652	kxetray.exe
4652	kxetray.exe
4652	kxetray.exe
2276	kxescore.exe
2276	kxescore.exe
2248	kislive.exe
2248	kislive.exe
2248	kislive.exe
4652	kxetray.exe
4652	kxetray.exe
2276	kxescore.exe
4652	kxetray.exe
4652	kxetray.exe
2276	kxescore.exe
2276	kxescore.exe
3312	BFVCenter-y4bd[[AB013]].exe
2276	kxescore.exe
2276	kxescore.exe
2276	kxescore.exe
2276	kxescore.exe
2276	kxescore.exe
2276	kxescore.exe

Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 104.192.108.157

description	ioc
Destination IP	104.192.108.157

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

duba_3_295.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	duba_3_295.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kxesc = "\"c:\\program files (x86)\\kingsoft\\kingsoft antivirus\\kxetray.exe\" -autorun"	duba_3_295.exe

Checks for any installed AV software in registry 1 TTPs 4 IoCs

Security Software Discovery

T1063

Processes:

BFVCenter-y4bd[[AB013]].exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avira\Launcher	BFVCenter-y4bd[[AB013]].exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Launcher	BFVCenter-y4bd[[AB013]].exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AhnLab\V3IS80	BFVCenter-y4bd[[AB013]].exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AhnLab\V3IS80	BFVCenter-y4bd[[AB013]].exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 2 IoCs

Processes:

duba_3_295.exe

description	ioc	process
File opened for modification	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\desktop.ini	duba_3_295.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\desktop.ini	duba_3_295.exe

Writes to the Master Boot Record (MBR) 1 TTPs 6 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

Processes:

6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exeQQPCDownload72844.exeQQPCMgr_Setup.exesetup.exeBFVCenter-y4bd[[AB013]].exeduba_3_295.exe

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe
File opened for modification	\??\PhysicalDrive0	QQPCDownload72844.exe
File opened for modification	\??\PhysicalDrive0	QQPCMgr_Setup.exe
File opened for modification	\??\PhysicalDrive0	setup.exe
File opened for modification	\??\PhysicalDrive0	BFVCenter-y4bd[[AB013]].exe
File opened for modification	\??\PhysicalDrive0	duba_3_295.exe

Drops file in System32 directory 1 IoCs

Processes:

kavlog2.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\config\KAVEventLog.EVT kavlog2.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\KAVEventLog.EVT	kavlog2.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 33 IoCs

Processes:

BFVCenter-y4bd[[AB013]].exe

pid	process
3312	BFVCenter-y4bd[[AB013]].exe
3312	BFVCenter-y4bd[[AB013]].exe
3312	BFVCenter-y4bd[[AB013]].exe
3312	BFVCenter-y4bd[[AB013]].exe
3312	BFVCenter-y4bd[[AB013]].exe
3312	BFVCenter-y4bd[[AB013]].exe
3312	BFVCenter-y4bd[[AB013]].exe
3312	BFVCenter-y4bd[[AB013]].exe
3312	BFVCenter-y4bd[[AB013]].exe
3312	BFVCenter-y4bd[[AB013]].exe
3312	BFVCenter-y4bd[[AB013]].exe
3312	BFVCenter-y4bd[[AB013]].exe
3312	BFVCenter-y4bd[[AB013]].exe
3312	BFVCenter-y4bd[[AB013]].exe
3312	BFVCenter-y4bd[[AB013]].exe
3312	BFVCenter-y4bd[[AB013]].exe
3312	BFVCenter-y4bd[[AB013]].exe
3312	BFVCenter-y4bd[[AB013]].exe
3312	BFVCenter-y4bd[[AB013]].exe
3312	BFVCenter-y4bd[[AB013]].exe
3312	BFVCenter-y4bd[[AB013]].exe
3312	BFVCenter-y4bd[[AB013]].exe
3312	BFVCenter-y4bd[[AB013]].exe
3312	BFVCenter-y4bd[[AB013]].exe
3312	BFVCenter-y4bd[[AB013]].exe
3312	BFVCenter-y4bd[[AB013]].exe
3312	BFVCenter-y4bd[[AB013]].exe
3312	BFVCenter-y4bd[[AB013]].exe
3312	BFVCenter-y4bd[[AB013]].exe
3312	BFVCenter-y4bd[[AB013]].exe
3312	BFVCenter-y4bd[[AB013]].exe
3312	BFVCenter-y4bd[[AB013]].exe
3312	BFVCenter-y4bd[[AB013]].exe

Drops file in Program Files directory 64 IoCs

Processes:

SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exeduba_3_295.exe

description	ioc	process
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\upload\download_deletetask.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\window\win_normal_lc.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\upload\btn_clearlist_pressed.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\Frames\btn_fast_disable.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CenterConsole\btn_font_smart_normal.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\Frames\dlna_btn_ok_hover.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\Frames\btn_previous_normal.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CommonCtl\progressbar_mid.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CommonCtl\sliderbar_slider_normal.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CommonCtl\bp.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\Frames\btn_down_pressed.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\Frames\btn_hideconsole_pressed.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\Frames\btn_hidetree_hover.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\Frames\btn_rotate_right_pressed.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CenterConsole\btn_treeclose_hover.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CenterConsole\ToolBar_Spliter.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\hotgame.ico	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kavevent.dll	duba_3_295.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CommonCtl\btn_playerAdd_normal.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CommonCtl\btn_playerminus_pressedl.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CommonCtl\btn_retry_h.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\menu\middle_left.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\Frames\btn_down_disable.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\Frames\btn_pause_disable.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\Frames\btn_tool_copyrul_pressed.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\Frames\btn_tool_set_pressed.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kshmpgext.dll	duba_3_295.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CenterConsole\btn_clmsg_normal.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CommonCtl\scroll_arrowdown_pressed.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CommonCtl\scroll_sliderbg_normal.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CommonCtl\sliderbar_leftpart.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CommonCtl\i_no_active.png.r28001	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CenterConsole\btn_treeclose_pressed.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CommonCtl\cs_btn_common_hover.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\Frames\dlna_btn_refresh_disable.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\Frames\dlna_btn_refresh_normal.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kcommonpid.kid	duba_3_295.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CenterConsole\btn_treecycle_disable.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CenterConsole\btn_treefresh_pressed.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CommonCtl\cs_btn_common_normal.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CenterConsole\btn_font_big_hover.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\window\r_min-pressed.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\ksnetm\kmonstat.dll	duba_3_295.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\ressrc\chs\extendimg\3.jpg	duba_3_295.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\Frames\btn_showtree_normal.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CenterConsole\btn_treefresh_disable.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CenterConsole\btn_tree_noplay.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\Frames\dlna_btn_open_disable.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\window\win_normal_lt.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\duba123new.ico	duba_3_295.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CenterConsole\btn_font_big_disable.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\window\btn_restore_normal.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\Frames\btn_showconsole_disable.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CenterConsole\btn_font_big_pressed.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CenterConsole\btn_tree_played.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxeksgpid.kid	duba_3_295.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\loading\Main.swf	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CommonCtl\btn_addtap_hover.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CommonCtl\btn_addtap_normal.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CommonCtl\btn_common_normal.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File opened for modification	C:\Program Files (x86)\搜狐影音\Skin\Default\player\window\error.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\Frames\btn_speedhide_pressed.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CenterConsole\btn_treecycle_normal.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
File created	C:\Program Files (x86)\搜狐影音\Skin\Default\player\CenterConsole\message_box.png	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 4 IoCs

installer

Processes:

resource	yara_rule
C:\Program Files\setup_30004.exe	nsis_installer_1
C:\Program Files\setup_30004.exe	nsis_installer_2
C:\Program Files\setup_30004.exe	nsis_installer_1
C:\Program Files\setup_30004.exe	nsis_installer_2

Modifies data under HKEY_USERS 5 IoCs

Processes:

QQPCMgr_Setup.exe

description	ioc	process
Key created	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg	QQPCMgr_Setup.exe
Key created	\REGISTRY\USER\QMConfig	QQPCMgr_Setup.exe
Key created	\REGISTRY\USER\QMConfig\QQDoctor	QQPCMgr_Setup.exe
Key created	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor	QQPCMgr_Setup.exe
Set value (data)	\REGISTRY\USER\QMConfig\QQDoctor\QQDoctor\ComCfg\defSimpleVersionNetConfig = 7b74ea37	QQPCMgr_Setup.exe

