joker | 60595c19a11e39ca8444dce56f6db1f8c79356db3cb9d314893c14c494f9f9d3

Analysis

max time kernel
153s
max time network
158s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 23:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

60595c19a11e39ca8444dce56f6db1f8c79356db3cb9d314893c14c494f9f9d3.exe
Size

26KB
MD5

4ad83b7f8b9a684e39696c4909451630
SHA1

68291da4bc62f793bedd5fc61be23d8f5f532975
SHA256

60595c19a11e39ca8444dce56f6db1f8c79356db3cb9d314893c14c494f9f9d3
SHA512

38462aeac1c1dc88953596964f8accb424994f6cbf4177f33f75c41b1ea0d335e2a3d2cb849f66b2d8297e4271a3628dce0c59010745c7a123151811926c1532
SSDEEP

384:rK5Iu0DOSiBuMAjo/BNxf+yOhmwnh2Oj0eohDTkVOhvF27z/FUxiWtBlwmRz:rK5JAyg9oNVo2OC9yoYf

Score

10^/10

joker bootkit discovery infostealer persistence trojan upx

Malware Config

Extracted

Family

joker

http://mmtie.oss-cn-hangzhou.aliyuncs.com

Signatures

joker
Joker is an Android malware that targets billing and SMS fraud.
infostealer trojan joker
Downloads MZ/PE file

Drops file in Drivers directory 14 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\bc.sys	duba_1_244.exe
File opened for modification	C:\Windows\SysWOW64\drivers\kisknl.sys	kxescore.exe
File created	C:\Windows\system32\drivers\kisknl.sys	kxescore.exe
File created	C:\Windows\system32\drivers\kisnetm64.sys	duba_1_244.exe
File created	C:\Windows\system32\drivers\ksapi64.sys	duba_1_244.exe
File opened for modification	C:\Windows\system32\drivers\kisknl.sys	kxescore.exe
File created	C:\Windows\system32\drivers\kisknl64.sys	duba_1_244.exe
File created	C:\Windows\system32\drivers\kisnetm.sys	duba_1_244.exe
File created	C:\Windows\system32\drivers\kisnetmxp.sys	duba_1_244.exe
File created	C:\Windows\system32\drivers\ksskrpr.sys	duba_1_244.exe
File opened for modification	C:\Windows\SysWOW64\drivers\KAVBase.sys	duba_1_244.exe
File opened for modification	C:\Windows\system32\drivers\bc.sys	duba_1_244.exe
File created	C:\Windows\system32\drivers\kisknl.sys	duba_1_244.exe
File created	C:\Windows\system32\drivers\ksapi.sys	duba_1_244.exe

Executes dropped EXE 7 IoCs

pid	Process
1600	duba_1_244.exe
856	install1968982.exe
1100	kavlog2.exe
1452	kxetray.exe
1564	kxescore.exe
1540	kislive.exe
1164	kxescore.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32\ = "c:\\program files (x86)\\kingsoft\\kingsoft antivirus\\kavmenu64.dll"	duba_1_244.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32\ThreadingModel = "Apartment"	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32	duba_1_244.exe

Sets file execution options in registry 2 TTPs 28 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISADDIN.EXE	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kismain.exe	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\krecycle.exe	duba_1_244.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KSIGNSP.EXE	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavlog2.exe	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kdrvmgr.exe	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kiscall.exe	duba_1_244.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISLIVE.EXE	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kxescore.exe	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kisaddin.exe	duba_1_244.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KSCAN.EXE	duba_1_244.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KSETUPWIZ.EXE	duba_1_244.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UNINST.EXE	duba_1_244.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRECYCLE.EXE	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ksignsp.exe	duba_1_244.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KXETRAY.EXE	duba_1_244.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCOMREGSVRV8.EXE	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kislive.exe	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uninst.exe	duba_1_244.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISCALL.EXE	duba_1_244.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISMAIN.EXE	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kxetray.exe	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scomregsvrv8.exe	duba_1_244.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KXESCORE.EXE	duba_1_244.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVLOG2.EXE	duba_1_244.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KDRVMGR.EXE	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kscan.exe	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ksetupwiz.exe	duba_1_244.exe

Sets service image path in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\kisknl\ImagePath = "\\??\\C:\\Windows\\system32\\drivers\\kisknl.sys"	kxescore.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\kisknl\ImagePath = "\\??\\C:\\Windows\\system32\\drivers\\kisknl.sys"	kxescore.exe

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1504-55-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/memory/1504-58-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/files/0x00070000000139e4-59.dat	upx
behavioral1/files/0x00070000000139e4-61.dat	upx
behavioral1/memory/1600-63-0x0000000000400000-0x000000000051E000-memory.dmp	upx
behavioral1/files/0x00070000000139e4-66.dat	upx
behavioral1/files/0x00070000000139e4-65.dat	upx
behavioral1/files/0x00070000000139e4-67.dat	upx
behavioral1/memory/1600-68-0x00000000002E0000-0x00000000003FE000-memory.dmp	upx
behavioral1/memory/1600-73-0x0000000002930000-0x00000000029B9000-memory.dmp	upx
behavioral1/files/0x00060000000141af-75.dat	upx
behavioral1/files/0x00060000000141af-77.dat	upx
behavioral1/files/0x00060000000141af-81.dat	upx
behavioral1/files/0x00060000000141af-80.dat	upx
behavioral1/files/0x00060000000141af-79.dat	upx
behavioral1/memory/1600-83-0x0000000000400000-0x000000000051E000-memory.dmp	upx
behavioral1/memory/1504-84-0x0000000003C70000-0x0000000003E70000-memory.dmp	upx
behavioral1/memory/856-85-0x0000000000400000-0x0000000000600000-memory.dmp	upx
behavioral1/memory/1504-89-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/memory/1600-189-0x0000000000400000-0x000000000051E000-memory.dmp	upx
behavioral1/memory/856-201-0x0000000000400000-0x0000000000600000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
1648	cmd.exe

