joker | 18cc13c1471ee634a087a1562dd58e848bb37077043150bd28cc334fff5ce0c3

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 09:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

18cc13c1471ee634a087a1562dd58e848bb37077043150bd28cc334fff5ce0c3.exe
Size

27KB
MD5

1932bdb6062dfa590b4ab9da45cd9bb0
SHA1

e20891fb56e40ff49feb9c8183329386ed4a0c98
SHA256

18cc13c1471ee634a087a1562dd58e848bb37077043150bd28cc334fff5ce0c3
SHA512

1626011f178d94adf13a75abe6a46da4144abe6fd8e9335b41bef583e331533847a05b05524d8ea6e290b93435567ad74fd6eda85f91633365ba39db7a414298
SSDEEP

768:rntDssLlSB16cM7lVO5HrttXntC9yoYf:rnRLl08/cHrtg+

Score

10^/10

joker bootkit discovery infostealer persistence trojan upx

Malware Config

Extracted

Family

joker

http://mmtie.oss-cn-hangzhou.aliyuncs.com

Signatures

joker
Joker is an Android malware that targets billing and SMS fraud.
infostealer trojan joker
Downloads MZ/PE file

Drops file in Drivers directory 20 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\bc.sys	duba_1_244.exe
File created	C:\Windows\system32\drivers\ksskrpr.sys	duba_1_244.exe
File created	C:\Windows\system32\drivers\rsutils.sys	install1968982.exe
File opened for modification	C:\Windows\system32\drivers\bc.sys	duba_1_244.exe
File created	C:\Windows\system32\drivers\rsndisp.sys	install1968982.exe
File opened for modification	C:\Windows\system32\drivers\sysmon.sys	install1968982.exe
File created	C:\Windows\system32\drivers\sysmon.sys	install1968982.exe
File opened for modification	C:\Windows\SysWOW64\drivers\kisknl.sys	kxescore.exe
File opened for modification	C:\Windows\system32\drivers\kisknl.sys	kxescore.exe
File opened for modification	C:\Windows\SysWOW64\drivers\KAVBase.sys	duba_1_244.exe
File created	C:\Windows\system32\drivers\kisknl.sys	duba_1_244.exe
File created	C:\Windows\system32\drivers\kisnetm64.sys	duba_1_244.exe
File created	C:\Windows\system32\drivers\kisnetmxp.sys	duba_1_244.exe
File opened for modification	C:\Windows\system32\drivers\rsutils.sys	install1968982.exe
File opened for modification	C:\Windows\system32\drivers\rsndisp.sys	install1968982.exe
File created	C:\Windows\system32\drivers\kisknl.sys	kxescore.exe
File created	C:\Windows\system32\drivers\kisknl64.sys	duba_1_244.exe
File created	C:\Windows\system32\drivers\kisnetm.sys	duba_1_244.exe
File created	C:\Windows\system32\drivers\ksapi.sys	duba_1_244.exe
File created	C:\Windows\system32\drivers\ksapi64.sys	duba_1_244.exe

Executes dropped EXE 13 IoCs

pid	Process
1512	install1968982.exe
1936	duba_1_244.exe
1808	RsMgrSvc.exe
2016	popwndexe.exe
728	kavlog2.exe
628	kxetray.exe
1756	kxescore.exe
2036	kislive.exe
536	kxescore.exe
652	kxetray.exe
2188	kwsprotect64.exe
2276	ravmond.exe
2308	ravmond.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32	duba_1_244.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32\ = "c:\\program files (x86)\\kingsoft\\kingsoft antivirus\\kavmenu64.dll"	duba_1_244.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32\ThreadingModel = "Apartment"	duba_1_244.exe

Sets file execution options in registry 2 TTPs 28 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KSIGNSP.EXE	duba_1_244.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KXETRAY.EXE	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kismain.exe	duba_1_244.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KSCAN.EXE	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uninst.exe	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ksetupwiz.exe	duba_1_244.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KSETUPWIZ.EXE	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kxetray.exe	duba_1_244.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UNINST.EXE	duba_1_244.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISADDIN.EXE	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\krecycle.exe	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavlog2.exe	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ksignsp.exe	duba_1_244.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISMAIN.EXE	duba_1_244.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCOMREGSVRV8.EXE	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scomregsvrv8.exe	duba_1_244.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRECYCLE.EXE	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kxescore.exe	duba_1_244.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISCALL.EXE	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kscan.exe	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kdrvmgr.exe	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kiscall.exe	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kisaddin.exe	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kislive.exe	duba_1_244.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISLIVE.EXE	duba_1_244.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KXESCORE.EXE	duba_1_244.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVLOG2.EXE	duba_1_244.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KDRVMGR.EXE	duba_1_244.exe

Sets service image path in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\kisknl\ImagePath = "\\??\\C:\\Windows\\system32\\drivers\\kisknl.sys"	kxescore.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\kisknl\ImagePath = "\\??\\C:\\Windows\\system32\\drivers\\kisknl.sys"	kxescore.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1444-55-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/files/0x00070000000126a6-58.dat	upx
behavioral1/files/0x00070000000126a6-60.dat	upx
behavioral1/files/0x00070000000126a6-62.dat	upx
behavioral1/files/0x00070000000126a6-63.dat	upx
behavioral1/files/0x00070000000126a6-64.dat	upx
behavioral1/memory/1512-66-0x0000000000400000-0x0000000000600000-memory.dmp	upx
behavioral1/files/0x0008000000012330-97.dat	upx
behavioral1/files/0x0008000000012330-104.dat	upx
behavioral1/files/0x0008000000012330-107.dat	upx
behavioral1/files/0x0008000000012330-108.dat	upx
behavioral1/files/0x0008000000012330-109.dat	upx
behavioral1/memory/1936-112-0x0000000000400000-0x000000000051E000-memory.dmp	upx
behavioral1/memory/1444-118-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/memory/1512-120-0x0000000000400000-0x0000000000600000-memory.dmp	upx
behavioral1/memory/1936-171-0x0000000003E50000-0x0000000003ED9000-memory.dmp	upx
behavioral1/memory/1936-231-0x0000000000400000-0x000000000051E000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
1560	cmd.exe