Modifies registry class 55 IoCs

Processes:

duba_3_295.exesetup.exekxetray.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\Shellex\ContextMenuHandlers\duba_64bit	duba_3_295.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}\InprocServer32\ThreadingModel = "Apartment"	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}\InprocServer32	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	duba_3_295.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}	duba_3_295.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}	duba_3_295.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\duba_32bit\ = "{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}"	duba_3_295.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\svrid = "9ngxwa7yhpeihecmvg5b9vx4sehs"	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F1CF8F61-AB1D-11d4-ABBD-0050BACEC828}\RzNBMlVLLUswUDBORC1MMEVGU1UtRkg1MzAw\ProcInfo = "1664758807"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}	duba_3_295.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idex = "cf1970a152ea0ff67f7ad5b48c283b55"	duba_3_295.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\svrid	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers\duba_64bit	duba_3_295.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F1CF8F61-AB1D-11d4-ABBD-0050BACEC828}\RzNBMlVLLUswUDBORC1MMEVGU1UtRkg1MzAw\ProcDll = "1696381207"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}	duba_3_295.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32\ThreadingModel = "Apartment"	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\Shellex\ContextMenuHandlers\duba_64bit	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\duba_32bit	duba_3_295.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idno = "0"	duba_3_295.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idno = "1"	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\Shellex\ContextMenuHandlers\duba_64bit	duba_3_295.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\duba_32bit\ = "{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}"	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\duba_32bit	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32\ = "c:\\program files (x86)\\kingsoft\\kingsoft antivirus\\kavmenu64.dll"	duba_3_295.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\duba_64bit\ = "{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}"	duba_3_295.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}\ = "CKavMenuShell Class"	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers	duba_3_295.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers\duba_32bit\ = "{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}"	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers\duba_32bit	duba_3_295.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\duba_32bit\ = "{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}"	duba_3_295.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F1CF8F61-AB1D-11d4-ABBD-0050BACEC828}\RzNBMlVLLUswUDBORC1MMEVGU1UtRkg1MzAw\ProcKind = "5"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}	kxetray.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F1CF8F61-AB1D-11d4-ABBD-0050BACEC828}\RzNBMlVLLUswUDBORC1MMEVGU1UtRkg1MzAw	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\mid = "1166857529"	duba_3_295.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\mid = "1166857529"	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}	duba_3_295.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\duba_64bit\ = "{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}"	duba_3_295.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\duba_64bit\ = "{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}"	duba_3_295.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers\duba_64bit\ = "{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}"	duba_3_295.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}\InprocServer32\ = "c:\\program files (x86)\\kingsoft\\kingsoft antivirus\\kavmenu.dll"	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\duba_32bit	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F1CF8F61-AB1D-11d4-ABBD-0050BACEC828}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F1CF8F61-AB1D-11d4-ABBD-0050BACEC828}\ProcKey = "RzNBMlVLLUswUDBORC1MMEVGU1UtRkg1MzAw"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}	duba_3_295.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\svrid = "9ngxwa7yhpeihecmvg5b9vx4sehs"	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers	duba_3_295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories	duba_3_295.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exeQQPCDownload72844.exeQQPCMgr_Setup.exeduba_3_295.exeSoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe

pid	process
1644	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe
1644	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe
620	QQPCDownload72844.exe
620	QQPCDownload72844.exe
620	QQPCDownload72844.exe
620	QQPCDownload72844.exe
620	QQPCDownload72844.exe
620	QQPCDownload72844.exe
3560	QQPCMgr_Setup.exe
3560	QQPCMgr_Setup.exe
3560	QQPCMgr_Setup.exe
3560	QQPCMgr_Setup.exe
3560	QQPCMgr_Setup.exe
3560	QQPCMgr_Setup.exe
3560	QQPCMgr_Setup.exe
3560	QQPCMgr_Setup.exe
3560	QQPCMgr_Setup.exe
3560	QQPCMgr_Setup.exe
3560	QQPCMgr_Setup.exe
3560	QQPCMgr_Setup.exe
3560	QQPCMgr_Setup.exe
3560	QQPCMgr_Setup.exe
3560	QQPCMgr_Setup.exe
3560	QQPCMgr_Setup.exe
3560	QQPCMgr_Setup.exe
3560	QQPCMgr_Setup.exe
3560	QQPCMgr_Setup.exe
3560	QQPCMgr_Setup.exe
3560	QQPCMgr_Setup.exe
3560	QQPCMgr_Setup.exe
3560	QQPCMgr_Setup.exe
3560	QQPCMgr_Setup.exe
3560	QQPCMgr_Setup.exe
3560	QQPCMgr_Setup.exe
3560	QQPCMgr_Setup.exe
3560	QQPCMgr_Setup.exe
3560	QQPCMgr_Setup.exe
3560	QQPCMgr_Setup.exe
3560	QQPCMgr_Setup.exe
3560	QQPCMgr_Setup.exe
4480	duba_3_295.exe
4480	duba_3_295.exe
4480	duba_3_295.exe
4480	duba_3_295.exe
1608	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
1608	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
1608	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
1608	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
1608	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
1608	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
1608	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
1608	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
1608	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
1608	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
1608	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
1608	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
1608	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
1608	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
1608	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
1608	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
1608	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
1608	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
1608	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
1608	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe

Suspicious behavior: LoadsDriver 2 IoCs

Processes:

pid process

648
648

pid	process
648
648

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

setup_30004.exeQQPCMgr_Setup.exe360se_nanaxt9.exeduba_3_295.exeBFVCenter-y4bd[[AB013]].exekislive.exekxescore.exekxetray.exe

description	pid	process
Token: SeDebugPrivilege	1276	setup_30004.exe
Token: SeBackupPrivilege	3560	QQPCMgr_Setup.exe
Token: SeRestorePrivilege	3560	QQPCMgr_Setup.exe
Token: 33	752	360se_nanaxt9.exe
Token: SeIncBasePriorityPrivilege	752	360se_nanaxt9.exe
Token: SeDebugPrivilege	4480	duba_3_295.exe
Token: SeDebugPrivilege	3312	BFVCenter-y4bd[[AB013]].exe
Token: SeDebugPrivilege	2248	kislive.exe
Token: SeDebugPrivilege	2276	kxescore.exe
Token: SeDebugPrivilege	4652	kxetray.exe
Token: SeDebugPrivilege	4480	duba_3_295.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

QQPCDownload72844.exekxetray.exe

pid process

620 QQPCDownload72844.exe
620 QQPCDownload72844.exe
4652 kxetray.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

QQPCDownload72844.exekxetray.exe

pid process

620 QQPCDownload72844.exe
620 QQPCDownload72844.exe
4652 kxetray.exe

pid	process
620	QQPCDownload72844.exe
620	QQPCDownload72844.exe
4652	kxetray.exe

pid	process
620	QQPCDownload72844.exe
620	QQPCDownload72844.exe
4652	kxetray.exe

Suspicious use of WriteProcessMemory 45 IoCs

Processes:

6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exeQQPCDownload72844.exeQQPCMgr_Setup.exe360se_nanaxt9.exerag1446260.exeduba_3_295.exe

description	pid	process	target process
PID 1644 wrote to memory of 1276	1644	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	setup_30004.exe
PID 1644 wrote to memory of 1276	1644	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	setup_30004.exe
PID 1644 wrote to memory of 1276	1644	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	setup_30004.exe
PID 1644 wrote to memory of 620	1644	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	QQPCDownload72844.exe
PID 1644 wrote to memory of 620	1644	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	QQPCDownload72844.exe
PID 1644 wrote to memory of 620	1644	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	QQPCDownload72844.exe
PID 620 wrote to memory of 3560	620	QQPCDownload72844.exe	QQPCMgr_Setup.exe
PID 620 wrote to memory of 3560	620	QQPCDownload72844.exe	QQPCMgr_Setup.exe
PID 620 wrote to memory of 3560	620	QQPCDownload72844.exe	QQPCMgr_Setup.exe
PID 3560 wrote to memory of 3660	3560	QQPCMgr_Setup.exe	InstAsm.exe
PID 3560 wrote to memory of 3660	3560	QQPCMgr_Setup.exe	InstAsm.exe
PID 3560 wrote to memory of 3660	3560	QQPCMgr_Setup.exe	InstAsm.exe
PID 1644 wrote to memory of 752	1644	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	360se_nanaxt9.exe
PID 1644 wrote to memory of 752	1644	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	360se_nanaxt9.exe
PID 1644 wrote to memory of 752	1644	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	360se_nanaxt9.exe
PID 752 wrote to memory of 4340	752	360se_nanaxt9.exe	setup.exe
PID 752 wrote to memory of 4340	752	360se_nanaxt9.exe	setup.exe
PID 752 wrote to memory of 4340	752	360se_nanaxt9.exe	setup.exe
PID 1644 wrote to memory of 4480	1644	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	duba_3_295.exe
PID 1644 wrote to memory of 4480	1644	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	duba_3_295.exe
PID 1644 wrote to memory of 4480	1644	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	duba_3_295.exe
PID 1644 wrote to memory of 3312	1644	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	BFVCenter-y4bd[[AB013]].exe
PID 1644 wrote to memory of 3312	1644	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	BFVCenter-y4bd[[AB013]].exe
PID 1644 wrote to memory of 3312	1644	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	BFVCenter-y4bd[[AB013]].exe
PID 1644 wrote to memory of 1608	1644	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
PID 1644 wrote to memory of 1608	1644	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
PID 1644 wrote to memory of 1608	1644	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
PID 1644 wrote to memory of 1568	1644	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	rag1446260.exe
PID 1644 wrote to memory of 1568	1644	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	rag1446260.exe
PID 1644 wrote to memory of 1568	1644	6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe	rag1446260.exe
PID 1568 wrote to memory of 3292	1568	rag1446260.exe	setup.exe
PID 1568 wrote to memory of 3292	1568	rag1446260.exe	setup.exe
PID 1568 wrote to memory of 3292	1568	rag1446260.exe	setup.exe
PID 4480 wrote to memory of 4112	4480	duba_3_295.exe	kavlog2.exe
PID 4480 wrote to memory of 4112	4480	duba_3_295.exe	kavlog2.exe
PID 4480 wrote to memory of 4112	4480	duba_3_295.exe	kavlog2.exe
PID 4480 wrote to memory of 4652	4480	duba_3_295.exe	kxetray.exe
PID 4480 wrote to memory of 4652	4480	duba_3_295.exe	kxetray.exe
PID 4480 wrote to memory of 4652	4480	duba_3_295.exe	kxetray.exe
PID 4480 wrote to memory of 3832	4480	duba_3_295.exe	kxescore.exe
PID 4480 wrote to memory of 3832	4480	duba_3_295.exe	kxescore.exe
PID 4480 wrote to memory of 3832	4480	duba_3_295.exe	kxescore.exe
PID 4480 wrote to memory of 2248	4480	duba_3_295.exe	kislive.exe
PID 4480 wrote to memory of 2248	4480	duba_3_295.exe	kislive.exe
PID 4480 wrote to memory of 2248	4480	duba_3_295.exe	kislive.exe