Loads dropped DLL 64 IoCs

pid	Process
1504	60595c19a11e39ca8444dce56f6db1f8c79356db3cb9d314893c14c494f9f9d3.exe
1600	duba_1_244.exe
1600	duba_1_244.exe
1600	duba_1_244.exe
1600	duba_1_244.exe
1600	duba_1_244.exe
1504	60595c19a11e39ca8444dce56f6db1f8c79356db3cb9d314893c14c494f9f9d3.exe
856	install1968982.exe
856	install1968982.exe
1600	duba_1_244.exe
1600	duba_1_244.exe
1600	duba_1_244.exe
1600	duba_1_244.exe
1600	duba_1_244.exe
1600	duba_1_244.exe
1600	duba_1_244.exe
1600	duba_1_244.exe
1600	duba_1_244.exe
1600	duba_1_244.exe
1600	duba_1_244.exe
1600	duba_1_244.exe
1540	kislive.exe
1540	kislive.exe
1100	kavlog2.exe
1452	kxetray.exe
1100	kavlog2.exe
1564	kxescore.exe
1564	kxescore.exe
1452	kxetray.exe
1540	kislive.exe
1540	kislive.exe
1564	kxescore.exe
1564	kxescore.exe
1452	kxetray.exe
1100	kavlog2.exe
1100	kavlog2.exe
1452	kxetray.exe
1540	kislive.exe
1164	kxescore.exe
1164	kxescore.exe
1540	kislive.exe
1540	kislive.exe
1452	kxetray.exe
1452	kxetray.exe
1164	kxescore.exe
1452	kxetray.exe
1164	kxescore.exe
1164	kxescore.exe
1164	kxescore.exe
1164	kxescore.exe
1452	kxetray.exe
1164	kxescore.exe
1164	kxescore.exe
1164	kxescore.exe
1164	kxescore.exe
1164	kxescore.exe
1164	kxescore.exe
1164	kxescore.exe
1452	kxetray.exe
1452	kxetray.exe
1452	kxetray.exe
1164	kxescore.exe
1164	kxescore.exe
1164	kxescore.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RSDTRAY = "\"C:\\Program Files (x86)\\Rising\\RSD\\popwndexe.exe\""	install1968982.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	duba_1_244.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kxesc = "\"c:\\program files (x86)\\kingsoft\\kingsoft antivirus\\kxetray.exe\" -autorun"	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	install1968982.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\desktop.ini	duba_1_244.exe
File opened for modification	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\desktop.ini	duba_1_244.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	install1968982.exe
File opened for modification	\??\PhysicalDrive0	duba_1_244.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\KAVEventLog.EVT	kavlog2.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\scom.xml	duba_1_244.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kupdata.exe	duba_1_244.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RSD\RSSetup\RsMgrSvc.exe	install1968982.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RSD\RSSetup\comx3.dll	install1968982.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\RSD950\CHT.lag	install1968982.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kwnp.dat	duba_1_244.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\ksnetm\kmonstat.dll	duba_1_244.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kskinmgr.dll	duba_1_244.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RSD\RSSetup\Setup.exe	install1968982.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RSD\RSSetup\setup.dat	install1968982.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\floatskin\dudubao.skin	duba_1_244.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\ksbwdet2.dll	duba_1_244.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\kxesansp.dll	duba_1_244.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RSD\RSSetup\comx3.dll	install1968982.exe
File created	C:\Program Files (x86)\Rising\RSD\XMLS\RSSetup.xml	install1968982.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kislive.log	kislive.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RSD\RSSetup\os.xml	install1968982.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\install.xml	duba_1_244.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\uninstall\uninstallcfg.ini	duba_1_244.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\fnsign.dat	duba_1_244.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\krecycle.exe	duba_1_244.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe	duba_1_244.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\ressrc\chs\extendimg\3.jpg	duba_1_244.exe
File opened for modification	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kws_init.log	kxescore.exe
File opened for modification	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\fdsdcache.db	kxescore.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RSD\RSSetup\update.xml	install1968982.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RSD\RSSetup\rsmginfo.dll	install1968982.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\os.xml	install1968982.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxetray.log	kxetray.exe
File opened for modification	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\kfc_dps.dat	kxetray.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RSD\RSSetup\rsmginfo.dll	install1968982.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\rsdinfo.dll	install1968982.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kfloatmain.dll	duba_1_244.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\ksde\ksdecs.dll	duba_1_244.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\ressrc\chs\game.xml	duba_1_244.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\ksedset.ini	duba_1_244.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\operation\cas\kctrl.dat	duba_1_244.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\kqsccfg.dat	duba_1_244.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\netbank.dat	duba_1_244.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore_sp.xcf	duba_1_244.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RSD\RSSetup\RSD950\CHT.lag	install1968982.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RSD\RSSetup\RSD932\Jpn.lag	install1968982.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\RsStub.exe	install1968982.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\floatskin\wenduji.skin	duba_1_244.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\ressrc\chs\web\kingsoft_main.htm	duba_1_244.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\bro.cfg	duba_1_244.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\ksde\kmctrl.dll	duba_1_244.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RSD\RSSetup\updater.exe	install1968982.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\floatskin\skinicon\tianshizhiyi_skin_img.png	duba_1_244.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\ressrc\chs\citys.xml	duba_1_244.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\ressrc\chs\web\kingsoft_duba.htm	duba_1_244.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RSD\RSSetup\RSSetup.xml	install1968982.exe
File created	C:\Program Files (x86)\Rising\RSD\RSD950\CHT.lag	install1968982.exe
File created	C:\Program Files (x86)\Rising\RSD\ui\snin.htm	install1968982.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\ksetupwiz.exe	duba_1_244.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\floatskin\shrink_skin_history.ini	kxetray.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\floatskin\skinicon\wendujishrink_skin_img.png	duba_1_244.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\duba123new.ico	duba_1_244.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\khistory.ini	duba_1_244.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\ksedset.ini	duba_1_244.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\ressrc\chs\upcfg.dat	duba_1_244.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kvmpid2.kid	duba_1_244.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RSD\RSSetup\rslang.dll	install1968982.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\ktoolupd.dll	duba_1_244.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
836	taskkill.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\duba_32bit	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}	duba_1_244.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idex = "d51422d2b0fdad0f52e9303ecd924db4"	duba_1_244.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC3909C5-DC79-47e5-86CA-7FB5C041A37C}\ravmonexe = "MY3yyOWfPDJGWUI9Kn1VTEg0"	install1968982.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC3909C5-DC79-47e5-86CA-7FB5C041A37C}\regtray = "MY3yyOWfHDJGYH8SFzo="	install1968982.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\Shellex\ContextMenuHandlers\duba_64bit	duba_1_244.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	install1968982.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers\duba_32bit	duba_1_244.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers\duba_32bit\ = "{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}"	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories	duba_1_244.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1CF8F61-AB1D-11d4-ABBD-0050BACEC828}\RzNBMlVLLUswUDBORC1MMEVGU1UtRkg1MzAw\ProcKind = "5"	install1968982.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}\InprocServer32\ = "c:\\program files (x86)\\kingsoft\\kingsoft antivirus\\kavmenu.dll"	duba_1_244.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\duba_32bit\ = "{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}"	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1CF8F61-AB1D-11d4-ABBD-0050BACEC828}	install1968982.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\Shellex\ContextMenuHandlers\duba_64bit	duba_1_244.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\duba_64bit\ = "{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}"	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}	duba_1_244.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers\duba_64bit	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\duba_32bit	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}	duba_1_244.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idno = "0"	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	install1968982.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC3909C5-DC79-47e5-86CA-7FB5C041A37C}\InstallPath = "MY3yyOWfawNie2oBDx50fX92EgFZR0Q9KQ9idXsd"	install1968982.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32\ = "c:\\program files (x86)\\kingsoft\\kingsoft antivirus\\kavmenu64.dll"	duba_1_244.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}\ = "CKavMenuShell Class"	duba_1_244.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\svrid = "psaltsu5wobgo94ovpioq29gfcbc"	duba_1_244.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAA2D3B1-4BB5-4a45-A17A-122773379D99}\ProcID = "{BA202F28-F712-1B29-3030-303133000000}"	install1968982.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC3909C5-DC79-47e5-86CA-7FB5C041A37C}\RAV = "MY3yyOWfHBJm3Q=="	install1968982.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\duba_32bit	duba_1_244.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\svrid = "psaltsu5wobgo94ovpioq29gfcbc"	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}	kxescore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1CF8F61-AB1D-11d4-ABBD-0050BACEC828}\RzNBMlVLLUswUDBORC1MMEVGU1UtRkg1MzAw	install1968982.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32\ThreadingModel = "Apartment"	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex	duba_1_244.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\mid = "1549536490"	duba_1_244.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idno = "1"	kxetray.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idex = "d51422d2b0fdad0f52e9303ecd924db4"	kxetray.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC3909C5-DC79-47e5-86CA-7FB5C041A37C}\rstrayexe = "MY3yyOWfPCBERkwqYDZIUTg="	install1968982.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\duba_64bit\ = "{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}"	duba_1_244.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}\InprocServer32\ThreadingModel = "Apartment"	duba_1_244.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC3909C5-DC79-47e5-86CA-7FB5C041A37C}\Title = "MY3yyOWfhqPg853hhvj42ZGt3Q=="	install1968982.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\Shellex\ContextMenuHandlers\duba_64bit	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAA2D3B1-4BB5-4a45-A17A-122773379D99}	install1968982.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}	kxetray.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC3909C5-DC79-47e5-86CA-7FB5C041A37C}\monShowName = "MY3yyOWfHDJGFH42PCVZV0hJ"	install1968982.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\duba_32bit\ = "{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}"	duba_1_244.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1CF8F61-AB1D-11d4-ABBD-0050BACEC828}\RzNBMlVLLUswUDBORC1MMEVGU1UtRkg1MzAw\ProcDll = "1696480188"	install1968982.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1CF8F61-AB1D-11d4-ABBD-0050BACEC828}\ProcKey = "RzNBMlVLLUswUDBORC1MMEVGU1UtRkg1MzAw"	install1968982.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers	duba_1_244.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\duba_32bit\ = "{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}"	duba_1_244.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idno = "1"	duba_1_244.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories	duba_1_244.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers\duba_64bit\ = "{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}"	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}\InprocServer32	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC3909C5-DC79-47e5-86CA-7FB5C041A37C}	install1968982.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1600	duba_1_244.exe
1600	duba_1_244.exe
1164	kxescore.exe
856	install1968982.exe
1164	kxescore.exe
1452	kxetray.exe
1452	kxetray.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
460	Process not Found
460	Process not Found
460	Process not Found
460	Process not Found