Loads dropped DLL 64 IoCs

pid	Process
1444	18cc13c1471ee634a087a1562dd58e848bb37077043150bd28cc334fff5ce0c3.exe
1512	install1968982.exe
1512	install1968982.exe
1512	install1968982.exe
1512	install1968982.exe
1512	install1968982.exe
1512	install1968982.exe
1512	install1968982.exe
1512	install1968982.exe
1512	install1968982.exe
1512	install1968982.exe
1512	install1968982.exe
1512	install1968982.exe
1512	install1968982.exe
1512	install1968982.exe
1512	install1968982.exe
1444	18cc13c1471ee634a087a1562dd58e848bb37077043150bd28cc334fff5ce0c3.exe
1512	install1968982.exe
1512	install1968982.exe
1936	duba_1_244.exe
1936	duba_1_244.exe
1512	install1968982.exe
1808	RsMgrSvc.exe
1808	RsMgrSvc.exe
1512	install1968982.exe
2016	popwndexe.exe
2016	popwndexe.exe
2016	popwndexe.exe
2016	popwndexe.exe
1936	duba_1_244.exe
1936	duba_1_244.exe
1936	duba_1_244.exe
1936	duba_1_244.exe
1936	duba_1_244.exe
1936	duba_1_244.exe
1936	duba_1_244.exe
1936	duba_1_244.exe
1936	duba_1_244.exe
1936	duba_1_244.exe
1936	duba_1_244.exe
1936	duba_1_244.exe
728	kavlog2.exe
1936	duba_1_244.exe
728	kavlog2.exe
728	kavlog2.exe
728	kavlog2.exe
628	kxetray.exe
1936	duba_1_244.exe
628	kxetray.exe
628	kxetray.exe
628	kxetray.exe
1936	duba_1_244.exe
2036	kislive.exe
2036	kislive.exe
628	kxetray.exe
1756	kxescore.exe
1756	kxescore.exe
1756	kxescore.exe
1756	kxescore.exe
536	kxescore.exe
536	kxescore.exe
628	kxetray.exe
2036	kislive.exe
2036	kislive.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	install1968982.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RSDTRAY = "\"C:\\Program Files (x86)\\Rising\\RSD\\popwndexe.exe\""	install1968982.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	duba_1_244.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kxesc = "\"c:\\program files (x86)\\kingsoft\\kingsoft antivirus\\kxetray.exe\" -autorun"	duba_1_244.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\desktop.ini	duba_1_244.exe
File opened for modification	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\desktop.ini	duba_1_244.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\desktop.ini	install1968982.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	install1968982.exe
File opened for modification	\??\PhysicalDrive0	duba_1_244.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\KAVEventLog.EVT	kavlog2.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Rising\RSD\RsStub.exe	install1968982.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\ksbwdet2.dll	duba_1_244.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVBASE\repairmanager.mond	install1968982.exe
File created	C:\Program Files (x86)\Rising\RAV\rsnscfg.dat	install1968982.exe
File created	C:\Program Files (x86)\Rising\RAV\XMLS\RAVLOG.xml	install1968982.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\duba123new.ico	duba_1_244.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxeksgpid.kid	duba_1_244.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\MONBASEDUI\MONBASEDUI.xml	install1968982.exe
File created	C:\Program Files (x86)\Rising\RAV\rscurl.dll	install1968982.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\12345678.000	install1968982.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\XMLS\RSDK.xml	install1968982.exe
File created	C:\Program Files (x86)\Rising\RAV\rstask.xml	install1968982.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\syslay.dll	install1968982.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\cloudstore.dll	install1968982.exe
File created	C:\Program Files (x86)\Rising\RSD\syslay.dll	install1968982.exe
File created	C:\Program Files (x86)\Rising\RSD\RsMgrSvc.dat	RsMgrSvc.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\ksedset.ini	duba_1_244.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RSDK\rsxml3w.dll	install1968982.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAV936\RAV936.xml	install1968982.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RSD\RSSetup\rsdk.dll	install1968982.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\lpolicy.dat	duba_1_244.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\kavquara.dll	duba_1_244.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kspupwnd.dll	duba_1_244.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RSCFG\RSCFG.xml	install1968982.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVMAINDUI\RAVMAINDUI.xml	install1968982.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVMAINDUI\RAVMAINDUI.xml	install1968982.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RSCOMM\rscommx2.dll	install1968982.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\rssrv.dll	install1968982.exe
File created	C:\Program Files (x86)\Rising\RAV\rspalvd.dll	install1968982.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\XMLS\RSCOMM.xml	install1968982.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\MSCRT9\msvcp90.dll	install1968982.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RSCOMM\cnt09.dll	install1968982.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVXP\RAVXP.xml	install1968982.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\CLOUDV3\localopt.dll	install1968982.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\ksde\kisknl.sys	duba_1_244.exe
File created	C:\Program Files (x86)\Rising\RAV\cfgxml\mond.xml	install1968982.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\rav936\lics936.txt	install1968982.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\rssqlite.dll	install1968982.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\kfcdetect.dll	duba_1_244.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\ksreng3.dll	duba_1_244.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\HOOKBASE\mondrv.dll	install1968982.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RAV\LICENSE\LICENSE.xml	install1968982.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVBASE\RsTray.ico	install1968982.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\dataups.dat	install1968982.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\operation\cas\kinfoc.dll	duba_1_244.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\MONBASEDUI\ravmond.exe	install1968982.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\CLOUDV3\dataups.dat	install1968982.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\RsTray.ico	install1968982.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\log\ksdectrl_trace.log	kxescore.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RSD\RSSetup\RsAppMgr.dll	install1968982.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RSD\RSSetup\popwndexe.exe	install1968982.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RAV\CLOUDQRY\cloudnet.dll	install1968982.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\msvcp80.dll	duba_1_244.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVCONFIG\RAVCONFIG.xml	install1968982.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\ksnetm\kisnetm.sys	duba_1_244.exe
File opened for modification	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\	duba_1_244.exe
File opened for modification	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\kfcdetect.dll.log	kxetray.exe
File created	C:\Program Files (x86)\Rising\RAV\XMLS\setup.xml	install1968982.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\CCenter.db-journal	ravmond.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RSD\RSSetup\RsAppMgr.dll	install1968982.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RSD\RSSetup\RsMgrSvc.exe	install1968982.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RSD\RSSetup\RstoreDll.dll	install1968982.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVMAINDUI\rsmain.exe	install1968982.exe
File created	C:\Program Files (x86)\Rising\RAV\repairmanager.dll	install1968982.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
1188	taskkill.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idno = "1"	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}	kxetray.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1CF8F61-AB1D-11d4-ABBD-0050BACEC828}\RzNBMlVLLUswUDBORC1MMEVGU1UtRkg1MzAw\ProcInfo = "1667734333"	install1968982.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex	duba_1_244.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers\duba_64bit\ = "{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}"	duba_1_244.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}\InprocServer32\ = "c:\\program files (x86)\\kingsoft\\kingsoft antivirus\\kavmenu.dll"	duba_1_244.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idno = "0"	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}	kxescore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}	duba_1_244.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32\ = "c:\\program files (x86)\\kingsoft\\kingsoft antivirus\\kavmenu64.dll"	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers\duba_64bit	duba_1_244.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\duba_32bit\ = "{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}"	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1CF8F61-AB1D-11d4-ABBD-0050BACEC828}\RzNBMlVLLUswUDBORC1MMEVGU1UtRkg1MzAw	install1968982.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1CF8F61-AB1D-11d4-ABBD-0050BACEC828}	install1968982.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC3909C5-DC79-47e5-86CA-7FB5C041A37C}	install1968982.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC3909C5-DC79-47e5-86CA-7FB5C041A37C}\InstallPath = "5uUnkuqGVn0HFSEZMmAREzRuL388KQ8lFHEHGzAF"	install1968982.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\duba_32bit\ = "{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}"	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\Shellex\ContextMenuHandlers\duba_64bit	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers\duba_32bit	duba_1_244.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idex = "104b87b58c8c27d46c4e632f44584225"	duba_1_244.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories	duba_1_244.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\mid = "1872602433"	duba_1_244.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC3909C5-DC79-47e5-86CA-7FB5C041A37C}\RAV = "5uUnkuqGIWwDsw=="	install1968982.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC3909C5-DC79-47e5-86CA-7FB5C041A37C}\monServerName = "5uUnkuqGIV4HOxAGHENN"	install1968982.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}\InprocServer32	duba_1_244.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers\duba_32bit\ = "{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}"	duba_1_244.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\duba_32bit\ = "{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}"	duba_1_244.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\duba_64bit\ = "{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}"	duba_1_244.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\mid = "1872602433"	duba_1_244.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idno = "1"	kxetray.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAA2D3B1-4BB5-4a45-A17A-122773379D99}\ProcID = "{CFE18630-4454-1B29-3030-303133000000}"	install1968982.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC3909C5-DC79-47e5-86CA-7FB5C041A37C}\ravmonexe = "5uUnkuqGAUwjNwklFwMwIgMs"	install1968982.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\duba_32bit	duba_1_244.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\svrid = "fgohosxjslvkfpz4cl2c7ep2gsmu"	duba_1_244.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	install1968982.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC3909C5-DC79-47e5-86CA-7FB5C041A37C}\rstrayexe = "5uUnkuqGAV4hKAcyXUgtP3M="	install1968982.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}\InprocServer32\ThreadingModel = "Apartment"	duba_1_244.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\svrid = "fgohosxjslvkfpz4cl2c7ep2gsmu"	duba_1_244.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC3909C5-DC79-47e5-86CA-7FB5C041A37C}\monShowName = "5uUnkuqGIUwjejUuAVs8OQNR"	install1968982.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\Shellex\ContextMenuHandlers\duba_64bit	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\duba_32bit	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	install1968982.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1CF8F61-AB1D-11d4-ABBD-0050BACEC828}\RzNBMlVLLUswUDBORC1MMEVGU1UtRkg1MzAw\ProcKind = "5"	install1968982.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}	duba_1_244.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC3909C5-DC79-47e5-86CA-7FB5C041A37C}\regtray = "5uUnkuqGIUwjDjQKKkQ="	install1968982.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	duba_1_244.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1CF8F61-AB1D-11d4-ABBD-0050BACEC828}\RzNBMlVLLUswUDBORC1MMEVGU1UtRkg1MzAw\ProcDll = "1699356733"	install1968982.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1CF8F61-AB1D-11d4-ABBD-0050BACEC828}\ProcKey = "RzNBMlVLLUswUDBORC1MMEVGU1UtRkg1MzAw"	install1968982.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC3909C5-DC79-47e5-86CA-7FB5C041A37C}\Title = "5uUnkuqGu92Fndb5u4adt9q14A=="	install1968982.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}	duba_1_244.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idex = "104b87b58c8c27d46c4e632f44584225"	kxetray.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAA2D3B1-4BB5-4a45-A17A-122773379D99}	install1968982.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\duba_64bit\ = "{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}"	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\duba_32bit	duba_1_244.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\duba_64bit\ = "{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}"	duba_1_244.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}\ = "CKavMenuShell Class"	duba_1_244.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}	duba_1_244.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1512	install1968982.exe
2016	popwndexe.exe
1936	duba_1_244.exe
1936	duba_1_244.exe
536	kxescore.exe
652	kxetray.exe
652	kxetray.exe
536	kxescore.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeBackupPrivilege	1808	RsMgrSvc.exe
Token: SeDebugPrivilege	1188	taskkill.exe
Token: SeDebugPrivilege	1936	duba_1_244.exe
Token: SeDebugPrivilege	1512	install1968982.exe
Token: SeDebugPrivilege	2036	kislive.exe
Token: SeDebugPrivilege	1936	duba_1_244.exe
Token: SeDebugPrivilege	536	kxescore.exe
Token: SeDebugPrivilege	652	kxetray.exe
Token: 33	536	kxescore.exe
Token: SeIncBasePriorityPrivilege	536	kxescore.exe
Token: SeDebugPrivilege	652	kxetray.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
652	kxetray.exe
652	kxetray.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
652	kxetray.exe
652	kxetray.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2188	kwsprotect64.exe
2188	kwsprotect64.exe
652	kxetray.exe
652	kxetray.exe
652	kxetray.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 1512	1444	18cc13c1471ee634a087a1562dd58e848bb37077043150bd28cc334fff5ce0c3.exe	30
PID 1444 wrote to memory of 1512	1444	18cc13c1471ee634a087a1562dd58e848bb37077043150bd28cc334fff5ce0c3.exe	30
PID 1444 wrote to memory of 1512	1444	18cc13c1471ee634a087a1562dd58e848bb37077043150bd28cc334fff5ce0c3.exe	30
PID 1444 wrote to memory of 1512	1444	18cc13c1471ee634a087a1562dd58e848bb37077043150bd28cc334fff5ce0c3.exe	30
PID 1444 wrote to memory of 1512	1444	18cc13c1471ee634a087a1562dd58e848bb37077043150bd28cc334fff5ce0c3.exe	30
PID 1444 wrote to memory of 1512	1444	18cc13c1471ee634a087a1562dd58e848bb37077043150bd28cc334fff5ce0c3.exe	30
PID 1444 wrote to memory of 1512	1444	18cc13c1471ee634a087a1562dd58e848bb37077043150bd28cc334fff5ce0c3.exe	30
PID 1444 wrote to memory of 1936	1444	18cc13c1471ee634a087a1562dd58e848bb37077043150bd28cc334fff5ce0c3.exe	33
PID 1444 wrote to memory of 1936	1444	18cc13c1471ee634a087a1562dd58e848bb37077043150bd28cc334fff5ce0c3.exe	33
PID 1444 wrote to memory of 1936	1444	18cc13c1471ee634a087a1562dd58e848bb37077043150bd28cc334fff5ce0c3.exe	33
PID 1444 wrote to memory of 1936	1444	18cc13c1471ee634a087a1562dd58e848bb37077043150bd28cc334fff5ce0c3.exe	33
PID 1444 wrote to memory of 1936	1444	18cc13c1471ee634a087a1562dd58e848bb37077043150bd28cc334fff5ce0c3.exe	33
PID 1444 wrote to memory of 1936	1444	18cc13c1471ee634a087a1562dd58e848bb37077043150bd28cc334fff5ce0c3.exe	33
PID 1444 wrote to memory of 1936	1444	18cc13c1471ee634a087a1562dd58e848bb37077043150bd28cc334fff5ce0c3.exe	33
PID 1444 wrote to memory of 1560	1444	18cc13c1471ee634a087a1562dd58e848bb37077043150bd28cc334fff5ce0c3.exe	34
PID 1444 wrote to memory of 1560	1444	18cc13c1471ee634a087a1562dd58e848bb37077043150bd28cc334fff5ce0c3.exe	34
PID 1444 wrote to memory of 1560	1444	18cc13c1471ee634a087a1562dd58e848bb37077043150bd28cc334fff5ce0c3.exe	34
PID 1444 wrote to memory of 1560	1444	18cc13c1471ee634a087a1562dd58e848bb37077043150bd28cc334fff5ce0c3.exe	34
PID 1444 wrote to memory of 1560	1444	18cc13c1471ee634a087a1562dd58e848bb37077043150bd28cc334fff5ce0c3.exe	34
PID 1444 wrote to memory of 1560	1444	18cc13c1471ee634a087a1562dd58e848bb37077043150bd28cc334fff5ce0c3.exe	34
PID 1444 wrote to memory of 1560	1444	18cc13c1471ee634a087a1562dd58e848bb37077043150bd28cc334fff5ce0c3.exe	34
PID 1560 wrote to memory of 1188	1560	cmd.exe	37
PID 1560 wrote to memory of 1188	1560	cmd.exe	37
PID 1560 wrote to memory of 1188	1560	cmd.exe	37
PID 1560 wrote to memory of 1188	1560	cmd.exe	37
PID 1560 wrote to memory of 1188	1560	cmd.exe	37
PID 1560 wrote to memory of 1188	1560	cmd.exe	37
PID 1560 wrote to memory of 1188	1560	cmd.exe	37
PID 1512 wrote to memory of 2016	1512	install1968982.exe	38
PID 1512 wrote to memory of 2016	1512	install1968982.exe	38
PID 1512 wrote to memory of 2016	1512	install1968982.exe	38
PID 1512 wrote to memory of 2016	1512	install1968982.exe	38
PID 1512 wrote to memory of 2016	1512	install1968982.exe	38
PID 1512 wrote to memory of 2016	1512	install1968982.exe	38
PID 1512 wrote to memory of 2016	1512	install1968982.exe	38
PID 1936 wrote to memory of 728	1936	duba_1_244.exe	39
PID 1936 wrote to memory of 728	1936	duba_1_244.exe	39
PID 1936 wrote to memory of 728	1936	duba_1_244.exe	39
PID 1936 wrote to memory of 728	1936	duba_1_244.exe	39
PID 1936 wrote to memory of 728	1936	duba_1_244.exe	39
PID 1936 wrote to memory of 728	1936	duba_1_244.exe	39
PID 1936 wrote to memory of 728	1936	duba_1_244.exe	39
PID 1936 wrote to memory of 628	1936	duba_1_244.exe	40
PID 1936 wrote to memory of 628	1936	duba_1_244.exe	40
PID 1936 wrote to memory of 628	1936	duba_1_244.exe	40
PID 1936 wrote to memory of 628	1936	duba_1_244.exe	40
PID 1936 wrote to memory of 628	1936	duba_1_244.exe	40
PID 1936 wrote to memory of 628	1936	duba_1_244.exe	40
PID 1936 wrote to memory of 628	1936	duba_1_244.exe	40
PID 1936 wrote to memory of 1756	1936	duba_1_244.exe	41
PID 1936 wrote to memory of 1756	1936	duba_1_244.exe	41
PID 1936 wrote to memory of 1756	1936	duba_1_244.exe	41
PID 1936 wrote to memory of 1756	1936	duba_1_244.exe	41
PID 1936 wrote to memory of 1756	1936	duba_1_244.exe	41
PID 1936 wrote to memory of 1756	1936	duba_1_244.exe	41
PID 1936 wrote to memory of 1756	1936	duba_1_244.exe	41
PID 1936 wrote to memory of 2036	1936	duba_1_244.exe	42
PID 1936 wrote to memory of 2036	1936	duba_1_244.exe	42
PID 1936 wrote to memory of 2036	1936	duba_1_244.exe	42
PID 1936 wrote to memory of 2036	1936	duba_1_244.exe	42
PID 1936 wrote to memory of 2036	1936	duba_1_244.exe	42
PID 1936 wrote to memory of 2036	1936	duba_1_244.exe	42
PID 1936 wrote to memory of 2036	1936	duba_1_244.exe	42
PID 628 wrote to memory of 652	628	kxetray.exe	46