C:\Users\Admin\AppData\Local\Temp\6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe
"C:\Users\Admin\AppData\Local\Temp\6011b6b1da26652cfcc795c014ccbfc4b7cd1a20ef5bb5af9db9a2506ae42212.exe"
1⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1644

C:\Program Files\setup_30004.exe
"C:\Program Files\setup_30004.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1276

C:\Program Files\QQPCDownload72844.exe
"C:\Program Files\QQPCDownload72844.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:620

C:\Users\Admin\AppData\Roaming\tencent\QQPCMgr\Download\QQPCMgr_Setup.exe
"C:\Users\Admin\AppData\Roaming\tencent\QQPCMgr\Download\QQPCMgr_Setup.exe" /S ##silence=1&handle=393682&update=1&supply=72844&forceinstall=1&qqpcmgr=0&recommand=3&DefaultIE="http://www.hao123.com/?tn=90757827_hao_pg"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3560

C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e576590\TestMSVCR.exe
"C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e576590\TestMSVCR.exe" (null)
4⤵
- Executes dropped EXE
PID:1524

C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e576590\InstAsm.exe
"C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e576590\InstAsm.exe" "C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e576590" "C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e576590\TestMSVCR.exe"
4⤵
- Executes dropped EXE
PID:3660

C:\Program Files\360se_nanaxt9.exe
"C:\Program Files\360se_nanaxt9.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:752

C:\Users\Admin\AppData\Local\Temp\360se6CR_67215.tmp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\360se6CR_67215.tmp\setup.exe" --exe-path="C:\Program Files\360se_nanaxt9.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4340

C:\Users\Admin\AppData\Roaming\360se6\Application\360se.exe
"C:\Users\Admin\AppData\Roaming\360se6\Application\360se.exe"
4⤵
PID:5072

C:\Users\Admin\AppData\Roaming\360se6\Application\360se.exe
"C:\Users\Admin\AppData\Roaming\360se6\Application\360se.exe" --type=utility --channel="5072.0.780321229\1488605979" --lang=en-US --no-sandbox /prefetch:-645351001
5⤵
PID:5220

C:\Users\Admin\AppData\Roaming\360se6\Application\360se.exe
"C:\Users\Admin\AppData\Roaming\360se6\Application\360se.exe" --type=renderer --enable-deferred-image-decoding --lang=en-US --renderer-print-preview --disable-html-notifications --channel="5072.1.453843041\46717932" /prefetch:673131151
5⤵
PID:6032

C:\Users\Admin\AppData\Roaming\360se6\Application\360se.exe
"C:\Users\Admin\AppData\Roaming\360se6\Application\360se.exe" --type=utility --channel="5072.2.1275656685\2036596861" --lang=en-US --ignored=" --type=renderer " /prefetch:-645351001
5⤵
PID:2216

C:\Users\Admin\AppData\Roaming\360se6\Application\7.1.1.531\Installer\setup.exe
"C:\Users\Admin\AppData\Roaming\360se6\Application\7.1.1.531\Installer\setup.exe" --launch-helper
4⤵
PID:5312

C:\Users\Admin\AppData\Roaming\360se6\Application\360se.exe
"C:\Users\Admin\AppData\Roaming\360se6\Application\360se.exe" --do-shortcut=0_0_1 --set-homepage-overwrite=http://f.jiss360.cn --silent-install=3_1_1 --no-welcome-page --set-adfilter-mode=0 --have-user-data-dir=true
4⤵
PID:5444

C:\Users\Admin\AppData\Roaming\360se6\Application\360se.exe
"C:\Users\Admin\AppData\Roaming\360se6\Application\360se.exe" --type=seupdate -360seautoupdate --v3Wnd=0 --v3seProcId=5444
5⤵
PID:5812

C:\Users\Admin\AppData\Roaming\360se6\Application\360se.exe
"C:\Users\Admin\AppData\Roaming\360se6\Application\360se.exe" --type=seupdate -360se_safe_browsing_autoupdate --v3Wnd=0 --v3seProcId=5444
5⤵
PID:5984

C:\Program Files\duba_3_295.exe
"C:\Program Files\duba_3_295.exe"
2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Registers COM server for autorun
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Drops desktop.ini file(s)
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4480

\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kavlog2.exe
"c:\program files (x86)\kingsoft\kingsoft antivirus\kavlog2.exe" -install
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:4112

\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxetray.exe
"c:\program files (x86)\kingsoft\kingsoft antivirus\kxetray.exe" /autorun /hidefloatwin /silentinstrcmd
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4652

\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kwsprotect64.exe
"kwsprotect64.exe" (null)
4⤵
PID:5700

\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe
"c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe" /start kxescore
3⤵
- Executes dropped EXE
PID:3832

\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kislive.exe
"c:\program files (x86)\kingsoft\kingsoft antivirus\kislive.exe" /autorun /std /skipcs3
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2248

C:\Program Files\BFVCenter-y4bd[[AB013]].exe
"C:\Program Files\BFVCenter-y4bd[[AB013]].exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:3312

C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFVKanDianYing.exe
"C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFVKanDianYing.exe" /taskbar
3⤵
PID:5684

C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFVServer.exe
"C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFVServer.exe" /Module="YiLanStartup"
4⤵
PID:5220

C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFVServer.exe
"C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFVServer.exe" /Module="AllTask"
4⤵
PID:1900

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s "C:\Program Files (x86)\Baofeng\BFVKanDianYing\npBFVWebPlugin.dll"
3⤵
PID:5964

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s "C:\Program Files (x86)\Baofeng\BFVKanDianYing\npBFVWebPlugin64.dll"
3⤵
PID:2324

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\Baofeng\BFVKanDianYing\npBFVWebPlugin64.dll"
4⤵
PID:6088

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s "C:\Program Files (x86)\Baofeng\BFVKanDianYing\UGCFlash.dll"
3⤵
PID:5328

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s "C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFVShellIcon64.dll"
3⤵
PID:5788

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFVShellIcon64.dll"
4⤵
PID:5732

C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFVServer.exe
"C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFVServer.exe" /Module="AllTask" /From="Install"
3⤵
PID:6112

C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFDownloadProc.exe
"C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFDownloadProc.exe"
4⤵
PID:7120

C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFVDesktop.exe
"C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFVDesktop.exe" /Run=0 /From=2
3⤵
PID:3428

C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFVServer.exe
"C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFVServer.exe" /Module="DesktopNoUI"
4⤵
PID:6616

C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFVServer.exe
"C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFVServer.exe" /Module="DesktopStartup"
4⤵
PID:6856

C:\Program Files (x86)\Baofeng\BFVKanDianYing\HistoryConverter.exe
"C:\Program Files (x86)\Baofeng\BFVKanDianYing\HistoryConverter.exe"
3⤵
PID:6592

C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFVOtherInst.exe
"C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFVOtherInst.exe" "C:\Users\Admin\AppData\Local\Temp\BFVDefaultBdSetup.xml" ""
3⤵
PID:6932

C:\Program Files\SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
"C:\Program Files\SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1608

C:\Program Files (x86)\搜狐影音\FileAssociationsTool.exe
"C:\Program Files (x86)\搜狐影音\FileAssociationsTool.exe" /PreventPinning "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\搜狐影音\卸载搜狐影音.lnk"
3⤵
PID:3376

C:\Program Files (x86)\搜狐影音\FileAssociationsTool.exe
"C:\Program Files (x86)\搜狐影音\FileAssociationsTool.exe" /ModifyTaskbar "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\搜狐影音.lnk"
3⤵
PID:5380

C:\Program Files (x86)\搜狐影音\SHPlayer.exe
"C:\Program Files (x86)\搜狐影音\SHPlayer.exe"
3⤵
PID:5336

C:\Program Files (x86)\搜狐影音\SohuVA.exe
"C:\Program Files (x86)\搜狐影音\SohuVA.exe"
4⤵
PID:5672

C:\Program Files (x86)\搜狐影音\SHUpdate.exe
"C:\Program Files (x86)\搜狐影音\SHUpdate.exe" /RegBHO
4⤵
PID:2076

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" C:\Program Files (x86)\搜狐影音\SohuDetector.dll /s
5⤵
PID:2036

C:\Program Files (x86)\搜狐影音\FileAssociationsTool.exe
"C:\Program Files (x86)\搜狐影音\FileAssociationsTool.exe" /EnableAutoRun
3⤵
PID:5464

C:\Program Files (x86)\搜狐影音\FileAssociationsTool.exe
"C:\Program Files (x86)\搜狐影音\FileAssociationsTool.exe" /ModifyMainShortcut
3⤵
PID:5584

C:\Program Files (x86)\搜狐影音\FileAssociationsTool.exe
"C:\Program Files (x86)\搜狐影音\FileAssociationsTool.exe" /F
3⤵
PID:5740

C:\Program Files (x86)\搜狐影音\FileAssociationsTool.exe
"C:\Program Files (x86)\搜狐影音\FileAssociationsTool.exe" /TIFOX
3⤵
PID:5936

C:\Program Files (x86)\搜狐影音\FileAssociationsTool.exe
"C:\Program Files (x86)\搜狐影音\FileAssociationsTool.exe" /ChangeSohuVARunToSHplayerRun
3⤵
PID:6080

C:\Program Files (x86)\搜狐影音\FileAssociationsTool.exe
"C:\Program Files (x86)\搜狐影音\FileAssociationsTool.exe" /ReleaseSWF
3⤵
PID:3428