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	1600	duba_1_244.exe
Token: SeDebugPrivilege	1540	kislive.exe
Token: SeDebugPrivilege	1600	duba_1_244.exe
Token: SeDebugPrivilege	836	taskkill.exe
Token: SeDebugPrivilege	1164	kxescore.exe
Token: 33	1164	kxescore.exe
Token: SeIncBasePriorityPrivilege	1164	kxescore.exe
Token: SeDebugPrivilege	1452	kxetray.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1452	kxetray.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1452	kxetray.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1600	1504	60595c19a11e39ca8444dce56f6db1f8c79356db3cb9d314893c14c494f9f9d3.exe	28
PID 1504 wrote to memory of 1600	1504	60595c19a11e39ca8444dce56f6db1f8c79356db3cb9d314893c14c494f9f9d3.exe	28
PID 1504 wrote to memory of 1600	1504	60595c19a11e39ca8444dce56f6db1f8c79356db3cb9d314893c14c494f9f9d3.exe	28
PID 1504 wrote to memory of 1600	1504	60595c19a11e39ca8444dce56f6db1f8c79356db3cb9d314893c14c494f9f9d3.exe	28
PID 1504 wrote to memory of 1600	1504	60595c19a11e39ca8444dce56f6db1f8c79356db3cb9d314893c14c494f9f9d3.exe	28
PID 1504 wrote to memory of 1600	1504	60595c19a11e39ca8444dce56f6db1f8c79356db3cb9d314893c14c494f9f9d3.exe	28
PID 1504 wrote to memory of 1600	1504	60595c19a11e39ca8444dce56f6db1f8c79356db3cb9d314893c14c494f9f9d3.exe	28
PID 1504 wrote to memory of 856	1504	60595c19a11e39ca8444dce56f6db1f8c79356db3cb9d314893c14c494f9f9d3.exe	29
PID 1504 wrote to memory of 856	1504	60595c19a11e39ca8444dce56f6db1f8c79356db3cb9d314893c14c494f9f9d3.exe	29
PID 1504 wrote to memory of 856	1504	60595c19a11e39ca8444dce56f6db1f8c79356db3cb9d314893c14c494f9f9d3.exe	29
PID 1504 wrote to memory of 856	1504	60595c19a11e39ca8444dce56f6db1f8c79356db3cb9d314893c14c494f9f9d3.exe	29
PID 1504 wrote to memory of 856	1504	60595c19a11e39ca8444dce56f6db1f8c79356db3cb9d314893c14c494f9f9d3.exe	29
PID 1504 wrote to memory of 856	1504	60595c19a11e39ca8444dce56f6db1f8c79356db3cb9d314893c14c494f9f9d3.exe	29
PID 1504 wrote to memory of 856	1504	60595c19a11e39ca8444dce56f6db1f8c79356db3cb9d314893c14c494f9f9d3.exe	29
PID 1504 wrote to memory of 1648	1504	60595c19a11e39ca8444dce56f6db1f8c79356db3cb9d314893c14c494f9f9d3.exe	30
PID 1504 wrote to memory of 1648	1504	60595c19a11e39ca8444dce56f6db1f8c79356db3cb9d314893c14c494f9f9d3.exe	30
PID 1504 wrote to memory of 1648	1504	60595c19a11e39ca8444dce56f6db1f8c79356db3cb9d314893c14c494f9f9d3.exe	30
PID 1504 wrote to memory of 1648	1504	60595c19a11e39ca8444dce56f6db1f8c79356db3cb9d314893c14c494f9f9d3.exe	30
PID 1504 wrote to memory of 1648	1504	60595c19a11e39ca8444dce56f6db1f8c79356db3cb9d314893c14c494f9f9d3.exe	30
PID 1504 wrote to memory of 1648	1504	60595c19a11e39ca8444dce56f6db1f8c79356db3cb9d314893c14c494f9f9d3.exe	30
PID 1504 wrote to memory of 1648	1504	60595c19a11e39ca8444dce56f6db1f8c79356db3cb9d314893c14c494f9f9d3.exe	30
PID 1648 wrote to memory of 836	1648	cmd.exe	32
PID 1648 wrote to memory of 836	1648	cmd.exe	32
PID 1648 wrote to memory of 836	1648	cmd.exe	32
PID 1648 wrote to memory of 836	1648	cmd.exe	32
PID 1648 wrote to memory of 836	1648	cmd.exe	32
PID 1648 wrote to memory of 836	1648	cmd.exe	32
PID 1648 wrote to memory of 836	1648	cmd.exe	32
PID 1600 wrote to memory of 1100	1600	duba_1_244.exe	33
PID 1600 wrote to memory of 1100	1600	duba_1_244.exe	33
PID 1600 wrote to memory of 1100	1600	duba_1_244.exe	33
PID 1600 wrote to memory of 1100	1600	duba_1_244.exe	33
PID 1600 wrote to memory of 1100	1600	duba_1_244.exe	33
PID 1600 wrote to memory of 1100	1600	duba_1_244.exe	33
PID 1600 wrote to memory of 1100	1600	duba_1_244.exe	33
PID 1600 wrote to memory of 1452	1600	duba_1_244.exe	34
PID 1600 wrote to memory of 1452	1600	duba_1_244.exe	34
PID 1600 wrote to memory of 1452	1600	duba_1_244.exe	34
PID 1600 wrote to memory of 1452	1600	duba_1_244.exe	34
PID 1600 wrote to memory of 1452	1600	duba_1_244.exe	34
PID 1600 wrote to memory of 1452	1600	duba_1_244.exe	34
PID 1600 wrote to memory of 1452	1600	duba_1_244.exe	34
PID 1600 wrote to memory of 1564	1600	duba_1_244.exe	35
PID 1600 wrote to memory of 1564	1600	duba_1_244.exe	35
PID 1600 wrote to memory of 1564	1600	duba_1_244.exe	35
PID 1600 wrote to memory of 1564	1600	duba_1_244.exe	35
PID 1600 wrote to memory of 1564	1600	duba_1_244.exe	35
PID 1600 wrote to memory of 1564	1600	duba_1_244.exe	35
PID 1600 wrote to memory of 1564	1600	duba_1_244.exe	35
PID 1600 wrote to memory of 1540	1600	duba_1_244.exe	37
PID 1600 wrote to memory of 1540	1600	duba_1_244.exe	37
PID 1600 wrote to memory of 1540	1600	duba_1_244.exe	37
PID 1600 wrote to memory of 1540	1600	duba_1_244.exe	37
PID 1600 wrote to memory of 1540	1600	duba_1_244.exe	37
PID 1600 wrote to memory of 1540	1600	duba_1_244.exe	37
PID 1600 wrote to memory of 1540	1600	duba_1_244.exe	37

C:\Users\Admin\AppData\Local\Temp\60595c19a11e39ca8444dce56f6db1f8c79356db3cb9d314893c14c494f9f9d3.exe
"C:\Users\Admin\AppData\Local\Temp\60595c19a11e39ca8444dce56f6db1f8c79356db3cb9d314893c14c494f9f9d3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Users\Admin\AppData\Local\Temp\sbnimb.tmp\dtstop.tmp\duba_1_244.exe
  "C:\Users\Admin\AppData\Local\Temp\sbnimb.tmp\dtstop.tmp\duba_1_244.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Registers COM server for autorun
  - Sets file execution options in registry
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Writes to the Master Boot Record (MBR)
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1600
- - \??\c:\program files (x86)\kingsoft\kingsoft antivirus\kavlog2.exe
    "c:\program files (x86)\kingsoft\kingsoft antivirus\kavlog2.exe" -install
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    PID:1100
- - \??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxetray.exe
    "c:\program files (x86)\kingsoft\kingsoft antivirus\kxetray.exe" /autorun /hidefloatwin /silentinstrcmd
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1452
- - \??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe
    "c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe" /start kxescore
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1564
- - \??\c:\program files (x86)\kingsoft\kingsoft antivirus\kislive.exe
    "c:\program files (x86)\kingsoft\kingsoft antivirus\kislive.exe" /autorun /std /skipcs3
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Suspicious use of AdjustPrivilegeToken
    PID:1540
- C:\Users\Admin\AppData\Local\Temp\sbnimb.tmp\dtstop.tmp\install1968982.exe
  "C:\Users\Admin\AppData\Local\Temp\sbnimb.tmp\dtstop.tmp\install1968982.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Writes to the Master Boot Record (MBR)
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:856
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\60595c19a11e39ca8444dce56f6db1f8c79356db3cb9d314893c14c494f9f9d3.exe.bat
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM 60595c19a11e39ca8444dce56f6db1f8c79356db3cb9d314893c14c494f9f9d3.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:836

\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe
"c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe" /service kxescore
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Sets service image path in registry
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1164

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\kingsoft\kingsoft antivirus\kavlog2.exe

