Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 14:02
Static task
static1
Behavioral task
behavioral1
Sample
a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe
Resource
win10v2004-20220901-en
General
-
Target
a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe
-
Size
303KB
-
MD5
cc196ce61d0d922ac6f98337e31d1ceb
-
SHA1
0ecb019ccf5b0ef6a12b25ac302610167f5495dc
-
SHA256
a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76
-
SHA512
58276508991d43390eedb7ae9035f11d63f2023e2d3f7cf75174563568bec6116cb7a7e1c86df21d78a6b96b4226a926edd247f47576aed605c3bc54457fa5cb
-
SSDEEP
6144:wsqod870Aa5Xh289/xhYzVeyIwNg8/zIBiwdWwcdRLvPpZh14Tn:LuvaxhjIIyrg87D57RLnpPOTn
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\tongji.dll acprotect C:\Users\Admin\AppData\Local\Temp\tongji.dll acprotect -
Downloads MZ/PE file
-
Executes dropped EXE 25 IoCs
Processes:
9377mycs_Y_mgaz2_01.exeMYLogger.exeMYLogger.exeMYLogger.exeMYLogger.exeBingPy_1.5.73.04_pptv8.exeOfficeAssist.0195.80.1043.exeOfficeAssist.0195.80.1043.exeBingIMEUpdateService.exeInstallUtils.exeInstallUtils.exeInstallUtils.exeSaveUidToConfigFile.exeInstallUtils.exeBingIMEPlatform.exeBingIMEPlatform.exeklconsole.exeklconsole.exeassistupdate.exenotify.exeklconsole.exeklconsole.exeInstallUtils.exeInstallUtils.exeBingIMEtmp1.exepid process 412 9377mycs_Y_mgaz2_01.exe 4688 MYLogger.exe 1340 MYLogger.exe 348 MYLogger.exe 1004 MYLogger.exe 952 BingPy_1.5.73.04_pptv8.exe 4412 OfficeAssist.0195.80.1043.exe 4600 OfficeAssist.0195.80.1043.exe 4912 BingIMEUpdateService.exe 2284 InstallUtils.exe 4036 InstallUtils.exe 2384 InstallUtils.exe 1944 SaveUidToConfigFile.exe 5036 InstallUtils.exe 3688 BingIMEPlatform.exe 1456 BingIMEPlatform.exe 2124 klconsole.exe 2996 klconsole.exe 2248 assistupdate.exe 2356 notify.exe 3056 klconsole.exe 3484 klconsole.exe 2744 InstallUtils.exe 3184 InstallUtils.exe 3964 BingIMEtmp1.exe -
Registers COM server for autorun 1 TTPs 16 IoCs
Processes:
regsvr32.exeregsvr32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\WOW6432Node\CLSID\{1077138E-896C-445E-BD31-CFCFFA4636C4}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{034DF736-A378-4292-ACAE-A561088999F5}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\PPTAssist\\pptassist64.dll" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{1077138E-896C-445E-BD31-CFCFFA4636C4}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\PPTAssist\\pptassist64.dll" regsvr32.exe Key deleted \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{1077138E-896C-445E-BD31-CFCFFA4636C4}\InprocServer32 regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\WOW6432Node\CLSID\{034DF736-A378-4292-ACAE-A561088999F5}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\WOW6432Node\CLSID\{034DF736-A378-4292-ACAE-A561088999F5}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\PPTAssist\\pptassist.dll" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\WOW6432Node\CLSID\{034DF736-A378-4292-ACAE-A561088999F5}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key deleted \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\WOW6432Node\CLSID\{1077138E-896C-445E-BD31-CFCFFA4636C4}\InprocServer32 regsvr32.exe Key deleted \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\WOW6432Node\CLSID\{034DF736-A378-4292-ACAE-A561088999F5}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{034DF736-A378-4292-ACAE-A561088999F5}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{1077138E-896C-445E-BD31-CFCFFA4636C4}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{1077138E-896C-445E-BD31-CFCFFA4636C4}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\WOW6432Node\CLSID\{1077138E-896C-445E-BD31-CFCFFA4636C4}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\WOW6432Node\CLSID\{1077138E-896C-445E-BD31-CFCFFA4636C4}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\PPTAssist\\pptassist.dll" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{034DF736-A378-4292-ACAE-A561088999F5}\InprocServer32 regsvr32.exe Key deleted \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{034DF736-A378-4292-ACAE-A561088999F5}\InprocServer32 regsvr32.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\tongji.dll upx behavioral2/memory/4084-225-0x0000000072D60000-0x0000000072DE0000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\tongji.dll upx -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
MYLogger.exeOfficeAssist.0195.80.1043.exe9377mycs_Y_mgaz2_01.exeMYLogger.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation MYLogger.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation OfficeAssist.0195.80.1043.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 9377mycs_Y_mgaz2_01.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation MYLogger.exe -
Loads dropped DLL 64 IoCs
Processes:
a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe9377mycs_Y_mgaz2_01.exeMYLogger.exeMYLogger.exerundll32.exeMYLogger.exeMYLogger.exeMsiExec.exeOfficeAssist.0195.80.1043.exeMsiExec.exeregsvr32.exeregsvr32.exeregsvr32.exeklconsole.exepid process 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 412 9377mycs_Y_mgaz2_01.exe 412 9377mycs_Y_mgaz2_01.exe 412 9377mycs_Y_mgaz2_01.exe 412 9377mycs_Y_mgaz2_01.exe 412 9377mycs_Y_mgaz2_01.exe 412 9377mycs_Y_mgaz2_01.exe 412 9377mycs_Y_mgaz2_01.exe 412 9377mycs_Y_mgaz2_01.exe 412 9377mycs_Y_mgaz2_01.exe 412 9377mycs_Y_mgaz2_01.exe 412 9377mycs_Y_mgaz2_01.exe 4688 MYLogger.exe 1340 MYLogger.exe 4084 rundll32.exe 1004 MYLogger.exe 348 MYLogger.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 396 MsiExec.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 396 MsiExec.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4412 OfficeAssist.0195.80.1043.exe 4412 OfficeAssist.0195.80.1043.exe 4252 MsiExec.exe 2124 regsvr32.exe 1772 regsvr32.exe 4432 regsvr32.exe 2124 klconsole.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
msedge.exeInstallUtils.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InstallUtils.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BingIME = "\"C:\\Program Files (x86)\\Microsoft Bing Pinyin\\1.5.73.04\\Shared\\QuickStart.exe\" /inform" InstallUtils.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exedescription ioc process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe -
Drops file in System32 directory 3 IoCs
Processes:
InstallUtils.exedescription ioc process File created C:\Windows\SysWow64\kunlun.ime InstallUtils.exe File opened for modification C:\Windows\SysWow64\kunlun.ime InstallUtils.exe File created C:\Windows\system32\kunlun.ime InstallUtils.exe -
Drops file in Program Files directory 64 IoCs
Processes:
msiexec.exedescription ioc process File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\Plugins\BingDictionary\down-hover.png msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\Plugins\Emoticon\up-hover.png msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\Plugins\Symbol\logo.png msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\AppsHome\moreview.png msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\ConfigurationPanel\close.png msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\Plugins\Emoticon\down-hover.png msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\userdefinephrase.dat msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\Plugins\AutoSuggest\webjs.js msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\Plugins\ImageSearch\defaultstyle.css msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\ConfigurationPanel\bluesky.png msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\Plugins\WFamousPeople\SinaLogo.gif msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\Plugins\BingDictionary\dicttip.png msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\Plugins\Wiki\engine.js msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\ConfigurationPanel\Gear.png msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\Skins\隽永经典.imeskin msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\Skins\清新斜阴影.imeskin msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\Plugins\Symbol\manifest.xml msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\QuickStart\QuickInform.htm msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\sqlite3.dll msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\Skins\清爽简洁.imeskin msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\ConfigurationPanel\closehover.png msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\ConfigurationPanel\EUDCViewer.htm msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\ConfigurationPanel\KConfigUtils.js msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\ConfigurationPanel\hnav9.png msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\Plugins\MapApp\default_insert.xsl msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\Plugins\SuperEmoticons\fileinsert.xsl msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\Plugins\ImageSearch\imagetip.png msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\ConfigurationPanel\AddUDP.htm msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\EUDC\BingImeEUDC.tte msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\ConfigurationPanel\key.png msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\Plugins\Navigation\insert_text.xsl msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\ConfigurationPanel\LexiconViewer.htm msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\Plugins\SuperEmoticons\ImageRichCandidates-1.0.js msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\ConfigurationPanel\hnavigator.png msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\Plugins\Emoticon\up-active.png msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\Plugins\AutoSuggest\defaultstyle.css msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\ConfigurationPanel\advance_grey.png msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\QuickStart\404.htm msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\Plugins\SuperEmoticons\htmldisplay.xsl msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\AppsHome\up-active.png msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\ConfigurationPanel\skin_none.jpg msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\Plugins\ImageSearch\down.png msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\ConfigurationPanel\win8.png msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\Plugins\WFamousPeople\Weibo_insert.xsl msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\EUDC\BingImeEUDC.EUF msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\ConfigurationPanel\jquery-1.7.2.min.js msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\Plugins\SuperEmoticons\htmlinsert.xsl msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\Plugins\WFamousPeople\up-hover.png msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\QuickStart\AllInOne.png msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\SendSmile.exe msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\Skins\Win8印象.imeskin msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\QuickStart\endlessdark.png msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\Plugins\Video\html_insert.xsl msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\Plugins\Emoticon\html_insert.xsl msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\ConfigurationPanel\spacetour.png msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\Plugins\WFamousPeople\weibo.png msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\Plugins\AutoSuggest\asicon.png msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\Plugins\Symbol\symbolicon.png msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\ConfigurationPanel\hnav4.png msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\QuickStart\info_logo.png msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\Utils\ok_active.png msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\AppsHome\X.png msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\ConfigurationPanel\UserLogin.png msiexec.exe File created C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\Plugins\Symbol\html_insert.xsl msiexec.exe -
Drops file in Windows directory 16 IoCs
Processes:
msiexec.exenotify.exeassistupdate.exedescription ioc process File opened for modification C:\Windows\Installer\e588056.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI8F99.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI945D.tmp msiexec.exe File created C:\Windows\Tasks\PPTAssistantNotifyTask_Admin.job notify.exe File created C:\Windows\Installer\SourceHash{55B12382-9145-4988-B4A7-E3CB4AB7BEBC} msiexec.exe File opened for modification C:\Windows\Installer\MSI8FD8.tmp msiexec.exe File opened for modification C:\Windows\Installer\{55B12382-9145-4988-B4A7-E3CB4AB7BEBC}\icon.ico msiexec.exe File created C:\Windows\Installer\e588059.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIB3EE.tmp msiexec.exe File created C:\Windows\Installer\{55B12382-9145-4988-B4A7-E3CB4AB7BEBC}\icon.ico msiexec.exe File opened for modification C:\Windows\Installer\MSIA1CC.tmp msiexec.exe File created C:\Windows\Tasks\PPTAssistantUpdateTask_Admin.job assistupdate.exe File created C:\Windows\Installer\e588056.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\nsoC422.tmp\9377mycs_Y_mgaz2_01.exe nsis_installer_1 C:\Users\Admin\AppData\Local\Temp\nsoC422.tmp\9377mycs_Y_mgaz2_01.exe nsis_installer_2 C:\Users\Admin\AppData\Local\Temp\nsoC422.tmp\9377mycs_Y_mgaz2_01.exe nsis_installer_1 C:\Users\Admin\AppData\Local\Temp\nsoC422.tmp\9377mycs_Y_mgaz2_01.exe nsis_installer_2 -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Processes:
InstallUtils.exeMYLogger.exeMYLogger.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{48D6D071-0BF4-4BB3-A09C-7B1937FE0E0D}\Policy = "3" InstallUtils.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A41DF24E-5929-4854-8609-A1DF8E691EF5} InstallUtils.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A41DF24E-5929-4854-8609-A1DF8E691EF5}\Policy = "3" InstallUtils.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{48D6D071-0BF4-4BB3-A09C-7B1937FE0E0D} InstallUtils.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{48D6D071-0BF4-4BB3-A09C-7B1937FE0E0D}\AppPath = "C:\\Program Files (x86)\\Microsoft Bing Pinyin\\1.5.73.04\\Shared" InstallUtils.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{48D6D071-0BF4-4BB3-A09C-7B1937FE0E0D}\Policy = "3" InstallUtils.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" MYLogger.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6C26AA37-C79E-41A0-851E-AE4FD00E6BF8}\AppPath = "C:\\Program Files (x86)\\Microsoft Bing Pinyin\\1.5.73.04\\Shared" InstallUtils.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4B1D516D-8788-4315-9A15-A463E46825D2} InstallUtils.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A41DF24E-5929-4854-8609-A1DF8E691EF5}\AppPath = "C:\\Program Files (x86)\\Microsoft Bing Pinyin\\1.5.73.04\\Shared" InstallUtils.