C:\Program Files (x86)\搜狐影音\FileAssociationsTool.exe
"C:\Program Files (x86)\搜狐影音\FileAssociationsTool.exe" /InstallSuccess 0
3⤵
PID:5388

C:\Program Files (x86)\搜狐影音\SHRes.exe
"C:\Program Files (x86)\搜狐影音\SHRes.exe" /RegServer
3⤵
PID:5532

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s "C:\Program Files (x86)\搜狐影音\SoHuAutoDetector.dll"
3⤵
PID:5924

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s "C:\Program Files (x86)\搜狐影音\SHUploadFile.dll"
3⤵
PID:6108

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s "C:\Program Files (x86)\搜狐影音\SohuDetector.dll"
3⤵
PID:5560

C:\Program Files (x86)\搜狐影音\SHPlayer.exe
"C:\Program Files (x86)\搜狐影音\SHPlayer.exe" /auto
3⤵
PID:4688

C:\Program Files (x86)\搜狐影音\SohuVA.exe
"C:\Program Files (x86)\搜狐影音\SohuVA.exe"
3⤵
PID:2172

C:\Program Files\rag1446260.exe
"C:\Program Files\rag1446260.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568

C:\Users\Admin\AppData\Local\Temp\RsdSfxTmp\setup.exe
C:\Users\Admin\AppData\Local\Temp\RsdSfxTmp\setup.exe /S
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Modifies registry class
PID:3292

C:\Program Files (x86)\Rising\RSD\popwndexe.exe
"C:\Program Files (x86)\Rising\RSD\popwndexe.exe"
4⤵
PID:5788

\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe
"c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe" /service kxescore
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2276

C:\Program Files (x86)\搜狐影音\SHRes.exe
"C:\Program Files (x86)\搜狐影音\SHRes.exe" -Embedding
1⤵
PID:5424

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x41c 0x3fc
1⤵
PID:6336

C:\Program Files (x86)\Rising\RSD\RsMgrSvc.exe
"C:\Program Files (x86)\Rising\RSD\RsMgrSvc.exe"
1⤵
PID:6076

C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFVDesktop.exe
"C:\Program Files (x86)\Baofeng\BFVKanDianYing\BFVDesktop.exe" /Run=0 /From=1
1⤵
PID:2216

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Bootkit

T1067

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Security Software Discovery

T1063

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\kingsoft\kingsoft antivirus\kavmenu.dll
Filesize
69KB

MD5
c8ed4b3af03d82cc3fe2f8c42c22326c

SHA1
78a2e216262b8f1b35e408685cf20f2fa4685d8f

SHA256
1c73f57c31845d3719644f815ca9df1efb18cfc3dfc2dc1b4afddb71261afb31

SHA512
34e6cf09afa68875be24005f90be35bb7c490ac9d2f63befadfdd1902136c383ee903442c9df572e2ccd0b7ea1be10857401c76c5b6923c28f8eaecab5b3c45c

Download Submit
C:\Program Files\360se_nanaxt9.exe
Filesize
25.3MB

MD5
fa129e1b7e66dc8f0b05ab8fd2dec7ca

SHA1
961eb8011bbb0f45e39956edf285f68b342637b5

SHA256
695cc7294d59e530bcf4d27518dff2dfae965139956bf118905d853b27d16e65

SHA512
a9186b4bdbd17459107b7ae3dd3cd3ceb454d98cd54d470e6abe981550495b8ad6eae52f076e09d34e4fd02421f4a264ffc7ccb486f9d1eaf6ad38b5290f34bb

Download Submit
C:\Program Files\360se_nanaxt9.exe
Filesize
25.3MB

MD5
fa129e1b7e66dc8f0b05ab8fd2dec7ca

SHA1
961eb8011bbb0f45e39956edf285f68b342637b5

SHA256
695cc7294d59e530bcf4d27518dff2dfae965139956bf118905d853b27d16e65

SHA512
a9186b4bdbd17459107b7ae3dd3cd3ceb454d98cd54d470e6abe981550495b8ad6eae52f076e09d34e4fd02421f4a264ffc7ccb486f9d1eaf6ad38b5290f34bb

Download Submit
C:\Program Files\360se_nanaxt9.exe
Filesize
25.3MB

MD5
fa129e1b7e66dc8f0b05ab8fd2dec7ca

SHA1
961eb8011bbb0f45e39956edf285f68b342637b5

SHA256
695cc7294d59e530bcf4d27518dff2dfae965139956bf118905d853b27d16e65

SHA512
a9186b4bdbd17459107b7ae3dd3cd3ceb454d98cd54d470e6abe981550495b8ad6eae52f076e09d34e4fd02421f4a264ffc7ccb486f9d1eaf6ad38b5290f34bb

Download Submit
C:\Program Files\360se_nanaxt9.exe
Filesize
25.3MB

MD5
fa129e1b7e66dc8f0b05ab8fd2dec7ca

SHA1
961eb8011bbb0f45e39956edf285f68b342637b5

SHA256
695cc7294d59e530bcf4d27518dff2dfae965139956bf118905d853b27d16e65

SHA512
a9186b4bdbd17459107b7ae3dd3cd3ceb454d98cd54d470e6abe981550495b8ad6eae52f076e09d34e4fd02421f4a264ffc7ccb486f9d1eaf6ad38b5290f34bb

Download Submit
C:\Program Files\BFVCenter-y4bd[[AB013]].exe
Filesize
6.5MB

MD5
e005aa1806b9f4b59d382535f9a22e56

SHA1
f010d5342ee42b2fd6897a3f03d7282ddadc7547

SHA256
515db6ce7c3fa8366fda9650a30c958cedd76fd252179c9ae6f44bb7a462d508

SHA512
a10a4bd10d7e944f28a3c7004e977455bd0abb0b11475dafe24fcc75d6d6e65be6350a3655732b1f569170d89a4d5e838f5ef6a2dd0c272b73522039cbff46ff

Download Submit
C:\Program Files\BFVCenter-y4bd[[AB013]].exe
Filesize
6.5MB

MD5
e005aa1806b9f4b59d382535f9a22e56

SHA1
f010d5342ee42b2fd6897a3f03d7282ddadc7547

SHA256
515db6ce7c3fa8366fda9650a30c958cedd76fd252179c9ae6f44bb7a462d508

SHA512
a10a4bd10d7e944f28a3c7004e977455bd0abb0b11475dafe24fcc75d6d6e65be6350a3655732b1f569170d89a4d5e838f5ef6a2dd0c272b73522039cbff46ff

Download Submit
C:\Program Files\QQPCDownload72844.exe
Filesize
1.4MB

MD5
e948aaa5b0102fb00ee1706e2d25f3fa

SHA1
52c612c67a64428f73d58c91dc7134f0fec5bc8e

SHA256
c2375af1c6f99100952f95d47790819f3c2aac33f1b25b3a046c8354306700fb

SHA512
27e8119e7d295041bfd2a26435fef081964077a7460584b28a9349ca42a2cbee0d689ce1e22a2b7b91c039d54360f12dc032101ccec5db6d15e33e37c6289c62

Download Submit
C:\Program Files\QQPCDownload72844.exe
Filesize
1.4MB

MD5
e948aaa5b0102fb00ee1706e2d25f3fa

SHA1
52c612c67a64428f73d58c91dc7134f0fec5bc8e

SHA256
c2375af1c6f99100952f95d47790819f3c2aac33f1b25b3a046c8354306700fb

SHA512
27e8119e7d295041bfd2a26435fef081964077a7460584b28a9349ca42a2cbee0d689ce1e22a2b7b91c039d54360f12dc032101ccec5db6d15e33e37c6289c62

Download Submit
C:\Program Files\SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
Filesize
16.0MB

MD5
4ca9c323294a61f85d7f272de3c9fdfe

SHA1
ac19c4a07ac58c74d1f5e8640d247affa9f2bef3

SHA256
81195b7a7d9b33c4cc75c4a58ab2ea0c68acb151e0fc6635aab4f6ce30cf3102

SHA512
b3d43fde85a5c40b07e561ce136a00521165feefe7b582a90afdfd94b5104fa2d2830cb7bd881002e4934e2335c74d0949156b8e6dabbb0e800724c6aec7cf70

Download Submit
C:\Program Files\SoHuVA_4.2.0.16-c204900001-ng-nti-tp-s-x.exe
Filesize
16.0MB

MD5
4ca9c323294a61f85d7f272de3c9fdfe

SHA1
ac19c4a07ac58c74d1f5e8640d247affa9f2bef3

SHA256
81195b7a7d9b33c4cc75c4a58ab2ea0c68acb151e0fc6635aab4f6ce30cf3102

SHA512
b3d43fde85a5c40b07e561ce136a00521165feefe7b582a90afdfd94b5104fa2d2830cb7bd881002e4934e2335c74d0949156b8e6dabbb0e800724c6aec7cf70

Download Submit
C:\Program Files\duba_3_295.exe
Filesize
17.3MB

MD5
61d05e0ec49e0113c9b179a75f8721b0

SHA1
1b4a94a327df622e38218cccc036044fe91c5e99

SHA256
cdab7deb216875304970d76d55086a277cac500ad4d760c544d38b7b70fb7222

SHA512
f9215882254cd956802e2bdfb1acd7be0747456ff65bb1acd37d9c89bf9a1a4638ba7f4ac9c2786ef883446417e4b856fa93189b608e8b55bf5f0f892026cdca