Filesize
511KB

MD5
dd1443f153f7cf554addb404aff623f8

SHA1
893f24f463d03b3b19e952b85ae06daffcc466d1

SHA256
b943b7e8cdb2decca1eaf2db1683a670fc72024be8eb95f9308adec8abc50887

SHA512
6fc1062f258684a20fce9fff8cf0ee88218aca1bb2e65c4a07f6ac7624fc1536e267538ec35f37d2356eec37258f29c13203d55a6e477d1231a5f5e8e6cd19bd

Download Submit
C:\Program Files (x86)\kingsoft\kingsoft antivirus\kislive.exe

Filesize
1.1MB

MD5
04eeb71a179940aca8073ddaa5bf4350

SHA1
02f7c99c4a2784b2db466b20c6e9c02cccc733b6

SHA256
acd8f6de1355fa40d4703149eeae1887c3f4ee0474f65c7aa257db38924e1385

SHA512
049a164a916863f037f88288faab7ce6f92d555fac4e819d6b79ed787c583f0a0d821ef173440c481f4d2a39ee1547437c6471e2e2b37cf53ad6701ede452f21

Download Submit
C:\Program Files (x86)\kingsoft\kingsoft antivirus\kxescore.exe

Filesize
277KB

MD5
479263a138a81ac646a04a7ca1060821

SHA1
7bdd2ab8f03fd82d9c8e4e3c9af9ea1a365cd6d3

SHA256
bcd9860da984d0cf04a7ddbe7586c9b0d7207864abe203e80ade6f386d83b36d

SHA512
136121c3f1db93788021e910df1308ced47072a2a076e6d68773a5a1795ca62a075bf3d21dd318ce185dc7ddb6336c5300a71866f5c32f64a69e80931dea63d7

Download Submit
C:\Program Files (x86)\kingsoft\kingsoft antivirus\kxescore.exe

Filesize
277KB

MD5
479263a138a81ac646a04a7ca1060821

SHA1
7bdd2ab8f03fd82d9c8e4e3c9af9ea1a365cd6d3

SHA256
bcd9860da984d0cf04a7ddbe7586c9b0d7207864abe203e80ade6f386d83b36d

SHA512
136121c3f1db93788021e910df1308ced47072a2a076e6d68773a5a1795ca62a075bf3d21dd318ce185dc7ddb6336c5300a71866f5c32f64a69e80931dea63d7

Download Submit
C:\Program Files (x86)\kingsoft\kingsoft antivirus\kxetray.exe

Filesize
1.4MB

MD5
cee09dac2393fb81c34ea3c5ced75d31

SHA1
e2d5c7720c65b4dcd7f740104fc9f8890b68a494

SHA256
156920cf11f82d22ef2339b4a9525b2905ee496be6630c2a926eef39c3c77570

SHA512
c4710de9bc6c9f8c37ceebd600a9e9ac7c6c9dfa60d24ef4f36374cff3dc4054e6ca99e5ea9c41eed70d772d1acebf7da9ebd3b8c9ff93bcecacc8099554574f

Download Submit
C:\Users\Admin\AppData\Local\Temp\60595c19a11e39ca8444dce56f6db1f8c79356db3cb9d314893c14c494f9f9d3.exe.bat

Filesize
330B

MD5
1dfd37b0efcbd173814c46e456099084

SHA1
55a4bf3c9f619f14d5d111c6a592a6a1b49e54c5

SHA256
82b4ddfe38a42d468009ea693360ead210842c3972af9bc9a395f65836534c53

SHA512
9e8dd6fa4cde4031aab02366d0aa056a2baa242042df3fcc137658604d978fbcdb57f1a17eafb0890ef18c81e1c10d007d790682db3f97a41710afc20b2f4483

Download Submit
C:\Users\Admin\AppData\Local\Temp\sbnimb.tmp\dtstop.tmp\duba_1_244.exe

Filesize
16.8MB

MD5
1f1c87b2b8528523907cc58c00923df8

SHA1
ea0f7ad5e2d0bc48e52ea9e00c56dc14ea026514

SHA256
37e29c28eb4a4753f6926c2f7dfd169a09e184264f537c64893637716237733a

SHA512
2a8d2107eb8d479d8378c780389278e2d20653954d93dea72700b9bb9c21bc7ecf826243c1aadf8a6bc2705cc9d0055a01cf24c32a8ba38cca87ca51abd66fbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\sbnimb.tmp\dtstop.tmp\duba_1_244.exe

Filesize
16.8MB

MD5
1f1c87b2b8528523907cc58c00923df8

SHA1
ea0f7ad5e2d0bc48e52ea9e00c56dc14ea026514

SHA256
37e29c28eb4a4753f6926c2f7dfd169a09e184264f537c64893637716237733a

SHA512
2a8d2107eb8d479d8378c780389278e2d20653954d93dea72700b9bb9c21bc7ecf826243c1aadf8a6bc2705cc9d0055a01cf24c32a8ba38cca87ca51abd66fbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\sbnimb.tmp\dtstop.tmp\install1968982.exe

Filesize
4.6MB

MD5
512fe2eb54dde3c922ce73c075a592a1

SHA1
4332a256f0a77381ecd11e823475c335691325d7

SHA256
110f6a132f05a0d7b31d449beb75c7b22cd1fd409d50b32ded10e8ac305d852e

SHA512
a3f6fda13e054d5f3f52f0b62895c94b467b32e5811bf52e91c7c747554204af150c0bddce229bcd4b912c575079376ffdd02dbe281d2a59f1f6824b464b993e

Download Submit
C:\Users\Admin\AppData\Local\Temp\sbnimb.tmp\dtstop.tmp\install1968982.exe

Filesize
4.6MB

MD5
512fe2eb54dde3c922ce73c075a592a1

SHA1
4332a256f0a77381ecd11e823475c335691325d7

SHA256
110f6a132f05a0d7b31d449beb75c7b22cd1fd409d50b32ded10e8ac305d852e

SHA512
a3f6fda13e054d5f3f52f0b62895c94b467b32e5811bf52e91c7c747554204af150c0bddce229bcd4b912c575079376ffdd02dbe281d2a59f1f6824b464b993e

Download Submit
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\MSVCP80.dll

Filesize
536KB

MD5
4c8a880eabc0b4d462cc4b2472116ea1

SHA1
d0a27f553c0fe0e507c7df079485b601d5b592e6

SHA256
2026f3c4f830dff6883b88e2647272a52a132f25eb42c0d423e36b3f65a94d08

SHA512
6a6cce8c232f46dab9b02d29be5e0675cc1e968e9c2d64d0abc008d20c0a7baeb103a5b1d9b348fa1c4b3af9797dbcb6e168b14b545fb15c2ccd926c3098c31c

Download Submit
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\MSVCR80.dll

Filesize
612KB

MD5
e4fece18310e23b1d8fee993e35e7a6f

SHA1
9fd3a7f0522d36c2bf0e64fc510c6eea3603b564

SHA256
02bdde38e4c6bd795a092d496b8d6060cdbe71e22ef4d7a204e3050c1be44fa9

SHA512
2fb5f8d63a39ba5e93505df3a643d14e286fe34b11984cbed4b88e8a07517c03efb3a7bf9d61cf1ec73b0a20d83f9e6068e61950a61d649b8d36082bb034ddfc

Download Submit
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kavevent.dll

Filesize
90KB

MD5
80f899ca024ddcf5218a4fadeacaec54

SHA1
2756821bde2d8eb44b04da63afbf5496565ddf71

SHA256
2a0d8c0778ef91c5e9f7ffac47a0e49a4055d50556895822d84adcbce9375c17

SHA512
ae871718f3eb2bcdd4bc6d41a691e9684a98a022d0db9d9444470820847e648e369a5f0c7887dc31d6ffa51572634345fe2448c1defe8535eb79c30f8202f41f

Download Submit
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kavlog2.exe

Filesize
511KB

MD5
dd1443f153f7cf554addb404aff623f8

SHA1
893f24f463d03b3b19e952b85ae06daffcc466d1

SHA256
b943b7e8cdb2decca1eaf2db1683a670fc72024be8eb95f9308adec8abc50887

SHA512
6fc1062f258684a20fce9fff8cf0ee88218aca1bb2e65c4a07f6ac7624fc1536e267538ec35f37d2356eec37258f29c13203d55a6e477d1231a5f5e8e6cd19bd