C:\Users\Admin\AppData\Local\Temp\18cc13c1471ee634a087a1562dd58e848bb37077043150bd28cc334fff5ce0c3.exe
"C:\Users\Admin\AppData\Local\Temp\18cc13c1471ee634a087a1562dd58e848bb37077043150bd28cc334fff5ce0c3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Users\Admin\AppData\Local\Temp\sbnimb.tmp\dtstop.tmp\install1968982.exe
  "C:\Users\Admin\AppData\Local\Temp\sbnimb.tmp\dtstop.tmp\install1968982.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Writes to the Master Boot Record (MBR)
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Program Files (x86)\Rising\RSD\popwndexe.exe
    "C:\Program Files (x86)\Rising\RSD\popwndexe.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:2016
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s RavExt64.dll
    3⤵
    PID:980
- - C:\Program Files (x86)\Rising\RAV\ravmond.exe
    "C:\Program Files (x86)\Rising\RAV\ravmond.exe" -srv setup /SLIENCE
    3⤵
    - Executes dropped EXE
    PID:2276
- C:\Users\Admin\AppData\Local\Temp\sbnimb.tmp\dtstop.tmp\duba_1_244.exe
  "C:\Users\Admin\AppData\Local\Temp\sbnimb.tmp\dtstop.tmp\duba_1_244.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Registers COM server for autorun
  - Sets file execution options in registry
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Writes to the Master Boot Record (MBR)
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1936
- - \??\c:\program files (x86)\kingsoft\kingsoft antivirus\kavlog2.exe
    "c:\program files (x86)\kingsoft\kingsoft antivirus\kavlog2.exe" -install
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    PID:728
- - \??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxetray.exe
    "c:\program files (x86)\kingsoft\kingsoft antivirus\kxetray.exe" /autorun /hidefloatwin /silentinstrcmd
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:628
  - - \??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxetray.exe
      "c:\program files (x86)\kingsoft\kingsoft antivirus\kxetray.exe" /autorun /hidefloatwin /silentinstrcmd
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:652
    - - \??\c:\program files (x86)\kingsoft\kingsoft antivirus\kwsprotect64.exe
        