Download Submit
C:\Program Files\duba_3_295.exe
Filesize
17.3MB

MD5
61d05e0ec49e0113c9b179a75f8721b0

SHA1
1b4a94a327df622e38218cccc036044fe91c5e99

SHA256
cdab7deb216875304970d76d55086a277cac500ad4d760c544d38b7b70fb7222

SHA512
f9215882254cd956802e2bdfb1acd7be0747456ff65bb1acd37d9c89bf9a1a4638ba7f4ac9c2786ef883446417e4b856fa93189b608e8b55bf5f0f892026cdca

Download Submit
C:\Program Files\rag1446260.exe
Filesize
3.3MB

MD5
ccc29d9d3911e3a4441ae2da332b1bb2

SHA1
485a942e94b9d2cd9ef920f17f20725edf29f81e

SHA256
21834dd025bfa3d6d0c0f79c8740caebb03dc22048bf0d3f15f29b8b934cbc1b

SHA512
25a5a107d41fd5eb84762ad2779cd7c9293d358a5f15cbfcb1011200257ab9b840bce554387e3565f0cd64aab293aa332c5cd193b27a8010d2478cbe17ce087f

Download Submit
C:\Program Files\rag1446260.exe
Filesize
3.3MB

MD5
ccc29d9d3911e3a4441ae2da332b1bb2

SHA1
485a942e94b9d2cd9ef920f17f20725edf29f81e

SHA256
21834dd025bfa3d6d0c0f79c8740caebb03dc22048bf0d3f15f29b8b934cbc1b

SHA512
25a5a107d41fd5eb84762ad2779cd7c9293d358a5f15cbfcb1011200257ab9b840bce554387e3565f0cd64aab293aa332c5cd193b27a8010d2478cbe17ce087f

Download Submit
C:\Program Files\setup_30004.exe
Filesize
630KB

MD5
272edafd76205919cd3f5218cd14d247

SHA1
6a45cf0768211067a5924dc8cc1555a4ccc6831a

SHA256
73b2afe10f7935444a1712d94765f5f762a0dddbbb09353a0f605376696a1546

SHA512
357cb57d6658b3b8632e9e8564b5b3ccafb0703ac0d4d0c1f0e5fb040db7829108f93d2c6f28cd73878a598d54924977a75d120fffc91d46c153d5ec229de4f2

Download Submit
C:\Program Files\setup_30004.exe
Filesize
630KB

MD5
272edafd76205919cd3f5218cd14d247

SHA1
6a45cf0768211067a5924dc8cc1555a4ccc6831a

SHA256
73b2afe10f7935444a1712d94765f5f762a0dddbbb09353a0f605376696a1546

SHA512
357cb57d6658b3b8632e9e8564b5b3ccafb0703ac0d4d0c1f0e5fb040db7829108f93d2c6f28cd73878a598d54924977a75d120fffc91d46c153d5ec229de4f2

Download Submit
C:\ProgramData\Baofeng\BFVKanDianYing\Profiles\temp\360ini.dll
Filesize
2.3MB

MD5
34f1d27d71ca894fdf587dbfb7aa52bd

SHA1
b1ad562154cf347fc3748e0c3a0eb7f8ff54e049

SHA256
7006e0c9157833fefa08ad2a4a5c11d4de43ae75a156a2a642822bd67598f7ea

SHA512
e24e557e6abec9a713dc0f2b4da960aeab9baf58003bb9adf50cf9bb220b58f6a0b566dec2920cb49371ce5d8603fdaa36d68247e1c1a95ff6ca41ed4cd73613

Download Submit
C:\Users\Admin\AppData\Local\Temp\360se6CR_67215.tmp\setup.exe
Filesize
1.8MB

MD5
42043d782d0a5411a2617d74163f1580

SHA1
bc1d19785ae3042254f7852d63e9ee341bcc96a6

SHA256
4044e4624ef67cfbba14dea9354fcae4b2723f5514d01e89d776659d0372d58e

SHA512
4e56c30fee1cbdc577c2a1632df6b8805a33e0124532db309da7f5bc94b8a0c071c0c402a84cd78cfff57b73e5fd61d8d33fee361a9867619f4348f39727506e

Download Submit
C:\Users\Admin\AppData\Local\Temp\360se6CR_67215.tmp\setup.exe
Filesize
1.8MB

MD5
42043d782d0a5411a2617d74163f1580

SHA1
bc1d19785ae3042254f7852d63e9ee341bcc96a6

SHA256
4044e4624ef67cfbba14dea9354fcae4b2723f5514d01e89d776659d0372d58e

SHA512
4e56c30fee1cbdc577c2a1632df6b8805a33e0124532db309da7f5bc94b8a0c071c0c402a84cd78cfff57b73e5fd61d8d33fee361a9867619f4348f39727506e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RsdSfxTmp\CompsVer.inf
Filesize
230B

MD5
e81dc1fb97008dd00c1655e2b88cf516

SHA1
22c557832f895bbecc8f00544f8d8cf0c0273e69

SHA256
59b271e540dff6ec535985e5917dc1d9bd66370315aeeb7d296d8ef9735b5854

SHA512
f8a362d2ca52f14e07eeb5a9abc29bb89e41fe8068b59a7da46ab307a3a9eb42eb737a3656dc733cbc99914a66d89752872589095bdd7cf54ef5c95d974edad5

Download Submit
C:\Users\Admin\AppData\Local\Temp\RsdSfxTmp\MSCRT9\MSCRT9.xml
Filesize
1KB

MD5
15e2f29a4c24f89ddc4229cc4e379780

SHA1
b00d9845208eef170d52fec75537f05f582a61ce

SHA256
f1f0b8f3a031bd3b57b0c67e303e92fa2831a361d2b9c6432d939bcdfc62edb8

SHA512
7dd016c0c4b93c175e920559dff18cfb1f660d16cdc66b08293ed72545138dd8d325d591572171ea384b8a2b8f18a6200465a89fc00a2122ac2dc4197d0510bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\RsdSfxTmp\RAG936\RAG936.xml
Filesize
15KB

MD5
07a13d88c06d44390e406c85410206a3

SHA1
558e6695664b63367044dfc632e8c9c01e28be02

SHA256
bb0a00ba56659941fe172da8fc231be845d28acf87020c7fb6038ff3ceb3092c

SHA512
1f641cd3ca9eff16922fc9eaaeb34731665036b1a9121bb07707c6dc7a819cfb52bf7f854f143a4a0db4fd69b7dd415006e3e6ef394d1ad8512d30aeae8253f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\RsdSfxTmp\RAGTRAYFRM\RAGTRAYFRM.xml
Filesize
1KB

MD5
7694241121ba4df0a39e094a364f0349

SHA1
e30efcd44d159c71b115ce1e12251609e2cc2c27

SHA256
df9ae5742699a686bfde2b3673d246d06a96073131cb75538ac7965145ab11d7

SHA512
43fb3b08db1af9ed0951bdee19fc544c1946bb5e6f1ff875135c3d96923c4a20f66274eecf8ed0296f7293c2064c7b51ed4a5d1db94da638c0352d4c67e5eeda

Download Submit
C:\Users\Admin\AppData\Local\Temp\RsdSfxTmp\RSCLOUDV3\RSCLOUDV3.xml
Filesize
1KB

MD5
4c07ae4014d976494a9add553b2a4d1f

SHA1
b78574364a488db5b4b2be42bdd799546ae26fd5

SHA256
2129149c17062572ba86682bda8f468939a76dd80e1d464fc1ab4da692b73d0d

SHA512
b7a50a9a0c3763f5a04b5dc36cc4a13b660463434cd3b088399029bf5f78317bd1b79c73f157a300551986bff40e0841d3d82b2190739ece38ad40a71b9af29f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RsdSfxTmp\RSD1252\Eng.lag
Filesize
51KB

MD5
20130a3d9adbfe3acf35534876b27817

SHA1
fb38a0bbfcf8fa687e8f1c3b85d756b687d7ff70

SHA256
031c4d5d673b5686b54b2f9dabe29fa3466bc42824792aa31fa1fba8bfb55a6d

SHA512
0dba52e492aeec19a37c79de4680f66684de169fa6c93d9007c542e2215b36530687fd53490dc9b486f0cdc51925bb2487d0bac7b5b217578fd36e5c25499d4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RsdSfxTmp\RSDK2\RSDK2.xml
Filesize
1KB

MD5
2382b0c41a0e3f34f4954459da8d24d1

SHA1
2ff5b65c129dc3c20d31f1bda93b45854df2eeaa

SHA256
d93109de17bee2c1194a738bf142474c41a434ad4d2d4e96685886cf608ef36d

SHA512
07c1e6cdf133bb1e06742cb761c8986bba1507daca2dc99f308dc19861f362a2792e65f82f3aa1bef2369bab378b54183a7ebd0c8c2cfef2ed7df07a5b085b93

Download Submit
C:\Users\Admin\AppData\Local\Temp\RsdSfxTmp\RSSetup.xml
Filesize
6KB

MD5
393f064a79921941e594fd7ed1ec64a9

SHA1
768c8cf69b552b990db4f8333467d0aa9587eab3

SHA256
125a3bd6efb3cae0482e1055fba66ed2b645abd93c341f0b6df93467e455a0d4

SHA512
05bbf78539ed656e9077849eda6ecde99a7cb629d02f51243dedf201eeb698a889ce89252df3c2e87a5c841250e1b6b6985853c60c953a66c33f4f17c84359ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\RsdSfxTmp\RsLang.dll
Filesize
134KB

MD5
af1b1fca64556fab4ce9c09e1dac4b96

SHA1
c4c6c9ab878bc779ddfcf45c6175bcc67a20f8ce

SHA256
6340dbb7152c32a54e55a12c054d06e6e98add697a2e5be5929806fec306b643

SHA512
2feb1881bedc73b4e69bec79889fb03940b9165a62083f729682803e85e547fe848451f5cc94779f1746eba19cbc2bf26e5d60c7876b491d28bed5b4f1601945