Download Submit
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kislive.exe

Filesize
1.1MB

MD5
04eeb71a179940aca8073ddaa5bf4350

SHA1
02f7c99c4a2784b2db466b20c6e9c02cccc733b6

SHA256
acd8f6de1355fa40d4703149eeae1887c3f4ee0474f65c7aa257db38924e1385

SHA512
049a164a916863f037f88288faab7ce6f92d555fac4e819d6b79ed787c583f0a0d821ef173440c481f4d2a39ee1547437c6471e2e2b37cf53ad6701ede452f21

Download Submit
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kpopclt.dll

Filesize
213KB

MD5
1dd2c3ecae68a35cde2d586aa24e0f25

SHA1
600f6a6af5b43a00c5ddd040a79afbeadba053cf

SHA256
905fbcb0f93015941e884bd37b5d196788bc4422919fead4be12fbfd42fb5440

SHA512
237f5623042dfab544458847cebe1a5f95bf83165d6155086378976b1082d7709b0fe8379ba15fff8ea39664ffe67546719983d27ce3e82cec6ac667e0f78145

Download Submit
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kskinmgr.dll

Filesize
816KB

MD5
53de7a10d35eb29067271ac7b7b290f0

SHA1
a90dbc5ac916171f0c79e617012945f020382137

SHA256
8a19b8ea0aa65e41911a9f411cf93b9555ce5a8e308f5b37fc124e312b562938

SHA512
c0e1d557adcce95697c83cb5521f72d62f3f3bc77c4bd46aab32070bb796c33b4d09d9399fb969ed5af8dedd0f2b6b917fd36355d17d5a922a2200fb39795892

Download Submit
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe

Filesize
277KB

MD5
479263a138a81ac646a04a7ca1060821

SHA1
7bdd2ab8f03fd82d9c8e4e3c9af9ea1a365cd6d3

SHA256
bcd9860da984d0cf04a7ddbe7586c9b0d7207864abe203e80ade6f386d83b36d

SHA512
136121c3f1db93788021e910df1308ced47072a2a076e6d68773a5a1795ca62a075bf3d21dd318ce185dc7ddb6336c5300a71866f5c32f64a69e80931dea63d7

Download Submit
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore_sp.xcf

Filesize
87B

MD5
47f61d0f7bd830f5bfe72c3b65941fde

SHA1
d7f440877e23679fd2c480dff2b8f3219702d681

SHA256
eb09cf1094904f0d3038ce1e981fd4366eba4000c8b6f13a3dbbaefea4797e37

SHA512
d234f17af1440aba1a4f6c2b24d04fdeb3a685f25f391cdc1ac048dfed1b470689bed5b21d7b3db94f9186445932982f462bbee8af919c1a957ab89bd69e68f5

Download Submit
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxetray.exe

Filesize
1.4MB

MD5
cee09dac2393fb81c34ea3c5ced75d31

SHA1
e2d5c7720c65b4dcd7f740104fc9f8890b68a494

SHA256
156920cf11f82d22ef2339b4a9525b2905ee496be6630c2a926eef39c3c77570

SHA512
c4710de9bc6c9f8c37ceebd600a9e9ac7c6c9dfa60d24ef4f36374cff3dc4054e6ca99e5ea9c41eed70d772d1acebf7da9ebd3b8c9ff93bcecacc8099554574f

Download Submit
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\operation\cas\kinfoc.dll

Filesize
166KB

MD5
170899a660d5d4a350edf80c77334136

SHA1
8119313e8a998ad83ee6a13ef88b6fa1c2a0fcae

SHA256
3672f758b4e875a66b2d95721c89a5ddd7d0eef27b10db254f321041c9f6cf43

SHA512
a87f2fe159f5cae36feda263f10473c7a0df0ddb5c4b82ded1d55b43d4223a4d03ce2a5b7254400d89cff2583f28c793dad2e8cc19cf98a54c42644f08ff7fd3

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kavevent.dll

Filesize
90KB

MD5
80f899ca024ddcf5218a4fadeacaec54

SHA1
2756821bde2d8eb44b04da63afbf5496565ddf71

SHA256
2a0d8c0778ef91c5e9f7ffac47a0e49a4055d50556895822d84adcbce9375c17

SHA512
ae871718f3eb2bcdd4bc6d41a691e9684a98a022d0db9d9444470820847e648e369a5f0c7887dc31d6ffa51572634345fe2448c1defe8535eb79c30f8202f41f

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kavlog2.exe

Filesize
511KB

MD5
dd1443f153f7cf554addb404aff623f8

SHA1
893f24f463d03b3b19e952b85ae06daffcc466d1

SHA256
b943b7e8cdb2decca1eaf2db1683a670fc72024be8eb95f9308adec8abc50887

SHA512
6fc1062f258684a20fce9fff8cf0ee88218aca1bb2e65c4a07f6ac7624fc1536e267538ec35f37d2356eec37258f29c13203d55a6e477d1231a5f5e8e6cd19bd

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kavlog2.exe

Filesize
511KB

MD5
dd1443f153f7cf554addb404aff623f8

SHA1
893f24f463d03b3b19e952b85ae06daffcc466d1

SHA256
b943b7e8cdb2decca1eaf2db1683a670fc72024be8eb95f9308adec8abc50887

SHA512
6fc1062f258684a20fce9fff8cf0ee88218aca1bb2e65c4a07f6ac7624fc1536e267538ec35f37d2356eec37258f29c13203d55a6e477d1231a5f5e8e6cd19bd

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kavlog2.exe

Filesize
511KB

MD5
dd1443f153f7cf554addb404aff623f8

SHA1
893f24f463d03b3b19e952b85ae06daffcc466d1

SHA256
b943b7e8cdb2decca1eaf2db1683a670fc72024be8eb95f9308adec8abc50887

SHA512
6fc1062f258684a20fce9fff8cf0ee88218aca1bb2e65c4a07f6ac7624fc1536e267538ec35f37d2356eec37258f29c13203d55a6e477d1231a5f5e8e6cd19bd

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kavlog2.exe

Filesize
511KB

MD5
dd1443f153f7cf554addb404aff623f8

SHA1
893f24f463d03b3b19e952b85ae06daffcc466d1

SHA256
b943b7e8cdb2decca1eaf2db1683a670fc72024be8eb95f9308adec8abc50887

SHA512
6fc1062f258684a20fce9fff8cf0ee88218aca1bb2e65c4a07f6ac7624fc1536e267538ec35f37d2356eec37258f29c13203d55a6e477d1231a5f5e8e6cd19bd

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kavmenu.dll

Filesize
69KB

MD5
c8ed4b3af03d82cc3fe2f8c42c22326c

SHA1
78a2e216262b8f1b35e408685cf20f2fa4685d8f

SHA256
1c73f57c31845d3719644f815ca9df1efb18cfc3dfc2dc1b4afddb71261afb31

SHA512
34e6cf09afa68875be24005f90be35bb7c490ac9d2f63befadfdd1902136c383ee903442c9df572e2ccd0b7ea1be10857401c76c5b6923c28f8eaecab5b3c45c

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kislive.exe

Filesize
1.1MB

MD5
04eeb71a179940aca8073ddaa5bf4350

SHA1
02f7c99c4a2784b2db466b20c6e9c02cccc733b6

SHA256
acd8f6de1355fa40d4703149eeae1887c3f4ee0474f65c7aa257db38924e1385

SHA512
049a164a916863f037f88288faab7ce6f92d555fac4e819d6b79ed787c583f0a0d821ef173440c481f4d2a39ee1547437c6471e2e2b37cf53ad6701ede452f21

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kislive.exe

Filesize
1.1MB

MD5
04eeb71a179940aca8073ddaa5bf4350

SHA1
02f7c99c4a2784b2db466b20c6e9c02cccc733b6

SHA256
acd8f6de1355fa40d4703149eeae1887c3f4ee0474f65c7aa257db38924e1385

SHA512
049a164a916863f037f88288faab7ce6f92d555fac4e819d6b79ed787c583f0a0d821ef173440c481f4d2a39ee1547437c6471e2e2b37cf53ad6701ede452f21

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kislive.exe

Filesize
1.1MB

MD5
04eeb71a179940aca8073ddaa5bf4350

SHA1
02f7c99c4a2784b2db466b20c6e9c02cccc733b6

SHA256
acd8f6de1355fa40d4703149eeae1887c3f4ee0474f65c7aa257db38924e1385

SHA512
049a164a916863f037f88288faab7ce6f92d555fac4e819d6b79ed787c583f0a0d821ef173440c481f4d2a39ee1547437c6471e2e2b37cf53ad6701ede452f21