        "kwsprotect64.exe" (null)
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2188
- - \??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe
    "c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe" /start kxescore
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1756
- - \??\c:\program files (x86)\kingsoft\kingsoft antivirus\kislive.exe
    "c:\program files (x86)\kingsoft\kingsoft antivirus\kislive.exe" /autorun /std /skipcs3
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:2036
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\18cc13c1471ee634a087a1562dd58e848bb37077043150bd28cc334fff5ce0c3.exe.bat
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:1560
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM 18cc13c1471ee634a087a1562dd58e848bb37077043150bd28cc334fff5ce0c3.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1188

C:\Program Files (x86)\Rising\RSD\RsMgrSvc.exe
"C:\Program Files (x86)\Rising\RSD\RsMgrSvc.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1808

\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe
"c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe" /service kxescore
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Sets service image path in registry
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:536

C:\Program Files (x86)\Rising\RAV\ravmond.exe
"C:\Program Files (x86)\Rising\RAV\ravmond.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2308

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Rising\RSD\RsMgrSvc.exe

Filesize
179KB

MD5
8b287372151ae026ae02cefece7f538e

SHA1
5874317a452605725129a69e1a7973d5849c8fd6

SHA256
f8e365a7fd1c22f680d2b38c5a66b054ea0b73f49618e39ad83bc8761cd03908

SHA512
44aa8184fe21552a8da2b5157c8ea722a1b2bbf23416a766ff5a08a96d73acc265536131c1c8dfd1f226c22c15fddc2684cb73153d7b0531b2b65afa7f788078

Download Submit
C:\Program Files (x86)\Rising\RSD\RsMgrSvc.ini

Filesize
66B

MD5
5bbe56a9322ce34371945380a3bae9a0

SHA1
881f54234e34bdd08e987fb1628d6fe17afeea0b

SHA256
0a19332fa5041f4999b51f4a46bbffb5d07f09b920cb837e3c78b595ff5ce20f

SHA512
847b043bb4748c2e5317138f7216d7a3cbe7ddb01ea2f81cbfa575b606936a6e069d911141686e08f770e40db0f9388f38f8472b51901d1e1cbf562114df27a5

Download Submit
C:\Program Files (x86)\Rising\RSD\Syslay.dll

Filesize
98KB

MD5
6a2ad6ba7dece95286bc5eef92c62b28

SHA1
61148917a206bf38c5f110eff5c9382ab940ff80

SHA256
bf46b98b27b82a666c2f22fc66c569f3566f33a638c9f5929d25cf071a5024bf

SHA512
81c6b8f7ce8a758255203eb0603ef5de8e4ffd1db290199c17b821a3731cf055cd007afa343fda44d6a43b21a4c8190abee83abe20e4677991541f68baeb22d0

Download Submit
C:\Program Files (x86)\Rising\RSD\comx3.dll

Filesize
182KB

MD5
92aa0e6a0be8766a98a74f05d202d4c3

SHA1
ea14ee946d61b014c2d0e463c454387d7f2fe527

SHA256
152ce57d1b6fbc784373f770a4dbe9812f6b1abeec549276e9f9747719d439f3

SHA512
d7cc56b0d521859c50c80bc403f3cdf987252f28b6f7928302f83b9e7923c1dd3c3f4b12aa31b8cf9e9ff296ce213cd5c6f1500bf69c1adc1b07c38b66a06d3b

Download Submit
C:\Program Files (x86)\Rising\RSD\data\RAV\RAV.ini

Filesize
54B

MD5
059d3164b4e40d70566b8ceee9091010

SHA1
7057ff71132433d86f964f0a043f818a1d7b230e

SHA256
3d72550ed3ef9e4273035417ffba85fed8527e027c59a48042d5ed9ff872ad0e

SHA512
5ee224ec5446bdee96d3fc86f68f3a484c62c52f401f79fb03fcc3dbebe9863ede4f2449a1eeb90a7ef866bf07c0c4d6b9c259a40e995f5b5f5cae147f52112b

Download Submit
C:\Program Files (x86)\Rising\RSD\popwndexe.exe

Filesize
123KB

MD5
9fc8d62cd7e5c9db50b515c26b968e00

SHA1
db51599827dcaaededa2fb4cf16b7853f30f5f84

SHA256
3b2ac4bf98d9812a969aaaa02ff292105ed81c8794ffd84788ba9acc1808d989

SHA512
244ccb61af416b03d9e383a98dd0da2f8ae428a0497af6b9a90dd2da223c710546b8df59236bb17d8ad06343331f2331f4f3d2b359243cd493d00a21b98c4847

Download Submit
C:\Program Files (x86)\Rising\RSD\popwndexe.exe

Filesize
123KB

MD5
9fc8d62cd7e5c9db50b515c26b968e00

SHA1
db51599827dcaaededa2fb4cf16b7853f30f5f84

SHA256
3b2ac4bf98d9812a969aaaa02ff292105ed81c8794ffd84788ba9acc1808d989

SHA512
244ccb61af416b03d9e383a98dd0da2f8ae428a0497af6b9a90dd2da223c710546b8df59236bb17d8ad06343331f2331f4f3d2b359243cd493d00a21b98c4847

Download Submit
C:\Program Files (x86)\Rising\RSD\rsdk.dll

Filesize
483KB

MD5
9dd8dfd3e7359021dcfa5e91537bafab

SHA1
07978c741136bdcdfaf06184752f499545cb48f4

SHA256
a721df54f839bb0e51d581f3678e60bf9b65f5da5d3ac282457059a43bf93f0a

SHA512
31e7ac7980315c73d41e9dddc0e67e9b7d55f1980ce8161876ed9a63c7eb77a4dc5b2bb2bd25dcaf4615f97d9b9f61d3882f52ef98b9136a99276b25c192b835

Download Submit
C:\Program Files (x86)\Rising\RSD\rsmginfo.dll

Filesize
328KB

MD5
0353146a43705ff783ee2a6109f232df

SHA1
7599b8b47ee7973fd2fab1d4c760ef92d9dc160f

SHA256
9672251d7f08a0a2247bb5592b01eeece7496b384a12b8d8ede4f9c6639f68f8

SHA512
0723d38669fbb0ce6b126cf6f818c5f3db0834103c6e81fac802be0f9b7b24f65360364f2c7734389811172eb2fe7560f011a06a37a7bbe0af6f743274cfebcd

Download Submit
C:\Program Files (x86)\Rising\RSD\update.xml

Filesize
164B

MD5
0f99e8eb5041ad830c3ffcfbd4e78558

SHA1
4be4cf05dbafe701a8efd3417408491244fcaee2

SHA256
1bb0ea03709e98b947f34e46e3a72578cc2bdacdcac45a9a7a8bdbfbd4e8bb33

SHA512
1b1b485476472d3408d2b3d4aed9fb4e97d43998314d8ce7e6775234200ee4c9f694b6ec790866e41dcb6294f9ab6818bc3c3c428d7a8aa7e2bcf35bcf539f63

Download Submit
C:\Program Files (x86)\kingsoft\kingsoft antivirus\kavlog2.exe

Filesize
511KB

MD5
dd1443f153f7cf554addb404aff623f8

SHA1
893f24f463d03b3b19e952b85ae06daffcc466d1

SHA256
b943b7e8cdb2decca1eaf2db1683a670fc72024be8eb95f9308adec8abc50887

SHA512
6fc1062f258684a20fce9fff8cf0ee88218aca1bb2e65c4a07f6ac7624fc1536e267538ec35f37d2356eec37258f29c13203d55a6e477d1231a5f5e8e6cd19bd

Download Submit
C:\Program Files (x86)\kingsoft\kingsoft antivirus\kxetray.exe

Filesize
1.4MB

MD5
cee09dac2393fb81c34ea3c5ced75d31

SHA1
e2d5c7720c65b4dcd7f740104fc9f8890b68a494

SHA256
156920cf11f82d22ef2339b4a9525b2905ee496be6630c2a926eef39c3c77570

SHA512
c4710de9bc6c9f8c37ceebd600a9e9ac7c6c9dfa60d24ef4f36374cff3dc4054e6ca99e5ea9c41eed70d772d1acebf7da9ebd3b8c9ff93bcecacc8099554574f

Download Submit
C:\Users\Admin\AppData\Local\Temp\18cc13c1471ee634a087a1562dd58e848bb37077043150bd28cc334fff5ce0c3.exe.bat

Filesize
330B

MD5
c5face12267073cd8ae6c34fe8c220d3

SHA1
a5c54edf0363334d5bcc905d650370ac6aa02685

SHA256
60d4816d2c638326052b098f00296de8244c3f42eccebe5f4dcc2302d81affe2

SHA512
94842985d8d8781ed1e22a1ba010d105b0029d85256ea69a25156e439eb04d763e4ba0a506c98563b0579f53b8a362e724537d2de100577a10bf639e4cd4e892