Download Submit
C:\Users\Admin\AppData\Local\Temp\RsdSfxTmp\Setup.exe
Filesize
731KB

MD5
6e2517fd1ced9878e60075e1e696b408

SHA1
e1b55dce2b9261b47914c1c01762ff40df824ef1

SHA256
60231e56cd80715b506f8a53bdc504572db392b7ac000532a97e8e20c1ca0803

SHA512
69f70201e623706a8dbb1731bd9d930d1da9cd9caef676f0e675ddce93d78a29dcdb6b6f389e47e1b8840289ec9f1ef2233db8ce83f9670e452dc0d1f405d80b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RsdSfxTmp\_RAG\_RAG.xml
Filesize
1KB

MD5
32efcd535957215ef6429c572029e02d

SHA1
30ca88134f399319b2b716e0fb4b91c5d851686b

SHA256
2eaa0d521fac564556dd883da388794656910d746c23140feec4fed0d9ae503c

SHA512
a7a8398221297cf0545a3459d71d1c954e7bafe7e0d7f05b61ea14fd2b82a440793ebdaa08218a9baa45704ab37a7b03098bc99cb718a006582ab4887d7a741b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RsdSfxTmp\_rag\Setup.xml
Filesize
608B

MD5
f878b44928c296332d0fa7aeee9174df

SHA1
89bb8c054119d9f560dac6c6ebc2628afd0df6b7

SHA256
c567ae0e5db53c10ba066da0812cc9b73e293f32fe0782371060c7539669656e

SHA512
368f8b32e097b34ead897ab216b4bfcad06b9ee0dca7395df418a154cd693c988ed80a950c3b39bbb4b2951d3e1131cc80679b3feafe9a3b28941149f128bf85

Download Submit
C:\Users\Admin\AppData\Local\Temp\RsdSfxTmp\os.xml
Filesize
685B

MD5
e8cefadc14e81fdf88b43b316f301de5

SHA1
b7f6e875409597b8d6abf54682424312a7777d6e

SHA256
ab6a7e96cf835aa4a2a99480832cca0c9b739c0a6df018798bfad8e4a9fdd27b

SHA512
5d95caed222b1eb49ae41a77dac0f088ad91b5378d7d0013adec594e1f0ff44c0f3c68db82e3696bc2f0aab3384bea6772fcbc9958b53831566f9ed85678ae62

Download Submit
C:\Users\Admin\AppData\Local\Temp\RsdSfxTmp\rslang.dll
Filesize
134KB

MD5
af1b1fca64556fab4ce9c09e1dac4b96

SHA1
c4c6c9ab878bc779ddfcf45c6175bcc67a20f8ce

SHA256
6340dbb7152c32a54e55a12c054d06e6e98add697a2e5be5929806fec306b643

SHA512
2feb1881bedc73b4e69bec79889fb03940b9165a62083f729682803e85e547fe848451f5cc94779f1746eba19cbc2bf26e5d60c7876b491d28bed5b4f1601945

Download Submit
C:\Users\Admin\AppData\Local\Temp\RsdSfxTmp\setup.exe
Filesize
731KB

MD5
6e2517fd1ced9878e60075e1e696b408

SHA1
e1b55dce2b9261b47914c1c01762ff40df824ef1

SHA256
60231e56cd80715b506f8a53bdc504572db392b7ac000532a97e8e20c1ca0803

SHA512
69f70201e623706a8dbb1731bd9d930d1da9cd9caef676f0e675ddce93d78a29dcdb6b6f389e47e1b8840289ec9f1ef2233db8ce83f9670e452dc0d1f405d80b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TencentDownload\~e56b654\QQPCDownload.dll
Filesize
1.1MB

MD5
f96c6ba297f9060ae99ae771a5a2758a

SHA1
d6152884fd74a62c6374b4d9a042f01830b788c0

SHA256
663e6203632b60544f10f35b21c7638e40c34b099f9ba2690ac96f3a5bcaf1e9

SHA512
8c9d28d9fc7d31e20a39c32cb9d0432d3a91eadd7942b73f7df73b82a12a2f79a5c18e58b70f42c952249cd635293a177dd656e12903dc00125769d04c13fc3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TencentDownload\~e56b654\qmdr\dr.dll
Filesize
73KB

MD5
4f53e6f3881ff3e1ee1cc0dc0561410f

SHA1
31388b4d64164eaa5b79ee30bf22840f6b5955a2

SHA256
967bfd76354486919fd252a8bcb3d787af495a0a58bfb8a216b3776cdc2dfc43

SHA512
a652d85e36143e45bafc105f7f385b1dfa25cc83d7bb1c2b167999ec95f4dd27fc43ea91e14abc26f78395a202159807dbfd85394b30061b64fea285aab64921

Download Submit
C:\Users\Admin\AppData\Local\Temp\TencentDownload\~e56b654\qmdr\dr.dll
Filesize
73KB

MD5
4f53e6f3881ff3e1ee1cc0dc0561410f

SHA1
31388b4d64164eaa5b79ee30bf22840f6b5955a2

SHA256
967bfd76354486919fd252a8bcb3d787af495a0a58bfb8a216b3776cdc2dfc43

SHA512
a652d85e36143e45bafc105f7f385b1dfa25cc83d7bb1c2b167999ec95f4dd27fc43ea91e14abc26f78395a202159807dbfd85394b30061b64fea285aab64921

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e576590\InstAsm.exe
Filesize
100KB

MD5
2cf3201553b4eabb62a35143a808381f

SHA1
e70a8f68ae3b8761a2ae75ace72f97bde0b3aa81

SHA256
3de1b79a41e5deb6366ba9f13ff65e47697fddbf7f355995fdd45f50c3668249

SHA512
2665d0fc15620c2125e65d27664ed80936e8b281293f0726fb7c3ca4590462bc13c7c607d85e74f67c91bbd61868a1f30710b0469db3657d5aee99983751b059

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e576590\InstAsm.exe
Filesize
100KB

MD5
2cf3201553b4eabb62a35143a808381f

SHA1
e70a8f68ae3b8761a2ae75ace72f97bde0b3aa81

SHA256
3de1b79a41e5deb6366ba9f13ff65e47697fddbf7f355995fdd45f50c3668249

SHA512
2665d0fc15620c2125e65d27664ed80936e8b281293f0726fb7c3ca4590462bc13c7c607d85e74f67c91bbd61868a1f30710b0469db3657d5aee99983751b059

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e576590\PackageConf.dll
Filesize
452KB

MD5
bd1a5bd6b3d7b93ed1db083ec077ec1b

SHA1
9682036613b396b64a761e346eaf9a50981362bd

SHA256
1e2d2b9f850ca0633219527c2f861432051a5a15c2e18d88a13cccec5a8c88d5

SHA512
c8d7036dd2f8355bf9a0f98b95b86f9e336c9104db23189c1510ab45cedb90c1aa49040321f3e0c6e3b21a8f838604d244c191c39d75241e66c720147dcf7f59

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e576590\TestMSVCR.exe
Filesize
16KB

MD5
4b847825788ec131032f106500638b92

SHA1
b5948921e9d3331eda2906cb664d32ab05564434

SHA256
3313c7606698e6721f65a8ec84e7e1f95859b39a7e2ca40463164788ab00565d

SHA512
e1390df49d8c101aa946ec01600ea7a55953ca950011e64c6343d672179ffbe5e1eff98fadc1b38464702e20c7c1e830eb928a1886dbd4ed4c95a57abbd29146

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tencent\QQPCMgr\~e576590\dr.dll
Filesize
421KB

MD5
e66d3647228022225b49581d61a5c7fc

SHA1
7eb433b0248ac944fde1dc73ed25e862963ec061

SHA256
7c8fbe194c7267c97bb27b92f5d592aa1716464bbdfac466ae33416b54bb32d7

SHA512
c0bf9a22da3417e64d216c7cd9a4d8550a36b1af2de069286742dce5840c5a9e7043332694ef5ca7906b60d3548b9c6954cfd7e8d6057ae65e721f842c5c7d64

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszAE09.tmp\System.dll
Filesize
11KB

MD5
a436db0c473a087eb61ff5c53c34ba27

SHA1
65ea67e424e75f5065132b539c8b2eda88aa0506

SHA256
75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49

SHA512
908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszAE09.tmp\nsDialogs.dll
Filesize
9KB

MD5
e75ae7cfe06ff9692d98a934f6aa2d3c

SHA1
d5fd4a59a39630c4693ce656bbbc0a55ede0a500

SHA256
1f861aeb145ebbb9a2628414e6dca6b06d0bfb252f2de624b86814cfec8097d0

SHA512
ab4998f8f6bbb60321d0c2aa941d4e85319901960297059bf0832cf84b18dfbb120c3aa71963b46d3be3b7c9602434cb23f9a961c00de02403b3f266b294d41b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszAE09.tmp\nsDialogs.dll
Filesize
9KB

MD5
e75ae7cfe06ff9692d98a934f6aa2d3c

SHA1
d5fd4a59a39630c4693ce656bbbc0a55ede0a500

SHA256
1f861aeb145ebbb9a2628414e6dca6b06d0bfb252f2de624b86814cfec8097d0

SHA512
ab4998f8f6bbb60321d0c2aa941d4e85319901960297059bf0832cf84b18dfbb120c3aa71963b46d3be3b7c9602434cb23f9a961c00de02403b3f266b294d41b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszAE09.tmp\nsisdl.dll
Filesize
14KB