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4B1D516D-8788-4315-9A15-A463E46825D2}\Policy = "3" InstallUtils.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4B1D516D-8788-4315-9A15-A463E46825D2}\AppName = "CrashReporter.exe" InstallUtils.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A41DF24E-5929-4854-8609-A1DF8E691EF5} InstallUtils.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A41DF24E-5929-4854-8609-A1DF8E691EF5}\AppName = "ConfigurationPanel.exe" InstallUtils.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4B1D516D-8788-4315-9A15-A463E46825D2}\AppName = "CrashReporter.exe" InstallUtils.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" MYLogger.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A41DF24E-5929-4854-8609-A1DF8E691EF5}\AppName = "ConfigurationPanel.exe" InstallUtils.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION InstallUtils.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A41DF24E-5929-4854-8609-A1DF8E691EF5}\AppPath = "C:\\Program Files (x86)\\Microsoft Bing Pinyin\\1.5.73.04\\Shared" InstallUtils.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4B1D516D-8788-4315-9A15-A463E46825D2}\Policy = "3" InstallUtils.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch MYLogger.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\IESettingSync MYLogger.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{48D6D071-0BF4-4BB3-A09C-7B1937FE0E0D} InstallUtils.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{48D6D071-0BF4-4BB3-A09C-7B1937FE0E0D}\AppName = "SendSmile.exe" InstallUtils.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4B1D516D-8788-4315-9A15-A463E46825D2}\AppPath = "C:\\Program Files (x86)\\Microsoft Bing Pinyin\\1.5.73.04\\Shared" InstallUtils.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch MYLogger.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\IESettingSync MYLogger.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{48D6D071-0BF4-4BB3-A09C-7B1937FE0E0D}\AppPath = "C:\\Program Files (x86)\\Microsoft Bing Pinyin\\1.5.73.04\\Shared" InstallUtils.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6C26AA37-C79E-41A0-851E-AE4FD00E6BF8} InstallUtils.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6C26AA37-C79E-41A0-851E-AE4FD00E6BF8}\AppName = "BingIMEPlatform.exe" InstallUtils.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\BingIMEPlatform.exe = "9999" InstallUtils.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6C26AA37-C79E-41A0-851E-AE4FD00E6BF8}\Policy = "3" InstallUtils.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4B1D516D-8788-4315-9A15-A463E46825D2} InstallUtils.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6C26AA37-C79E-41A0-851E-AE4FD00E6BF8} InstallUtils.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6C26AA37-C79E-41A0-851E-AE4FD00E6BF8}\AppName = "BingIMEPlatform.exe" InstallUtils.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A41DF24E-5929-4854-8609-A1DF8E691EF5}\Policy = "3" InstallUtils.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" MYLogger.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" MYLogger.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6C26AA37-C79E-41A0-851E-AE4FD00E6BF8}\Policy = "3" InstallUtils.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{48D6D071-0BF4-4BB3-A09C-7B1937FE0E0D}\AppName = "SendSmile.exe" InstallUtils.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4B1D516D-8788-4315-9A15-A463E46825D2}\AppPath = "C:\\Program Files (x86)\\Microsoft Bing Pinyin\\1.5.73.04\\Shared" InstallUtils.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6C26AA37-C79E-41A0-851E-AE4FD00E6BF8}\AppPath = "C:\\Program Files (x86)\\Microsoft Bing Pinyin\\1.5.73.04\\Shared" InstallUtils.exe -
Modifies data under HKEY_USERS 21 IoCs
Processes:
BingIMEPlatform.exeInstallUtils.exemsiexec.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" BingIMEPlatform.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\KunlunInput\Flight\CycleTime = "4" BingIMEPlatform.exe Key created \REGISTRY\USER\.DEFAULT\Keyboard Layout\Preload InstallUtils.exe Set value (str) \REGISTRY\USER\.DEFAULT\Keyboard Layout\Preload\2 = "E0200804" InstallUtils.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix BingIMEPlatform.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" BingIMEPlatform.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" BingIMEPlatform.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" BingIMEPlatform.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ BingIMEPlatform.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\KunlunInput\Flight\ BingIMEPlatform.exe Key created \REGISTRY\USER\.DEFAULT\Software BingIMEPlatform.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft BingIMEPlatform.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\KunlunInput\Flight BingIMEPlatform.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" BingIMEPlatform.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" BingIMEPlatform.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\KunlunInput BingIMEPlatform.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20 msiexec.exe -