Download Submit
C:\Users\Admin\AppData\Local\Temp\sbnimb.tmp\dtstop.tmp\duba_1_244.exe

Filesize
16.8MB

MD5
1f1c87b2b8528523907cc58c00923df8

SHA1
ea0f7ad5e2d0bc48e52ea9e00c56dc14ea026514

SHA256
37e29c28eb4a4753f6926c2f7dfd169a09e184264f537c64893637716237733a

SHA512
2a8d2107eb8d479d8378c780389278e2d20653954d93dea72700b9bb9c21bc7ecf826243c1aadf8a6bc2705cc9d0055a01cf24c32a8ba38cca87ca51abd66fbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\sbnimb.tmp\dtstop.tmp\duba_1_244.exe

Filesize
16.8MB

MD5
1f1c87b2b8528523907cc58c00923df8

SHA1
ea0f7ad5e2d0bc48e52ea9e00c56dc14ea026514

SHA256
37e29c28eb4a4753f6926c2f7dfd169a09e184264f537c64893637716237733a

SHA512
2a8d2107eb8d479d8378c780389278e2d20653954d93dea72700b9bb9c21bc7ecf826243c1aadf8a6bc2705cc9d0055a01cf24c32a8ba38cca87ca51abd66fbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\sbnimb.tmp\dtstop.tmp\install1968982.exe

Filesize
4.6MB

MD5
512fe2eb54dde3c922ce73c075a592a1

SHA1
4332a256f0a77381ecd11e823475c335691325d7

SHA256
110f6a132f05a0d7b31d449beb75c7b22cd1fd409d50b32ded10e8ac305d852e

SHA512
a3f6fda13e054d5f3f52f0b62895c94b467b32e5811bf52e91c7c747554204af150c0bddce229bcd4b912c575079376ffdd02dbe281d2a59f1f6824b464b993e

Download Submit
C:\Users\Admin\AppData\Local\Temp\sbnimb.tmp\dtstop.tmp\install1968982.exe

Filesize
4.6MB

MD5
512fe2eb54dde3c922ce73c075a592a1

SHA1
4332a256f0a77381ecd11e823475c335691325d7

SHA256
110f6a132f05a0d7b31d449beb75c7b22cd1fd409d50b32ded10e8ac305d852e

SHA512
a3f6fda13e054d5f3f52f0b62895c94b467b32e5811bf52e91c7c747554204af150c0bddce229bcd4b912c575079376ffdd02dbe281d2a59f1f6824b464b993e

Download Submit
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\MSVCP80.dll

Filesize
536KB

MD5
4c8a880eabc0b4d462cc4b2472116ea1

SHA1
d0a27f553c0fe0e507c7df079485b601d5b592e6

SHA256
2026f3c4f830dff6883b88e2647272a52a132f25eb42c0d423e36b3f65a94d08

SHA512
6a6cce8c232f46dab9b02d29be5e0675cc1e968e9c2d64d0abc008d20c0a7baeb103a5b1d9b348fa1c4b3af9797dbcb6e168b14b545fb15c2ccd926c3098c31c

Download Submit
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\MSVCR80.dll

Filesize
612KB

MD5
e4fece18310e23b1d8fee993e35e7a6f

SHA1
9fd3a7f0522d36c2bf0e64fc510c6eea3603b564

SHA256
02bdde38e4c6bd795a092d496b8d6060cdbe71e22ef4d7a204e3050c1be44fa9

SHA512
2fb5f8d63a39ba5e93505df3a643d14e286fe34b11984cbed4b88e8a07517c03efb3a7bf9d61cf1ec73b0a20d83f9e6068e61950a61d649b8d36082bb034ddfc

Download Submit
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kavlog2.exe

Filesize
511KB

MD5
dd1443f153f7cf554addb404aff623f8

SHA1
893f24f463d03b3b19e952b85ae06daffcc466d1

SHA256
b943b7e8cdb2decca1eaf2db1683a670fc72024be8eb95f9308adec8abc50887

SHA512
6fc1062f258684a20fce9fff8cf0ee88218aca1bb2e65c4a07f6ac7624fc1536e267538ec35f37d2356eec37258f29c13203d55a6e477d1231a5f5e8e6cd19bd

Download Submit
\Program Files (x86)\Rising\RSD\comx3.dll

Filesize
182KB

MD5
92aa0e6a0be8766a98a74f05d202d4c3

SHA1
ea14ee946d61b014c2d0e463c454387d7f2fe527

SHA256
152ce57d1b6fbc784373f770a4dbe9812f6b1abeec549276e9f9747719d439f3

SHA512
d7cc56b0d521859c50c80bc403f3cdf987252f28b6f7928302f83b9e7923c1dd3c3f4b12aa31b8cf9e9ff296ce213cd5c6f1500bf69c1adc1b07c38b66a06d3b

Download Submit
\Program Files (x86)\Rising\RSD\popwndexe.exe

Filesize
123KB

MD5
9fc8d62cd7e5c9db50b515c26b968e00

SHA1
db51599827dcaaededa2fb4cf16b7853f30f5f84

SHA256
3b2ac4bf98d9812a969aaaa02ff292105ed81c8794ffd84788ba9acc1808d989

SHA512
244ccb61af416b03d9e383a98dd0da2f8ae428a0497af6b9a90dd2da223c710546b8df59236bb17d8ad06343331f2331f4f3d2b359243cd493d00a21b98c4847

Download Submit
\Program Files (x86)\Rising\RSD\popwndexe.exe

Filesize
123KB

MD5
9fc8d62cd7e5c9db50b515c26b968e00

SHA1
db51599827dcaaededa2fb4cf16b7853f30f5f84

SHA256
3b2ac4bf98d9812a969aaaa02ff292105ed81c8794ffd84788ba9acc1808d989

SHA512
244ccb61af416b03d9e383a98dd0da2f8ae428a0497af6b9a90dd2da223c710546b8df59236bb17d8ad06343331f2331f4f3d2b359243cd493d00a21b98c4847

Download Submit
\Program Files (x86)\Rising\RSD\popwndexe.exe

Filesize
123KB

MD5
9fc8d62cd7e5c9db50b515c26b968e00

SHA1
db51599827dcaaededa2fb4cf16b7853f30f5f84

SHA256
3b2ac4bf98d9812a969aaaa02ff292105ed81c8794ffd84788ba9acc1808d989

SHA512
244ccb61af416b03d9e383a98dd0da2f8ae428a0497af6b9a90dd2da223c710546b8df59236bb17d8ad06343331f2331f4f3d2b359243cd493d00a21b98c4847

Download Submit
\Program Files (x86)\Rising\RSD\rsdk.dll

Filesize
483KB

MD5
9dd8dfd3e7359021dcfa5e91537bafab

SHA1
07978c741136bdcdfaf06184752f499545cb48f4

SHA256
a721df54f839bb0e51d581f3678e60bf9b65f5da5d3ac282457059a43bf93f0a

SHA512
31e7ac7980315c73d41e9dddc0e67e9b7d55f1980ce8161876ed9a63c7eb77a4dc5b2bb2bd25dcaf4615f97d9b9f61d3882f52ef98b9136a99276b25c192b835

Download Submit
\Program Files (x86)\Rising\RSD\rsmginfo.dll

Filesize
328KB

MD5
0353146a43705ff783ee2a6109f232df

SHA1
7599b8b47ee7973fd2fab1d4c760ef92d9dc160f

SHA256
9672251d7f08a0a2247bb5592b01eeece7496b384a12b8d8ede4f9c6639f68f8

SHA512
0723d38669fbb0ce6b126cf6f818c5f3db0834103c6e81fac802be0f9b7b24f65360364f2c7734389811172eb2fe7560f011a06a37a7bbe0af6f743274cfebcd

Download Submit
\Program Files (x86)\Rising\RSD\syslay.dll

Filesize
98KB

MD5
6a2ad6ba7dece95286bc5eef92c62b28

SHA1
61148917a206bf38c5f110eff5c9382ab940ff80

SHA256
bf46b98b27b82a666c2f22fc66c569f3566f33a638c9f5929d25cf071a5024bf

SHA512
81c6b8f7ce8a758255203eb0603ef5de8e4ffd1db290199c17b821a3731cf055cd007afa343fda44d6a43b21a4c8190abee83abe20e4677991541f68baeb22d0

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kavlog2.exe

Filesize
511KB

MD5
dd1443f153f7cf554addb404aff623f8

SHA1
893f24f463d03b3b19e952b85ae06daffcc466d1

SHA256
b943b7e8cdb2decca1eaf2db1683a670fc72024be8eb95f9308adec8abc50887

SHA512
6fc1062f258684a20fce9fff8cf0ee88218aca1bb2e65c4a07f6ac7624fc1536e267538ec35f37d2356eec37258f29c13203d55a6e477d1231a5f5e8e6cd19bd