MD5
86b723938b48dc670de8f1016c2fe603

SHA1
ff432e1f5d2b8423872719520e9df4da401755c3

SHA256
a238cb788e8077442358626fee022d0eb72fc228a5b11c101ab568662db27798

SHA512
0a291d76fd950b6f4c725ba377aef42dd2ecfa2a2e7837cf6c98dfba8f4e6f30985a0d0028900d0528501b38f92ccca6353ab20acda2d3349db30021e78a2a5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszAE09.tmp\nsisdl.dll
Filesize
14KB

MD5
86b723938b48dc670de8f1016c2fe603

SHA1
ff432e1f5d2b8423872719520e9df4da401755c3

SHA256
a238cb788e8077442358626fee022d0eb72fc228a5b11c101ab568662db27798

SHA512
0a291d76fd950b6f4c725ba377aef42dd2ecfa2a2e7837cf6c98dfba8f4e6f30985a0d0028900d0528501b38f92ccca6353ab20acda2d3349db30021e78a2a5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszAE09.tmp\nsisdl.dll
Filesize
14KB

MD5
86b723938b48dc670de8f1016c2fe603

SHA1
ff432e1f5d2b8423872719520e9df4da401755c3

SHA256
a238cb788e8077442358626fee022d0eb72fc228a5b11c101ab568662db27798

SHA512
0a291d76fd950b6f4c725ba377aef42dd2ecfa2a2e7837cf6c98dfba8f4e6f30985a0d0028900d0528501b38f92ccca6353ab20acda2d3349db30021e78a2a5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszAE09.tmp\nsisdl.dll
Filesize
14KB

MD5
86b723938b48dc670de8f1016c2fe603

SHA1
ff432e1f5d2b8423872719520e9df4da401755c3

SHA256
a238cb788e8077442358626fee022d0eb72fc228a5b11c101ab568662db27798

SHA512
0a291d76fd950b6f4c725ba377aef42dd2ecfa2a2e7837cf6c98dfba8f4e6f30985a0d0028900d0528501b38f92ccca6353ab20acda2d3349db30021e78a2a5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszAE09.tmp\nsisdl.dll
Filesize
14KB

MD5
86b723938b48dc670de8f1016c2fe603

SHA1
ff432e1f5d2b8423872719520e9df4da401755c3

SHA256
a238cb788e8077442358626fee022d0eb72fc228a5b11c101ab568662db27798

SHA512
0a291d76fd950b6f4c725ba377aef42dd2ecfa2a2e7837cf6c98dfba8f4e6f30985a0d0028900d0528501b38f92ccca6353ab20acda2d3349db30021e78a2a5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszAE09.tmp\nsisdl.dll
Filesize
14KB

MD5
86b723938b48dc670de8f1016c2fe603

SHA1
ff432e1f5d2b8423872719520e9df4da401755c3

SHA256
a238cb788e8077442358626fee022d0eb72fc228a5b11c101ab568662db27798

SHA512
0a291d76fd950b6f4c725ba377aef42dd2ecfa2a2e7837cf6c98dfba8f4e6f30985a0d0028900d0528501b38f92ccca6353ab20acda2d3349db30021e78a2a5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszAE09.tmp\nsisdl.dll
Filesize
14KB

MD5
86b723938b48dc670de8f1016c2fe603

SHA1
ff432e1f5d2b8423872719520e9df4da401755c3

SHA256
a238cb788e8077442358626fee022d0eb72fc228a5b11c101ab568662db27798

SHA512
0a291d76fd950b6f4c725ba377aef42dd2ecfa2a2e7837cf6c98dfba8f4e6f30985a0d0028900d0528501b38f92ccca6353ab20acda2d3349db30021e78a2a5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszAE09.tmp\nsisdl.dll
Filesize
14KB

MD5
86b723938b48dc670de8f1016c2fe603

SHA1
ff432e1f5d2b8423872719520e9df4da401755c3

SHA256
a238cb788e8077442358626fee022d0eb72fc228a5b11c101ab568662db27798

SHA512
0a291d76fd950b6f4c725ba377aef42dd2ecfa2a2e7837cf6c98dfba8f4e6f30985a0d0028900d0528501b38f92ccca6353ab20acda2d3349db30021e78a2a5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszAE09.tmp\nsisdl.dll
Filesize
14KB

MD5
86b723938b48dc670de8f1016c2fe603

SHA1
ff432e1f5d2b8423872719520e9df4da401755c3

SHA256
a238cb788e8077442358626fee022d0eb72fc228a5b11c101ab568662db27798

SHA512
0a291d76fd950b6f4c725ba377aef42dd2ecfa2a2e7837cf6c98dfba8f4e6f30985a0d0028900d0528501b38f92ccca6353ab20acda2d3349db30021e78a2a5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszAE09.tmp\nsisdl.dll
Filesize
14KB

MD5
86b723938b48dc670de8f1016c2fe603

SHA1
ff432e1f5d2b8423872719520e9df4da401755c3

SHA256
a238cb788e8077442358626fee022d0eb72fc228a5b11c101ab568662db27798

SHA512
0a291d76fd950b6f4c725ba377aef42dd2ecfa2a2e7837cf6c98dfba8f4e6f30985a0d0028900d0528501b38f92ccca6353ab20acda2d3349db30021e78a2a5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszAE09.tmp\nsisdl.dll
Filesize
14KB

MD5
86b723938b48dc670de8f1016c2fe603

SHA1
ff432e1f5d2b8423872719520e9df4da401755c3

SHA256
a238cb788e8077442358626fee022d0eb72fc228a5b11c101ab568662db27798

SHA512
0a291d76fd950b6f4c725ba377aef42dd2ecfa2a2e7837cf6c98dfba8f4e6f30985a0d0028900d0528501b38f92ccca6353ab20acda2d3349db30021e78a2a5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszAE09.tmp\nsisdl.dll
Filesize
14KB

MD5
86b723938b48dc670de8f1016c2fe603

SHA1
ff432e1f5d2b8423872719520e9df4da401755c3

SHA256
a238cb788e8077442358626fee022d0eb72fc228a5b11c101ab568662db27798

SHA512
0a291d76fd950b6f4c725ba377aef42dd2ecfa2a2e7837cf6c98dfba8f4e6f30985a0d0028900d0528501b38f92ccca6353ab20acda2d3349db30021e78a2a5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszAE09.tmp\nsisdl.dll
Filesize
14KB

MD5
86b723938b48dc670de8f1016c2fe603

SHA1
ff432e1f5d2b8423872719520e9df4da401755c3

SHA256
a238cb788e8077442358626fee022d0eb72fc228a5b11c101ab568662db27798

SHA512
0a291d76fd950b6f4c725ba377aef42dd2ecfa2a2e7837cf6c98dfba8f4e6f30985a0d0028900d0528501b38f92ccca6353ab20acda2d3349db30021e78a2a5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszAE09.tmp\nsisdl.dll
Filesize
14KB

MD5
86b723938b48dc670de8f1016c2fe603

SHA1
ff432e1f5d2b8423872719520e9df4da401755c3

SHA256
a238cb788e8077442358626fee022d0eb72fc228a5b11c101ab568662db27798

SHA512
0a291d76fd950b6f4c725ba377aef42dd2ecfa2a2e7837cf6c98dfba8f4e6f30985a0d0028900d0528501b38f92ccca6353ab20acda2d3349db30021e78a2a5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszAE09.tmp\nsisdl.dll
Filesize
14KB

MD5
86b723938b48dc670de8f1016c2fe603

SHA1
ff432e1f5d2b8423872719520e9df4da401755c3

SHA256
a238cb788e8077442358626fee022d0eb72fc228a5b11c101ab568662db27798

SHA512
0a291d76fd950b6f4c725ba377aef42dd2ecfa2a2e7837cf6c98dfba8f4e6f30985a0d0028900d0528501b38f92ccca6353ab20acda2d3349db30021e78a2a5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszAE09.tmp\nsisdl.dll
Filesize
14KB

MD5
86b723938b48dc670de8f1016c2fe603

SHA1
ff432e1f5d2b8423872719520e9df4da401755c3

SHA256
a238cb788e8077442358626fee022d0eb72fc228a5b11c101ab568662db27798

SHA512
0a291d76fd950b6f4c725ba377aef42dd2ecfa2a2e7837cf6c98dfba8f4e6f30985a0d0028900d0528501b38f92ccca6353ab20acda2d3349db30021e78a2a5d

Download Submit
C:\Users\Admin\AppData\Roaming\Tencent\QQPCMgr\Download\QQPCMgr_Setup.exe
Filesize
54.1MB

MD5
cbf250d1ab226371cda8888ba5f703b9

SHA1
8a4883292ac188a99af956d8b1292f48519587b5

SHA256
5345cecc7b4865d899c99a7d9ea0b86f33daf9c9302173c906c32c0b136959e1

SHA512
8e0cd523a0f477be3faf1f21f452721421bd049a19d92fb1c04d6ba852810ade0fa0ece800845ca2bbc47784a4846658016fe161e5dc458869c212d00ca4dfe2

Download Submit
C:\Users\Admin\AppData\Roaming\tencent\QQPCMgr\Download\QQPCMgr_Setup.exe
Filesize
54.1MB

MD5
cbf250d1ab226371cda8888ba5f703b9

SHA1
8a4883292ac188a99af956d8b1292f48519587b5

SHA256
5345cecc7b4865d899c99a7d9ea0b86f33daf9c9302173c906c32c0b136959e1

SHA512
8e0cd523a0f477be3faf1f21f452721421bd049a19d92fb1c04d6ba852810ade0fa0ece800845ca2bbc47784a4846658016fe161e5dc458869c212d00ca4dfe2