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kislive.exe

Filesize
1.1MB

MD5
04eeb71a179940aca8073ddaa5bf4350

SHA1
02f7c99c4a2784b2db466b20c6e9c02cccc733b6

SHA256
acd8f6de1355fa40d4703149eeae1887c3f4ee0474f65c7aa257db38924e1385

SHA512
049a164a916863f037f88288faab7ce6f92d555fac4e819d6b79ed787c583f0a0d821ef173440c481f4d2a39ee1547437c6471e2e2b37cf53ad6701ede452f21

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kismain.exe

Filesize
337KB

MD5
bb1ce6771f3bdfa3db16106e6802cf45

SHA1
9303e90c1782df8dd383ae75235e400e4a75df25

SHA256
b30440a7fe3f2cef818e9769df7aea5af5bd150058630299c34836f0eeec0270

SHA512
d412665027d7ad1b110a9e62b8ef2d1ab500b559865bb2cfa6584347993bb1e5634e442b158b3a8cbbf2df62d5ccd81714ac3e7f97246aca7b700991147893c2

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kismain.exe

Filesize
337KB

MD5
bb1ce6771f3bdfa3db16106e6802cf45

SHA1
9303e90c1782df8dd383ae75235e400e4a75df25

SHA256
b30440a7fe3f2cef818e9769df7aea5af5bd150058630299c34836f0eeec0270

SHA512
d412665027d7ad1b110a9e62b8ef2d1ab500b559865bb2cfa6584347993bb1e5634e442b158b3a8cbbf2df62d5ccd81714ac3e7f97246aca7b700991147893c2

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kpopclt.dll

Filesize
213KB

MD5
1dd2c3ecae68a35cde2d586aa24e0f25

SHA1
600f6a6af5b43a00c5ddd040a79afbeadba053cf

SHA256
905fbcb0f93015941e884bd37b5d196788bc4422919fead4be12fbfd42fb5440

SHA512
237f5623042dfab544458847cebe1a5f95bf83165d6155086378976b1082d7709b0fe8379ba15fff8ea39664ffe67546719983d27ce3e82cec6ac667e0f78145

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\krecycle.exe

Filesize
495KB

MD5
c423991edd1e101d7c1aa7f2fe5d6670

SHA1
1f19d1c7e6f9189b2cdc875cc4b5c9afcf976e51

SHA256
f6cf76ca159237d0661b94d49d50657363db2df2f1b15188a60ef207c09a9ca4

SHA512
73640c9f8342ba3d51649726e85bad9510860ca836f8de21df27d9163ae0a6092a66fe8b10c3870f1ec3084a5ea1cb2917af50572b865a15d8faa8306fb9df9f

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kskinmgr.dll

Filesize
816KB

MD5
53de7a10d35eb29067271ac7b7b290f0

SHA1
a90dbc5ac916171f0c79e617012945f020382137

SHA256
8a19b8ea0aa65e41911a9f411cf93b9555ce5a8e308f5b37fc124e312b562938

SHA512
c0e1d557adcce95697c83cb5521f72d62f3f3bc77c4bd46aab32070bb796c33b4d09d9399fb969ed5af8dedd0f2b6b917fd36355d17d5a922a2200fb39795892

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kxescore.exe

Filesize
277KB

MD5
479263a138a81ac646a04a7ca1060821

SHA1
7bdd2ab8f03fd82d9c8e4e3c9af9ea1a365cd6d3

SHA256
bcd9860da984d0cf04a7ddbe7586c9b0d7207864abe203e80ade6f386d83b36d

SHA512
136121c3f1db93788021e910df1308ced47072a2a076e6d68773a5a1795ca62a075bf3d21dd318ce185dc7ddb6336c5300a71866f5c32f64a69e80931dea63d7

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kxescore.exe

Filesize
277KB

MD5
479263a138a81ac646a04a7ca1060821

SHA1
7bdd2ab8f03fd82d9c8e4e3c9af9ea1a365cd6d3

SHA256
bcd9860da984d0cf04a7ddbe7586c9b0d7207864abe203e80ade6f386d83b36d

SHA512
136121c3f1db93788021e910df1308ced47072a2a076e6d68773a5a1795ca62a075bf3d21dd318ce185dc7ddb6336c5300a71866f5c32f64a69e80931dea63d7

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kxescore.exe

Filesize
277KB

MD5
479263a138a81ac646a04a7ca1060821

SHA1
7bdd2ab8f03fd82d9c8e4e3c9af9ea1a365cd6d3

SHA256
bcd9860da984d0cf04a7ddbe7586c9b0d7207864abe203e80ade6f386d83b36d

SHA512
136121c3f1db93788021e910df1308ced47072a2a076e6d68773a5a1795ca62a075bf3d21dd318ce185dc7ddb6336c5300a71866f5c32f64a69e80931dea63d7

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kxescore.exe

Filesize
277KB

MD5
479263a138a81ac646a04a7ca1060821

SHA1
7bdd2ab8f03fd82d9c8e4e3c9af9ea1a365cd6d3

SHA256
bcd9860da984d0cf04a7ddbe7586c9b0d7207864abe203e80ade6f386d83b36d

SHA512
136121c3f1db93788021e910df1308ced47072a2a076e6d68773a5a1795ca62a075bf3d21dd318ce185dc7ddb6336c5300a71866f5c32f64a69e80931dea63d7

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kxetray.exe

Filesize
1.4MB

MD5
cee09dac2393fb81c34ea3c5ced75d31

SHA1
e2d5c7720c65b4dcd7f740104fc9f8890b68a494

SHA256
156920cf11f82d22ef2339b4a9525b2905ee496be6630c2a926eef39c3c77570

SHA512
c4710de9bc6c9f8c37ceebd600a9e9ac7c6c9dfa60d24ef4f36374cff3dc4054e6ca99e5ea9c41eed70d772d1acebf7da9ebd3b8c9ff93bcecacc8099554574f

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kxetray.exe

Filesize
1.4MB

MD5
cee09dac2393fb81c34ea3c5ced75d31

SHA1
e2d5c7720c65b4dcd7f740104fc9f8890b68a494

SHA256
156920cf11f82d22ef2339b4a9525b2905ee496be6630c2a926eef39c3c77570

SHA512
c4710de9bc6c9f8c37ceebd600a9e9ac7c6c9dfa60d24ef4f36374cff3dc4054e6ca99e5ea9c41eed70d772d1acebf7da9ebd3b8c9ff93bcecacc8099554574f

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kxetray.exe

Filesize
1.4MB

MD5
cee09dac2393fb81c34ea3c5ced75d31

SHA1
e2d5c7720c65b4dcd7f740104fc9f8890b68a494

SHA256
156920cf11f82d22ef2339b4a9525b2905ee496be6630c2a926eef39c3c77570

SHA512
c4710de9bc6c9f8c37ceebd600a9e9ac7c6c9dfa60d24ef4f36374cff3dc4054e6ca99e5ea9c41eed70d772d1acebf7da9ebd3b8c9ff93bcecacc8099554574f

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kxetray.exe

Filesize
1.4MB

MD5
cee09dac2393fb81c34ea3c5ced75d31

SHA1
e2d5c7720c65b4dcd7f740104fc9f8890b68a494

SHA256
156920cf11f82d22ef2339b4a9525b2905ee496be6630c2a926eef39c3c77570

SHA512
c4710de9bc6c9f8c37ceebd600a9e9ac7c6c9dfa60d24ef4f36374cff3dc4054e6ca99e5ea9c41eed70d772d1acebf7da9ebd3b8c9ff93bcecacc8099554574f

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\msvcp80.dll

Filesize
536KB

MD5
4c8a880eabc0b4d462cc4b2472116ea1

SHA1
d0a27f553c0fe0e507c7df079485b601d5b592e6

SHA256
2026f3c4f830dff6883b88e2647272a52a132f25eb42c0d423e36b3f65a94d08

SHA512
6a6cce8c232f46dab9b02d29be5e0675cc1e968e9c2d64d0abc008d20c0a7baeb103a5b1d9b348fa1c4b3af9797dbcb6e168b14b545fb15c2ccd926c3098c31c

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\msvcp80.dll

Filesize
536KB

MD5
4c8a880eabc0b4d462cc4b2472116ea1

SHA1
d0a27f553c0fe0e507c7df079485b601d5b592e6

SHA256
2026f3c4f830dff6883b88e2647272a52a132f25eb42c0d423e36b3f65a94d08

SHA512
6a6cce8c232f46dab9b02d29be5e0675cc1e968e9c2d64d0abc008d20c0a7baeb103a5b1d9b348fa1c4b3af9797dbcb6e168b14b545fb15c2ccd926c3098c31c