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kavlog2.exe

Filesize
511KB

MD5
dd1443f153f7cf554addb404aff623f8

SHA1
893f24f463d03b3b19e952b85ae06daffcc466d1

SHA256
b943b7e8cdb2decca1eaf2db1683a670fc72024be8eb95f9308adec8abc50887

SHA512
6fc1062f258684a20fce9fff8cf0ee88218aca1bb2e65c4a07f6ac7624fc1536e267538ec35f37d2356eec37258f29c13203d55a6e477d1231a5f5e8e6cd19bd

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kavmenu.dll

Filesize
69KB

MD5
c8ed4b3af03d82cc3fe2f8c42c22326c

SHA1
78a2e216262b8f1b35e408685cf20f2fa4685d8f

SHA256
1c73f57c31845d3719644f815ca9df1efb18cfc3dfc2dc1b4afddb71261afb31

SHA512
34e6cf09afa68875be24005f90be35bb7c490ac9d2f63befadfdd1902136c383ee903442c9df572e2ccd0b7ea1be10857401c76c5b6923c28f8eaecab5b3c45c

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kislive.exe

Filesize
1.1MB

MD5
04eeb71a179940aca8073ddaa5bf4350

SHA1
02f7c99c4a2784b2db466b20c6e9c02cccc733b6

SHA256
acd8f6de1355fa40d4703149eeae1887c3f4ee0474f65c7aa257db38924e1385

SHA512
049a164a916863f037f88288faab7ce6f92d555fac4e819d6b79ed787c583f0a0d821ef173440c481f4d2a39ee1547437c6471e2e2b37cf53ad6701ede452f21

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kismain.exe

Filesize
337KB

MD5
bb1ce6771f3bdfa3db16106e6802cf45

SHA1
9303e90c1782df8dd383ae75235e400e4a75df25

SHA256
b30440a7fe3f2cef818e9769df7aea5af5bd150058630299c34836f0eeec0270

SHA512
d412665027d7ad1b110a9e62b8ef2d1ab500b559865bb2cfa6584347993bb1e5634e442b158b3a8cbbf2df62d5ccd81714ac3e7f97246aca7b700991147893c2

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kismain.exe

Filesize
337KB

MD5
bb1ce6771f3bdfa3db16106e6802cf45

SHA1
9303e90c1782df8dd383ae75235e400e4a75df25

SHA256
b30440a7fe3f2cef818e9769df7aea5af5bd150058630299c34836f0eeec0270

SHA512
d412665027d7ad1b110a9e62b8ef2d1ab500b559865bb2cfa6584347993bb1e5634e442b158b3a8cbbf2df62d5ccd81714ac3e7f97246aca7b700991147893c2

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\krecycle.exe

Filesize
495KB

MD5
c423991edd1e101d7c1aa7f2fe5d6670

SHA1
1f19d1c7e6f9189b2cdc875cc4b5c9afcf976e51

SHA256
f6cf76ca159237d0661b94d49d50657363db2df2f1b15188a60ef207c09a9ca4

SHA512
73640c9f8342ba3d51649726e85bad9510860ca836f8de21df27d9163ae0a6092a66fe8b10c3870f1ec3084a5ea1cb2917af50572b865a15d8faa8306fb9df9f

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kxescore.exe

Filesize
277KB

MD5
479263a138a81ac646a04a7ca1060821

SHA1
7bdd2ab8f03fd82d9c8e4e3c9af9ea1a365cd6d3

SHA256
bcd9860da984d0cf04a7ddbe7586c9b0d7207864abe203e80ade6f386d83b36d

SHA512
136121c3f1db93788021e910df1308ced47072a2a076e6d68773a5a1795ca62a075bf3d21dd318ce185dc7ddb6336c5300a71866f5c32f64a69e80931dea63d7

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kxetray.exe

Filesize
1.4MB

MD5
cee09dac2393fb81c34ea3c5ced75d31

SHA1
e2d5c7720c65b4dcd7f740104fc9f8890b68a494

SHA256
156920cf11f82d22ef2339b4a9525b2905ee496be6630c2a926eef39c3c77570

SHA512
c4710de9bc6c9f8c37ceebd600a9e9ac7c6c9dfa60d24ef4f36374cff3dc4054e6ca99e5ea9c41eed70d772d1acebf7da9ebd3b8c9ff93bcecacc8099554574f

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kxetray.exe

Filesize
1.4MB

MD5
cee09dac2393fb81c34ea3c5ced75d31

SHA1
e2d5c7720c65b4dcd7f740104fc9f8890b68a494

SHA256
156920cf11f82d22ef2339b4a9525b2905ee496be6630c2a926eef39c3c77570

SHA512
c4710de9bc6c9f8c37ceebd600a9e9ac7c6c9dfa60d24ef4f36374cff3dc4054e6ca99e5ea9c41eed70d772d1acebf7da9ebd3b8c9ff93bcecacc8099554574f

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\msvcp80.dll

Filesize
536KB

MD5
4c8a880eabc0b4d462cc4b2472116ea1

SHA1
d0a27f553c0fe0e507c7df079485b601d5b592e6

SHA256
2026f3c4f830dff6883b88e2647272a52a132f25eb42c0d423e36b3f65a94d08

SHA512
6a6cce8c232f46dab9b02d29be5e0675cc1e968e9c2d64d0abc008d20c0a7baeb103a5b1d9b348fa1c4b3af9797dbcb6e168b14b545fb15c2ccd926c3098c31c

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\msvcr80.dll

Filesize
612KB

MD5
e4fece18310e23b1d8fee993e35e7a6f

SHA1
9fd3a7f0522d36c2bf0e64fc510c6eea3603b564

SHA256
02bdde38e4c6bd795a092d496b8d6060cdbe71e22ef4d7a204e3050c1be44fa9

SHA512
2fb5f8d63a39ba5e93505df3a643d14e286fe34b11984cbed4b88e8a07517c03efb3a7bf9d61cf1ec73b0a20d83f9e6068e61950a61d649b8d36082bb034ddfc

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\security\ksde\kisknl.sys

Filesize
259KB

MD5
1636dd864151388451acb8b2fc1fccb8

SHA1
06e3ac51140a1f7c35f79f8c69e997919838bd01

SHA256
859bdfd8e8f067c3d2328e3cc910d906d07298fd2a5ffc9e89f22df61c499126

SHA512
694911e645fc982ec31aba9283c5e247a93d05b378a3e6eee1374d7f405257bef0e665f58fe29f1dd8417169373a772b6015548c1dc4643266a457b283dcaf10

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\security\ksde\kisknl.sys

Filesize
259KB

MD5
1636dd864151388451acb8b2fc1fccb8

SHA1
06e3ac51140a1f7c35f79f8c69e997919838bd01

SHA256
859bdfd8e8f067c3d2328e3cc910d906d07298fd2a5ffc9e89f22df61c499126

SHA512
694911e645fc982ec31aba9283c5e247a93d05b378a3e6eee1374d7f405257bef0e665f58fe29f1dd8417169373a772b6015548c1dc4643266a457b283dcaf10

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\uni0nst.exe

Filesize
842KB

MD5
c833984034607e01850987d075f4c3b9

SHA1
c5cb941666198a1678c88faf22be0a1b0b007813

SHA256
c6027958286a3f1a0e5ff5e104d461c6a1df7e1d0a828ab78fffa506ee2cc294

SHA512
918e3fee2fae74e8f278277774d8237c658b3d7c994ec20640c81667e66671a3029bdf7ff8e9fcfdbff8f1b2d8f98bd5492d5a3200d516a47db19a2ecce72d59

Download Submit
\Users\Admin\AppData\Local\Temp\RsdSfxTmp\CfgDll.dll

Filesize
264KB

MD5
4bf3b0c552a575f4a0d09bf74e4083dd

SHA1
1d995c98685471e7b7df3ac1df5426b7c8a4a1de

SHA256
539b021a0c3d445c9d2f054e0a33d0e8497893c321732c3f2a41d912384fde90

SHA512
15021142825e15efbee778df625bcbaae9587d1e41b23ac142b2b82c2c2b6592d61635f3a35ed10c8615ef29acdd44a8a3d52949202dc90a2058fc9666a30317

Download Submit
\Users\Admin\AppData\Local\Temp\RsdSfxTmp\CfgDll.dll

Filesize
264KB

MD5
4bf3b0c552a575f4a0d09bf74e4083dd

SHA1
1d995c98685471e7b7df3ac1df5426b7c8a4a1de

SHA256
539b021a0c3d445c9d2f054e0a33d0e8497893c321732c3f2a41d912384fde90

SHA512
15021142825e15efbee778df625bcbaae9587d1e41b23ac142b2b82c2c2b6592d61635f3a35ed10c8615ef29acdd44a8a3d52949202dc90a2058fc9666a30317