Download Submit
memory/620-142-0x0000000000000000-mapping.dmp

Download
memory/620-166-0x00000000025F0000-0x0000000002601000-memory.dmp

Filesize
68KB

Download
memory/752-180-0x0000000000000000-mapping.dmp

Download
memory/1276-138-0x00000000023A1000-0x00000000023A4000-memory.dmp

Filesize
12KB

Download
memory/1276-169-0x00000000023E1000-0x00000000023E3000-memory.dmp

Filesize
8KB

Download
memory/1276-132-0x0000000000000000-mapping.dmp

Download
memory/1524-176-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1568-273-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/1568-202-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/1568-199-0x0000000000000000-mapping.dmp

Download
memory/1608-196-0x0000000000000000-mapping.dmp

Download
memory/1900-589-0x0000000000000000-mapping.dmp

Download
memory/2036-700-0x0000000000000000-mapping.dmp

Download
memory/2076-597-0x0000000000000000-mapping.dmp

Download
memory/2172-531-0x0000000000000000-mapping.dmp

Download
memory/2216-560-0x0000000000000000-mapping.dmp

Download
memory/2248-257-0x00000000029E0000-0x0000000002AAD000-memory.dmp

Filesize
820KB

Download
memory/2248-228-0x0000000000000000-mapping.dmp

Download
memory/2248-230-0x00000000026C0000-0x00000000026DA000-memory.dmp

Filesize
104KB

Download
memory/2276-255-0x0000000001C81000-0x0000000001C9D000-memory.dmp

Filesize
112KB

Download
memory/2276-281-0x0000000003550000-0x0000000003564000-memory.dmp

Filesize
80KB

Download
memory/2276-272-0x00000000030B0000-0x0000000003204000-memory.dmp

Filesize
1.3MB

Download
memory/2276-236-0x0000000001C70000-0x0000000001C9A000-memory.dmp

Filesize
168KB

Download
memory/2276-238-0x0000000001CA0000-0x0000000001CCB000-memory.dmp

Filesize
172KB

Download
memory/2276-278-0x0000000003310000-0x0000000003432000-memory.dmp

Filesize
1.1MB

Download
memory/2276-285-0x00000000036C0000-0x00000000036D8000-memory.dmp

Filesize
96KB

Download
memory/2276-256-0x0000000001C90000-0x0000000001CA2000-memory.dmp

Filesize
72KB

Download
memory/2276-245-0x0000000001C91000-0x0000000001C9B000-memory.dmp

Filesize
40KB

Download
memory/2276-262-0x0000000003000000-0x00000000030B0000-memory.dmp

Filesize
704KB

Download
memory/2276-234-0x0000000001C50000-0x0000000001C5E000-memory.dmp

Filesize
56KB

Download
memory/2276-260-0x0000000001CB0000-0x0000000001CDB000-memory.dmp

Filesize
172KB

Download
memory/2276-283-0x0000000003570000-0x0000000003582000-memory.dmp

Filesize
72KB

Download
memory/2276-258-0x0000000001CB1000-0x0000000001CCE000-memory.dmp

Filesize
116KB

Download
memory/2324-441-0x0000000000000000-mapping.dmp

Download
memory/3292-222-0x0000000002960000-0x00000000029A4000-memory.dmp

Filesize
272KB

Download
memory/3292-203-0x0000000000000000-mapping.dmp

Download
memory/3292-220-0x0000000002820000-0x0000000002864000-memory.dmp

Filesize
272KB

Download
memory/3312-192-0x0000000000000000-mapping.dmp

Download
memory/3376-314-0x0000000000000000-mapping.dmp

Download
memory/3428-398-0x0000000000000000-mapping.dmp

Download
memory/3428-596-0x0000000000000000-mapping.dmp

Download
memory/3560-170-0x0000000000000000-mapping.dmp

Download
memory/3660-177-0x0000000000000000-mapping.dmp

Download
memory/3832-226-0x0000000000000000-mapping.dmp

Download
memory/4112-224-0x0000000000000000-mapping.dmp

Download
memory/4340-183-0x0000000000000000-mapping.dmp

Download
memory/4480-300-0x0000000000400000-0x0000000000520000-memory.dmp

Filesize
1.1MB

Download
memory/4480-242-0x0000000000400000-0x0000000000520000-memory.dmp

Filesize
1.1MB

Download
memory/4480-191-0x0000000000400000-0x0000000000520000-memory.dmp

Filesize
1.1MB

Download
memory/4480-188-0x0000000000000000-mapping.dmp

Download
memory/4652-225-0x0000000000000000-mapping.dmp

Download
memory/4652-251-0x00000000036F0000-0x000000000371B000-memory.dmp

Filesize
172KB

Download
memory/4652-274-0x00000000063C0000-0x0000000006541000-memory.dmp

Filesize
1.5MB

Download
memory/4652-280-0x0000000006550000-0x000000000677E000-memory.dmp

Filesize
2.2MB

Download
memory/4652-269-0x0000000005B70000-0x0000000005BA9000-memory.dmp

Filesize
228KB

Download
memory/4652-284-0x0000000006C80000-0x0000000006DDF000-memory.dmp

Filesize
1.4MB

Download
memory/4652-265-0x0000000004230000-0x0000000004235000-memory.dmp

Filesize
20KB

Download
memory/4652-227-0x0000000002750000-0x00000000028E3000-memory.dmp

Filesize
1.6MB

Download
memory/4652-263-0x0000000004220000-0x0000000004223000-memory.dmp

Filesize
12KB

Download
memory/4652-259-0x00000000049E0000-0x00000000049E9000-memory.dmp

Filesize
36KB

Download
memory/4652-246-0x00000000036C0000-0x00000000036EA000-memory.dmp

Filesize
168KB

Download
memory/4652-271-0x0000000005CF0000-0x0000000005DBD000-memory.dmp

Filesize
820KB

Download
memory/4652-261-0x00000000049F0000-0x00000000049FA000-memory.dmp

Filesize
40KB

Download
memory/4652-231-0x00000000028F0000-0x0000000002B58000-memory.dmp

Filesize
2.4MB

Download
memory/4652-267-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/4652-233-0x0000000002B60000-0x0000000002B78000-memory.dmp

Filesize
96KB

Download
memory/4652-241-0x0000000003730000-0x0000000003852000-memory.dmp

Filesize
1.1MB

Download
memory/4652-266-0x00000000059D0000-0x0000000005A2F000-memory.dmp

Filesize
380KB

Download
memory/4688-494-0x0000000000000000-mapping.dmp

Download
memory/5072-556-0x000000000BFE0000-0x000000000C082000-memory.dmp

Filesize
648KB

Download
memory/5072-288-0x0000000000000000-mapping.dmp

Download
memory/5072-739-0x000000000BFE0000-0x000000000C082000-memory.dmp

Filesize
648KB

Download
memory/5220-595-0x0000000000000000-mapping.dmp

Download
memory/5220-325-0x0000000000000000-mapping.dmp

Download
memory/5312-336-0x0000000000000000-mapping.dmp

Download
memory/5328-453-0x0000000000000000-mapping.dmp

Download
memory/5336-813-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/5336-770-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/5336-797-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/5336-792-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/5336-845-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/5336-790-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/5336-841-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/5336-846-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/5336-786-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/5336-784-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/5336-781-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/5336-775-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/5336-839-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/5336-773-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/5336-788-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/5336-756-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/5336-825-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/5336-766-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/5336-800-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/5336-764-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/5336-762-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/5336-759-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/5336-819-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/5336-337-0x0000000000000000-mapping.dmp

Download
memory/5336-811-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/5336-803-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/5336-805-0x0000000065EC0000-0x00000000667FB000-memory.dmp

Filesize
9.2MB

Download
memory/5380-341-0x0000000000000000-mapping.dmp

Download
memory/5388-407-0x0000000000000000-mapping.dmp

Download
memory/5444-346-0x0000000000000000-mapping.dmp

Download
memory/5464-347-0x0000000000000000-mapping.dmp

Download
memory/5532-418-0x0000000000000000-mapping.dmp

Download
memory/5560-475-0x0000000000000000-mapping.dmp

Download
memory/5584-352-0x0000000000000000-mapping.dmp

Download
memory/5672-354-0x0000000000000000-mapping.dmp

Download
memory/5684-355-0x0000000000000000-mapping.dmp

Download
memory/5700-356-0x0000000000000000-mapping.dmp

Download
memory/5732-518-0x0000000000000000-mapping.dmp

Download
memory/5740-362-0x0000000000000000-mapping.dmp

Download
memory/5788-465-0x0000000000000000-mapping.dmp

Download
memory/5812-376-0x0000000000000000-mapping.dmp

Download
memory/5924-428-0x0000000000000000-mapping.dmp

Download
memory/5936-378-0x0000000000000000-mapping.dmp

Download
memory/5964-436-0x0000000000000000-mapping.dmp

Download
memory/5984-380-0x0000000000000000-mapping.dmp

Download
memory/6032-435-0x0000000000000000-mapping.dmp

Download
memory/6080-387-0x0000000000000000-mapping.dmp

Download
memory/6088-505-0x0000000000000000-mapping.dmp

Download
memory/6108-447-0x0000000000000000-mapping.dmp

Download
memory/6112-549-0x0000000000000000-mapping.dmp

Download
memory/6592-657-0x0000000000000000-mapping.dmp

Download
memory/6616-707-0x0000000000000000-mapping.dmp

Download
memory/6856-724-0x0000000000000000-mapping.dmp

Download
memory/6932-680-0x0000000000000000-mapping.dmp

Download
memory/7120-689-0x0000000000000000-mapping.dmp

Download