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\msvcp80.dll

Filesize
536KB

MD5
4c8a880eabc0b4d462cc4b2472116ea1

SHA1
d0a27f553c0fe0e507c7df079485b601d5b592e6

SHA256
2026f3c4f830dff6883b88e2647272a52a132f25eb42c0d423e36b3f65a94d08

SHA512
6a6cce8c232f46dab9b02d29be5e0675cc1e968e9c2d64d0abc008d20c0a7baeb103a5b1d9b348fa1c4b3af9797dbcb6e168b14b545fb15c2ccd926c3098c31c

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\msvcp80.dll

Filesize
536KB

MD5
4c8a880eabc0b4d462cc4b2472116ea1

SHA1
d0a27f553c0fe0e507c7df079485b601d5b592e6

SHA256
2026f3c4f830dff6883b88e2647272a52a132f25eb42c0d423e36b3f65a94d08

SHA512
6a6cce8c232f46dab9b02d29be5e0675cc1e968e9c2d64d0abc008d20c0a7baeb103a5b1d9b348fa1c4b3af9797dbcb6e168b14b545fb15c2ccd926c3098c31c

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\msvcp80.dll

Filesize
536KB

MD5
4c8a880eabc0b4d462cc4b2472116ea1

SHA1
d0a27f553c0fe0e507c7df079485b601d5b592e6

SHA256
2026f3c4f830dff6883b88e2647272a52a132f25eb42c0d423e36b3f65a94d08

SHA512
6a6cce8c232f46dab9b02d29be5e0675cc1e968e9c2d64d0abc008d20c0a7baeb103a5b1d9b348fa1c4b3af9797dbcb6e168b14b545fb15c2ccd926c3098c31c

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\msvcr80.dll

Filesize
612KB

MD5
e4fece18310e23b1d8fee993e35e7a6f

SHA1
9fd3a7f0522d36c2bf0e64fc510c6eea3603b564

SHA256
02bdde38e4c6bd795a092d496b8d6060cdbe71e22ef4d7a204e3050c1be44fa9

SHA512
2fb5f8d63a39ba5e93505df3a643d14e286fe34b11984cbed4b88e8a07517c03efb3a7bf9d61cf1ec73b0a20d83f9e6068e61950a61d649b8d36082bb034ddfc

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\msvcr80.dll

Filesize
612KB

MD5
e4fece18310e23b1d8fee993e35e7a6f

SHA1
9fd3a7f0522d36c2bf0e64fc510c6eea3603b564

SHA256
02bdde38e4c6bd795a092d496b8d6060cdbe71e22ef4d7a204e3050c1be44fa9

SHA512
2fb5f8d63a39ba5e93505df3a643d14e286fe34b11984cbed4b88e8a07517c03efb3a7bf9d61cf1ec73b0a20d83f9e6068e61950a61d649b8d36082bb034ddfc

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\msvcr80.dll

Filesize
612KB

MD5
e4fece18310e23b1d8fee993e35e7a6f

SHA1
9fd3a7f0522d36c2bf0e64fc510c6eea3603b564

SHA256
02bdde38e4c6bd795a092d496b8d6060cdbe71e22ef4d7a204e3050c1be44fa9

SHA512
2fb5f8d63a39ba5e93505df3a643d14e286fe34b11984cbed4b88e8a07517c03efb3a7bf9d61cf1ec73b0a20d83f9e6068e61950a61d649b8d36082bb034ddfc

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\msvcr80.dll

Filesize
612KB

MD5
e4fece18310e23b1d8fee993e35e7a6f

SHA1
9fd3a7f0522d36c2bf0e64fc510c6eea3603b564

SHA256
02bdde38e4c6bd795a092d496b8d6060cdbe71e22ef4d7a204e3050c1be44fa9

SHA512
2fb5f8d63a39ba5e93505df3a643d14e286fe34b11984cbed4b88e8a07517c03efb3a7bf9d61cf1ec73b0a20d83f9e6068e61950a61d649b8d36082bb034ddfc

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\msvcr80.dll

Filesize
612KB

MD5
e4fece18310e23b1d8fee993e35e7a6f

SHA1
9fd3a7f0522d36c2bf0e64fc510c6eea3603b564

SHA256
02bdde38e4c6bd795a092d496b8d6060cdbe71e22ef4d7a204e3050c1be44fa9

SHA512
2fb5f8d63a39ba5e93505df3a643d14e286fe34b11984cbed4b88e8a07517c03efb3a7bf9d61cf1ec73b0a20d83f9e6068e61950a61d649b8d36082bb034ddfc

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\operation\cas\kinfoc.dll

Filesize
166KB

MD5
170899a660d5d4a350edf80c77334136

SHA1
8119313e8a998ad83ee6a13ef88b6fa1c2a0fcae

SHA256
3672f758b4e875a66b2d95721c89a5ddd7d0eef27b10db254f321041c9f6cf43

SHA512
a87f2fe159f5cae36feda263f10473c7a0df0ddb5c4b82ded1d55b43d4223a4d03ce2a5b7254400d89cff2583f28c793dad2e8cc19cf98a54c42644f08ff7fd3

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\security\ksde\kisknl.sys

Filesize
259KB

MD5
1636dd864151388451acb8b2fc1fccb8

SHA1
06e3ac51140a1f7c35f79f8c69e997919838bd01

SHA256
859bdfd8e8f067c3d2328e3cc910d906d07298fd2a5ffc9e89f22df61c499126

SHA512
694911e645fc982ec31aba9283c5e247a93d05b378a3e6eee1374d7f405257bef0e665f58fe29f1dd8417169373a772b6015548c1dc4643266a457b283dcaf10

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\security\ksde\kisknl.sys

Filesize
259KB

MD5
1636dd864151388451acb8b2fc1fccb8

SHA1
06e3ac51140a1f7c35f79f8c69e997919838bd01

SHA256
859bdfd8e8f067c3d2328e3cc910d906d07298fd2a5ffc9e89f22df61c499126

SHA512
694911e645fc982ec31aba9283c5e247a93d05b378a3e6eee1374d7f405257bef0e665f58fe29f1dd8417169373a772b6015548c1dc4643266a457b283dcaf10

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\uni0nst.exe

Filesize
842KB

MD5
c833984034607e01850987d075f4c3b9

SHA1
c5cb941666198a1678c88faf22be0a1b0b007813

SHA256
c6027958286a3f1a0e5ff5e104d461c6a1df7e1d0a828ab78fffa506ee2cc294

SHA512
918e3fee2fae74e8f278277774d8237c658b3d7c994ec20640c81667e66671a3029bdf7ff8e9fcfdbff8f1b2d8f98bd5492d5a3200d516a47db19a2ecce72d59

Download Submit
\Users\Admin\AppData\Local\Temp\sbnimb.tmp\dtstop.tmp\duba_1_244.exe

Filesize
16.8MB

MD5
1f1c87b2b8528523907cc58c00923df8

SHA1
ea0f7ad5e2d0bc48e52ea9e00c56dc14ea026514

SHA256
37e29c28eb4a4753f6926c2f7dfd169a09e184264f537c64893637716237733a

SHA512
2a8d2107eb8d479d8378c780389278e2d20653954d93dea72700b9bb9c21bc7ecf826243c1aadf8a6bc2705cc9d0055a01cf24c32a8ba38cca87ca51abd66fbc

Download Submit
\Users\Admin\AppData\Local\Temp\sbnimb.tmp\dtstop.tmp\duba_1_244.exe

Filesize
16.8MB

MD5
1f1c87b2b8528523907cc58c00923df8

SHA1
ea0f7ad5e2d0bc48e52ea9e00c56dc14ea026514

SHA256
37e29c28eb4a4753f6926c2f7dfd169a09e184264f537c64893637716237733a

SHA512
2a8d2107eb8d479d8378c780389278e2d20653954d93dea72700b9bb9c21bc7ecf826243c1aadf8a6bc2705cc9d0055a01cf24c32a8ba38cca87ca51abd66fbc

Download Submit
\Users\Admin\AppData\Local\Temp\sbnimb.tmp\dtstop.tmp\duba_1_244.exe