Download Submit
\Users\Admin\AppData\Local\Temp\RsdSfxTmp\RsAppMgr.dll

Filesize
62KB

MD5
1f35136daa23c794a9561b46db35d5a5

SHA1
c70934be177b81bcc8f5d0e925a9c4b16cf2778e

SHA256
1a5b02c7eb208459cba7795c286c4df00de1eee2fa5f5ad9caebdf385f568851

SHA512
ec6bd64f525687c8ec772770c2e754dbb64b64f2b11c40a4799a641df2c0faee63c4cc7df3e1a935ce2496c68003297c3e66371c47fd285206dba27e396a7d6d

Download Submit
\Users\Admin\AppData\Local\Temp\RsdSfxTmp\RsAppMgr.dll

Filesize
62KB

MD5
1f35136daa23c794a9561b46db35d5a5

SHA1
c70934be177b81bcc8f5d0e925a9c4b16cf2778e

SHA256
1a5b02c7eb208459cba7795c286c4df00de1eee2fa5f5ad9caebdf385f568851

SHA512
ec6bd64f525687c8ec772770c2e754dbb64b64f2b11c40a4799a641df2c0faee63c4cc7df3e1a935ce2496c68003297c3e66371c47fd285206dba27e396a7d6d

Download Submit
\Users\Admin\AppData\Local\Temp\RsdSfxTmp\cloudv3\Cloudv3.dll

Filesize
479KB

MD5
d5a4de2ba24c733642355d25357fa4b6

SHA1
74df3cf87698a94ebcb9d28f700c7c6c111e5566

SHA256
cd30026412d94a43942ae5d443a104730a2e1a37d35faaf8cc24f21c7c300e91

SHA512
bd9d2431b2f0d3c1a869be92336197e5b0a28b5109842ab30eb426eac395150a24a6753ba5f014751284fac69fa30f5becba66d5c5ab6af7b0bd299650c29444

Download Submit
\Users\Admin\AppData\Local\Temp\RsdSfxTmp\comx3.dll

Filesize
182KB

MD5
92aa0e6a0be8766a98a74f05d202d4c3

SHA1
ea14ee946d61b014c2d0e463c454387d7f2fe527

SHA256
152ce57d1b6fbc784373f770a4dbe9812f6b1abeec549276e9f9747719d439f3

SHA512
d7cc56b0d521859c50c80bc403f3cdf987252f28b6f7928302f83b9e7923c1dd3c3f4b12aa31b8cf9e9ff296ce213cd5c6f1500bf69c1adc1b07c38b66a06d3b

Download Submit
\Users\Admin\AppData\Local\Temp\RsdSfxTmp\hookbase\hookbase.dll

Filesize
142KB

MD5
8e1dc8ed7b7b77d922aca184d0e454b7

SHA1
3baf8cf9075269051aed41bae5c55de13932eb74

SHA256
f38341e899a620d2f751283fce9f3eac5ea7f6cbd49c41fec36f9cc7bb4176a3

SHA512
2109392bcccf9f2c58cfb62cc70a09c6a132006996916586051cb5a81fa181c8d95f4180b5e67512e07dcfe598eb36d0d9eca9445eb84c1b2641661ce4849e3e

Download Submit
\Users\Admin\AppData\Local\Temp\RsdSfxTmp\monbasedui\rssrv.dll

Filesize
111KB

MD5
00a45353f419bc4891645f1ad0150617

SHA1
65b8410c9ac395a6ca5e027a237648064bf863b3

SHA256
841b67ba124509ba01deb142a1af2d1e808e6973c41003e61a6922ac011d3043

SHA512
6b7eeb4b8abd91b9577c476df09da28a8abc16cdda39c5c8eed0fe79667c19ff430f54984789f70958170fe3fbd59a6da6a8570d0f56a6f5f9b5e9118984aa9e

Download Submit
\Users\Admin\AppData\Local\Temp\RsdSfxTmp\ravbase\RavSetup.dll

Filesize
1.0MB

MD5
270f42646170f2545c25a43f732532fb

SHA1
8a6ac1835800a9112d6a6ab0f1fcd38857eca66c

SHA256
aeb179bb01bbc586aa35ef5f3813a398f1f20f0f48bfaf434b39329f46a6e21f

SHA512
09f75c58d397a2e393b9e51a946200ead65dfb148f17fc966c3645efe4f7c9839cede08530d2a19c6dce58c654d7fc6d9c147481e04564d9eb88ef70e515dbf7

Download Submit
\Users\Admin\AppData\Local\Temp\RsdSfxTmp\ravconfig\mergexml.dll

Filesize
114KB

MD5
e28dd24338cae534a54a14d33020cbe9

SHA1
1a21a926187d70eb7f8c431d9196b12f389b20f9

SHA256
8e42df39dc1d92ccf1a503d8a79b6644106025f644f46c6ce5dd56f1658655f0

SHA512
f6072aa3637097731bda74b8aaa3aed3c7c26702b40693334c1c80a4d3cc027ea56c0e55521fe1df0fda8e025d301343a5a2325d1497cd129114b17b3cb4c3d2

Download Submit
\Users\Admin\AppData\Local\Temp\RsdSfxTmp\ravdefdb\mondef.dll

Filesize
515KB

MD5
62de362c75022744c5149e03d1191fff

SHA1
70b31802ac38d69e5189a65f76a371a722409753

SHA256
c5dbb1ef41851b44b272bf5280226353e285feaa254f21b941cb2f49811cd994

SHA512
0eb1f953a21a68e55d71d268018db49a91705297a42dd25a6ef860c2d86b793b651718562cfbd77491a6ffa6dd498dce4b4aff46667b515bceea27df9fd74dfb

Download Submit
\Users\Admin\AppData\Local\Temp\RsdSfxTmp\ravmaindui\rsmain.dll

Filesize
95KB

MD5
4f4500ee19410043cc338668d28f95a3

SHA1
139aa70bff3696dcff575836ac8bb4b8e7bf9334

SHA256
59caf0e3820af2e5d1e6652654c996ebb0857b79808d589d10ecd7fbbcf0df7b

SHA512
63cdee1ec89772479a45e9492f706e07daee07c56728bdf8d7b238b239b0efc087a2c07fa4488c349fb694ef2b9b298acfca6b488d17250868bec90ad7920a1d

Download Submit
\Users\Admin\AppData\Local\Temp\RsdSfxTmp\rscomm\Proccomm.dll

Filesize
158KB

MD5
7ae91c40093e829a971616b1e2f9113e

SHA1
a6b4e970be9e2821bcc7ec8c1e77304a15f58e3e

SHA256
608cba4e01124a099758295103ba0e5f8d2665874d78b9e3aeb45f7d6c7c2264

SHA512
242b1f46c6367f2b318460aafdc400340e01047ca5f6256e3f53977dc44c8d74f97d085551b39937e2e8b9848cf4fb409c7387fb20da6a5fed2cccebb70065ea

Download Submit
\Users\Admin\AppData\Local\Temp\RsdSfxTmp\rslang.dll

Filesize
134KB

MD5
af1b1fca64556fab4ce9c09e1dac4b96

SHA1
c4c6c9ab878bc779ddfcf45c6175bcc67a20f8ce

SHA256
6340dbb7152c32a54e55a12c054d06e6e98add697a2e5be5929806fec306b643

SHA512
2feb1881bedc73b4e69bec79889fb03940b9165a62083f729682803e85e547fe848451f5cc94779f1746eba19cbc2bf26e5d60c7876b491d28bed5b4f1601945

Download Submit
\Users\Admin\AppData\Local\Temp\RsdSfxTmp\setup.dll

Filesize
767KB

MD5
3fff3e7a22df1c549e8b054dd18477e6

SHA1
4b18974612cda9ad962b0f9ef59ba295caeafd5a

SHA256
c1a35c2775af04bd60c8751f7615853d7f652a118373c0a0e6a95bf123383903

SHA512
af4a1fbd655e4f982e41cb0302e5058302de0c8747f09f150941d3c1d82ffe30c6f1f613e0e6a19435d4cd86b8bcae992bc19e3f0bbe4477cf6b650b17a31075

Download Submit
\Users\Admin\AppData\Local\Temp\RsdSfxTmp\syslay.dll

Filesize
98KB

MD5
6a2ad6ba7dece95286bc5eef92c62b28

SHA1
61148917a206bf38c5f110eff5c9382ab940ff80

SHA256
bf46b98b27b82a666c2f22fc66c569f3566f33a638c9f5929d25cf071a5024bf

SHA512
81c6b8f7ce8a758255203eb0603ef5de8e4ffd1db290199c17b821a3731cf055cd007afa343fda44d6a43b21a4c8190abee83abe20e4677991541f68baeb22d0

Download Submit
\Users\Admin\AppData\Local\Temp\sbnimb.tmp\dtstop.tmp\duba_1_244.exe

Filesize
16.8MB

MD5
1f1c87b2b8528523907cc58c00923df8

SHA1
ea0f7ad5e2d0bc48e52ea9e00c56dc14ea026514

SHA256
37e29c28eb4a4753f6926c2f7dfd169a09e184264f537c64893637716237733a

SHA512
2a8d2107eb8d479d8378c780389278e2d20653954d93dea72700b9bb9c21bc7ecf826243c1aadf8a6bc2705cc9d0055a01cf24c32a8ba38cca87ca51abd66fbc

Download Submit
\Users\Admin\AppData\Local\Temp\sbnimb.tmp\dtstop.tmp\duba_1_244.exe

Filesize
16.8MB

MD5
1f1c87b2b8528523907cc58c00923df8

SHA1
ea0f7ad5e2d0bc48e52ea9e00c56dc14ea026514

SHA256
37e29c28eb4a4753f6926c2f7dfd169a09e184264f537c64893637716237733a

SHA512
2a8d2107eb8d479d8378c780389278e2d20653954d93dea72700b9bb9c21bc7ecf826243c1aadf8a6bc2705cc9d0055a01cf24c32a8ba38cca87ca51abd66fbc

Download Submit
\Users\Admin\AppData\Local\Temp\sbnimb.tmp\dtstop.tmp\duba_1_244.exe

Filesize
16.8MB

MD5
1f1c87b2b8528523907cc58c00923df8

SHA1
ea0f7ad5e2d0bc48e52ea9e00c56dc14ea026514

SHA256
37e29c28eb4a4753f6926c2f7dfd169a09e184264f537c64893637716237733a

SHA512
2a8d2107eb8d479d8378c780389278e2d20653954d93dea72700b9bb9c21bc7ecf826243c1aadf8a6bc2705cc9d0055a01cf24c32a8ba38cca87ca51abd66fbc

Download Submit
\Users\Admin\AppData\Local\Temp\sbnimb.tmp\dtstop.tmp\install1968982.exe

Filesize
4.6MB

MD5
512fe2eb54dde3c922ce73c075a592a1

SHA1
4332a256f0a77381ecd11e823475c335691325d7

SHA256
110f6a132f05a0d7b31d449beb75c7b22cd1fd409d50b32ded10e8ac305d852e

SHA512
a3f6fda13e054d5f3f52f0b62895c94b467b32e5811bf52e91c7c747554204af150c0bddce229bcd4b912c575079376ffdd02dbe281d2a59f1f6824b464b993e

Download Submit
\Users\Admin\AppData\Local\Temp\sbnimb.tmp\dtstop.tmp\install1968982.exe

Filesize
4.6MB

MD5
512fe2eb54dde3c922ce73c075a592a1

SHA1
4332a256f0a77381ecd11e823475c335691325d7

SHA256
110f6a132f05a0d7b31d449beb75c7b22cd1fd409d50b32ded10e8ac305d852e

SHA512
a3f6fda13e054d5f3f52f0b62895c94b467b32e5811bf52e91c7c747554204af150c0bddce229bcd4b912c575079376ffdd02dbe281d2a59f1f6824b464b993e

Download Submit
\Users\Admin\AppData\Local\Temp\sbnimb.tmp\dtstop.tmp\install1968982.exe

Filesize
4.6MB

MD5
512fe2eb54dde3c922ce73c075a592a1

SHA1
4332a256f0a77381ecd11e823475c335691325d7

SHA256
110f6a132f05a0d7b31d449beb75c7b22cd1fd409d50b32ded10e8ac305d852e

SHA512
a3f6fda13e054d5f3f52f0b62895c94b467b32e5811bf52e91c7c747554204af150c0bddce229bcd4b912c575079376ffdd02dbe281d2a59f1f6824b464b993e

Download Submit
memory/536-202-0x00000000013E0000-0x00000000013F2000-memory.dmp

Filesize
72KB

Download
memory/536-288-0x00000000011C0000-0x00000000011D1000-memory.dmp

Filesize
68KB

Download
memory/536-213-0x0000000004D20000-0x0000000004E42000-memory.dmp

Filesize
1.1MB

Download
memory/536-212-0x00000000016A0000-0x00000000016BA000-memory.dmp

Filesize
104KB

Download
memory/536-204-0x0000000001540000-0x0000000001558000-memory.dmp

Filesize
96KB

Download
memory/536-203-0x00000000011C0000-0x00000000011D1000-memory.dmp

Filesize
68KB

Download
memory/536-201-0x00000000011C0000-0x00000000011D1000-memory.dmp

Filesize
68KB

Download
memory/536-197-0x0000000003090000-0x00000000031E4000-memory.dmp

Filesize
1.3MB

Download
memory/536-188-0x0000000000F61000-0x0000000000F6B000-memory.dmp

Filesize
40KB

Download
memory/536-183-0x0000000001010000-0x000000000103B000-memory.dmp

Filesize
172KB

Download
memory/536-181-0x0000000000F40000-0x0000000000F6A000-memory.dmp

Filesize
168KB

Download
memory/536-179-0x0000000000110000-0x000000000011E000-memory.dmp

Filesize
56KB

Download
memory/652-206-0x0000000003CA0000-0x0000000003DC2000-memory.dmp

Filesize
1.1MB

Download
memory/652-198-0x00000000008C0000-0x00000000008D8000-memory.dmp

Filesize
96KB

Download
memory/652-210-0x0000000003980000-0x00000000039AB000-memory.dmp

Filesize
172KB

Download
memory/652-208-0x0000000003950000-0x000000000397A000-memory.dmp

Filesize
168KB

Download
memory/652-195-0x00000000028E0000-0x0000000002B48000-memory.dmp

Filesize
2.4MB

Download
memory/652-186-0x0000000002740000-0x00000000028D3000-memory.dmp

Filesize
1.6MB

Download
memory/652-244-0x0000000003F60000-0x0000000003F71000-memory.dmp

Filesize
68KB

Download
memory/652-243-0x0000000003F60000-0x0000000003F71000-memory.dmp

Filesize
68KB

Download
memory/652-242-0x0000000003F60000-0x0000000003F71000-memory.dmp

Filesize
68KB

Download
memory/1444-118-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1444-54-0x0000000075D71000-0x0000000075D73000-memory.dmp

Filesize
8KB

Download
memory/1444-57-0x0000000000020000-0x0000000000034000-memory.dmp

Filesize
80KB

Download
memory/1444-55-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1444-56-0x0000000000020000-0x0000000000034000-memory.dmp

Filesize
80KB

Download
memory/1444-111-0x0000000003300000-0x000000000341E000-memory.dmp

Filesize
1.1MB

Download
memory/1444-65-0x0000000003BE0000-0x0000000003DE0000-memory.dmp

Filesize
2.0MB

Download
memory/1512-89-0x0000000002120000-0x000000000214C000-memory.dmp

Filesize
176KB

Download
memory/1512-71-0x00000000027B0000-0x00000000027BE000-memory.dmp

Filesize
56KB

Download
memory/1512-117-0x00000000037CD000-0x00000000037D8000-memory.dmp

Filesize
44KB

Download
memory/1512-81-0x0000000003550000-0x000000000365A000-memory.dmp

Filesize
1.0MB

Download
memory/1512-216-0x0000000002770000-0x0000000002791000-memory.dmp

Filesize
132KB

Download
memory/1512-66-0x0000000000400000-0x0000000000600000-memory.dmp

Filesize
2.0MB

Download
memory/1512-226-0x0000000002770000-0x0000000002784000-memory.dmp

Filesize
80KB

Download
memory/1512-67-0x0000000000BE0000-0x0000000000DE0000-memory.dmp

Filesize
2.0MB

Download
memory/1512-215-0x0000000002771000-0x000000000278A000-memory.dmp

Filesize
100KB

Download
memory/1512-114-0x0000000003760000-0x00000000037D7000-memory.dmp

Filesize
476KB

Download
memory/1512-222-0x0000000003781000-0x00000000037E2000-memory.dmp

Filesize
388KB

Download
memory/1512-223-0x0000000003780000-0x00000000037F7000-memory.dmp

Filesize
476KB

Download
memory/1512-92-0x00000000030D0000-0x00000000030F4000-memory.dmp

Filesize
144KB

Download
memory/1512-103-0x0000000003760000-0x00000000037D7000-memory.dmp

Filesize
476KB

Download
memory/1512-120-0x0000000000400000-0x0000000000600000-memory.dmp

Filesize
2.0MB

Download
memory/1808-130-0x00000000005C0000-0x00000000005D9000-memory.dmp

Filesize
100KB

Download
memory/1936-116-0x0000000000B60000-0x0000000000C7E000-memory.dmp

Filesize
1.1MB

Download
memory/1936-115-0x0000000000B60000-0x0000000000C7E000-memory.dmp

Filesize
1.1MB

Download
memory/1936-112-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/1936-231-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/1936-171-0x0000000003E50000-0x0000000003ED9000-memory.dmp

Filesize
548KB

Download
memory/1936-170-0x0000000003E50000-0x0000000003ED9000-memory.dmp

Filesize
548KB

Download
memory/2036-180-0x0000000002A10000-0x0000000002ADD000-memory.dmp

Filesize
820KB

Download
memory/2036-177-0x00000000023C0000-0x00000000023DA000-memory.dmp

Filesize
104KB

Download