Filesize
16.8MB

MD5
1f1c87b2b8528523907cc58c00923df8

SHA1
ea0f7ad5e2d0bc48e52ea9e00c56dc14ea026514

SHA256
37e29c28eb4a4753f6926c2f7dfd169a09e184264f537c64893637716237733a

SHA512
2a8d2107eb8d479d8378c780389278e2d20653954d93dea72700b9bb9c21bc7ecf826243c1aadf8a6bc2705cc9d0055a01cf24c32a8ba38cca87ca51abd66fbc

Download Submit
\Users\Admin\AppData\Local\Temp\sbnimb.tmp\dtstop.tmp\install1968982.exe

Filesize
4.6MB

MD5
512fe2eb54dde3c922ce73c075a592a1

SHA1
4332a256f0a77381ecd11e823475c335691325d7

SHA256
110f6a132f05a0d7b31d449beb75c7b22cd1fd409d50b32ded10e8ac305d852e

SHA512
a3f6fda13e054d5f3f52f0b62895c94b467b32e5811bf52e91c7c747554204af150c0bddce229bcd4b912c575079376ffdd02dbe281d2a59f1f6824b464b993e

Download Submit
\Users\Admin\AppData\Local\Temp\sbnimb.tmp\dtstop.tmp\install1968982.exe

Filesize
4.6MB

MD5
512fe2eb54dde3c922ce73c075a592a1

SHA1
4332a256f0a77381ecd11e823475c335691325d7

SHA256
110f6a132f05a0d7b31d449beb75c7b22cd1fd409d50b32ded10e8ac305d852e

SHA512
a3f6fda13e054d5f3f52f0b62895c94b467b32e5811bf52e91c7c747554204af150c0bddce229bcd4b912c575079376ffdd02dbe281d2a59f1f6824b464b993e

Download Submit
\Users\Admin\AppData\Local\Temp\sbnimb.tmp\dtstop.tmp\install1968982.exe

Filesize
4.6MB

MD5
512fe2eb54dde3c922ce73c075a592a1

SHA1
4332a256f0a77381ecd11e823475c335691325d7

SHA256
110f6a132f05a0d7b31d449beb75c7b22cd1fd409d50b32ded10e8ac305d852e

SHA512
a3f6fda13e054d5f3f52f0b62895c94b467b32e5811bf52e91c7c747554204af150c0bddce229bcd4b912c575079376ffdd02dbe281d2a59f1f6824b464b993e

Download Submit
memory/856-215-0x00000000032F0000-0x00000000033FA000-memory.dmp

Filesize
1.0MB

Download
memory/856-85-0x0000000000400000-0x0000000000600000-memory.dmp

Filesize
2.0MB

Download
memory/856-202-0x0000000000A60000-0x0000000000C60000-memory.dmp

Filesize
2.0MB

Download
memory/856-88-0x0000000000A60000-0x0000000000C60000-memory.dmp

Filesize
2.0MB

Download
memory/856-86-0x0000000000A60000-0x0000000000C60000-memory.dmp

Filesize
2.0MB

Download
memory/856-201-0x0000000000400000-0x0000000000600000-memory.dmp

Filesize
2.0MB

Download
memory/856-204-0x0000000002D20000-0x0000000002D55000-memory.dmp

Filesize
212KB

Download
memory/856-205-0x0000000002D20000-0x0000000002D64000-memory.dmp

Filesize
272KB

Download
memory/856-219-0x0000000002B30000-0x0000000002B49000-memory.dmp

Filesize
100KB

Download
memory/856-217-0x00000000023B0000-0x00000000023DE000-memory.dmp

Filesize
184KB

Download
memory/856-203-0x0000000002050000-0x000000000205E000-memory.dmp

Filesize
56KB

Download
memory/1164-172-0x0000000000ED0000-0x0000000000EFB000-memory.dmp

Filesize
172KB

Download
memory/1164-188-0x0000000000F10000-0x0000000000F21000-memory.dmp

Filesize
68KB

Download
memory/1164-182-0x0000000000F10000-0x0000000000F21000-memory.dmp

Filesize
68KB

Download
memory/1164-183-0x0000000000F30000-0x0000000000F42000-memory.dmp

Filesize
72KB

Download
memory/1164-180-0x0000000003230000-0x0000000003384000-memory.dmp

Filesize
1.3MB

Download
memory/1164-191-0x0000000004290000-0x00000000043B2000-memory.dmp

Filesize
1.1MB

Download
memory/1164-213-0x0000000002030000-0x000000000204C000-memory.dmp

Filesize
112KB

Download
memory/1164-190-0x0000000001480000-0x000000000149A000-memory.dmp

Filesize
104KB

Download
memory/1164-159-0x0000000000140000-0x000000000014E000-memory.dmp

Filesize
56KB

Download
memory/1164-209-0x0000000001B70000-0x0000000001B89000-memory.dmp

Filesize
100KB

Download
memory/1164-162-0x0000000000D60000-0x0000000000D8B000-memory.dmp

Filesize
172KB

Download
memory/1164-184-0x00000000012C0000-0x00000000012D8000-memory.dmp

Filesize
96KB

Download
memory/1164-160-0x0000000000CF0000-0x0000000000D1A000-memory.dmp

Filesize
168KB

Download
memory/1164-222-0x0000000003A70000-0x0000000003AB9000-memory.dmp

Filesize
292KB

Download
memory/1164-247-0x0000000000F10000-0x0000000000F21000-memory.dmp

Filesize
68KB

Download
memory/1452-174-0x0000000003C60000-0x0000000003D82000-memory.dmp

Filesize
1.1MB

Download
memory/1452-193-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1452-155-0x0000000002600000-0x0000000002793000-memory.dmp

Filesize
1.6MB

Download
memory/1452-199-0x0000000004780000-0x0000000004901000-memory.dmp

Filesize
1.5MB

Download
memory/1452-164-0x0000000002A10000-0x0000000002A28000-memory.dmp

Filesize
96KB

Download
memory/1452-197-0x0000000003F00000-0x0000000003F11000-memory.dmp

Filesize
68KB

Download
memory/1452-196-0x0000000003F00000-0x0000000003F11000-memory.dmp

Filesize
68KB

Download
memory/1452-176-0x0000000002B70000-0x0000000002B9A000-memory.dmp

Filesize
168KB

Download
memory/1452-178-0x0000000003D90000-0x0000000003DBB000-memory.dmp

Filesize
172KB

Download
memory/1452-195-0x0000000003F00000-0x0000000003F11000-memory.dmp

Filesize
68KB

Download
memory/1452-157-0x00000000027A0000-0x0000000002A08000-memory.dmp

Filesize
2.4MB

Download
memory/1452-194-0x0000000003F00000-0x0000000003F11000-memory.dmp

Filesize
68KB

Download
memory/1452-225-0x0000000005020000-0x000000000524E000-memory.dmp

Filesize
2.2MB

Download
memory/1452-224-0x0000000005021000-0x000000000514A000-memory.dmp

Filesize
1.2MB

Download
memory/1504-55-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1504-56-0x0000000000020000-0x0000000000034000-memory.dmp

Filesize
80KB

Download
memory/1504-84-0x0000000003C70000-0x0000000003E70000-memory.dmp

Filesize
2.0MB

Download
memory/1504-57-0x0000000000020000-0x0000000000034000-memory.dmp

Filesize
80KB

Download
memory/1504-62-0x0000000003B70000-0x0000000003C8E000-memory.dmp

Filesize
1.1MB

Download
memory/1504-89-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1504-54-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download
memory/1504-82-0x0000000003B70000-0x0000000003C8E000-memory.dmp

Filesize
1.1MB

Download
memory/1504-58-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1540-132-0x00000000021D0000-0x00000000021EA000-memory.dmp

Filesize
104KB

Download
memory/1540-148-0x0000000002AC0000-0x0000000002B8D000-memory.dmp

Filesize
820KB

Download
memory/1600-69-0x00000000002E0000-0x00000000003FE000-memory.dmp

Filesize
1.1MB

Download
memory/1600-68-0x00000000002E0000-0x00000000003FE000-memory.dmp

Filesize
1.1MB

Download
memory/1600-63-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/1600-72-0x0000000002930000-0x00000000029B9000-memory.dmp

Filesize
548KB

Download
memory/1600-73-0x0000000002930000-0x00000000029B9000-memory.dmp

Filesize
548KB

Download
memory/1600-83-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/1600-189-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/1600-187-0x0000000002930000-0x00000000029B9000-memory.dmp

Filesize
548KB

Download
memory/1600-186-0x0000000002930000-0x00000000029B9000-memory.dmp

Filesize
548KB

Download