Modifies registry class 64 IoCs
Processes:
OfficeAssist.0195.80.1043.exeregsvr32.exeregsvr32.exeBingIMEPlatform.exeInstallUtils.exemsiexec.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{847EA60C-C1E6-4DC1-9847-78BC03A80AF0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OfficeAssist.0195.80.1043.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C03D8-0000-0000-C000-000000000046} OfficeAssist.0195.80.1043.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\PPTAssist.Addins.1\ = "PPTAssist Class" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\PPTAssist.Addins regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\PPTAssist.Addins\CurVer\ = "PPTAssist.Addins.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C0310-0000-0000-C000-000000000046}\TypeLib\Version = "2.8" OfficeAssist.0195.80.1043.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\kunlun.app\shell\open BingIMEPlatform.exe Key created \REGISTRY\MACHINE\Software\Classes\.imeudc BingIMEPlatform.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\HELPDIR OfficeAssist.0195.80.1043.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\TypeLib OfficeAssist.0195.80.1043.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\PPTAssist.Control.1\CLSID regsvr32.exe Key deleted \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\WOW6432Node\CLSID\{034DF736-A378-4292-ACAE-A561088999F5}\InprocServer32 regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Interface\{D5D8E0B6-F42F-43B2-BE45-7A065242F6EE}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{034DF736-A378-4292-ACAE-A561088999F5}\Programmable regsvr32.exe Key deleted \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\WOW6432Node\CLSID\{1077138E-896C-445E-BD31-CFCFFA4636C4}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\Software\Classes\Applications\BingIMEPlatform.exe\shell\open\command BingIMEPlatform.exe Key created \REGISTRY\MACHINE\Software\Classes\.imeapp BingIMEPlatform.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C031F-0000-0000-C000-000000000046}\TypeLib\Version = "2.8" OfficeAssist.0195.80.1043.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\kunlun.data BingIMEPlatform.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C03D8-0000-0000-C000-000000000046}\ProxyStubClsid32 OfficeAssist.0195.80.1043.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\PPTAssist.Addins\CurVer regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\PPTAssist.Control regsvr32.exe Key deleted \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{034DF736-A378-4292-ACAE-A561088999F5} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\BingIMEPlatform.exe\SupportedTypes\.imeskin BingIMEPlatform.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C03D9-0000-0000-C000-000000000046}\TypeLib OfficeAssist.0195.80.1043.exe Key deleted \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\WOW6432Node\CLSID\{1077138E-896C-445E-BD31-CFCFFA4636C4}\Version regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{034DF736-A378-4292-ACAE-A561088999F5}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\PPTAssist\\pptassist64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.imeudc\ = "kunlun.eudc" BingIMEPlatform.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C0398-0000-0000-C000-000000000046}\TypeLib\ = "{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}" OfficeAssist.0195.80.1043.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{1077138E-896C-445E-BD31-CFCFFA4636C4}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.imeskin\ = "kunlun.skin" BingIMEPlatform.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\BingIMEPlatform.exe\shell BingIMEPlatform.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\BingIMEPlatform.exe\shell\open BingIMEPlatform.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\PPTAssist.Addins\ = "PPTAssist Class" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\PPTAssist.Addins\CLSID regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Interface\{D5D8E0B6-F42F-43B2-BE45-7A065242F6EE}\ = "IWpsAssistControl" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{034DF736-A378-4292-ACAE-A561088999F5}\VersionIndependentProgID\ = "PPTAssist.Addins" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\BingIMEPlatform.exe\shell\open\FriendlyAppName = "必应 Bing 输入法 数据更新文件安装工具" BingIMEPlatform.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C0311-0000-0000-C000-000000000046}\TypeLib\Version = "2.8" OfficeAssist.0195.80.1043.exe Key deleted \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{1077138E-896C-445E-BD31-CFCFFA4636C4}\Version regsvr32.exe Key created \REGISTRY\MACHINE\Software\Classes\Applications\BingIMEPlatform.exe BingIMEPlatform.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\kunlun.eudc\shell\open\command BingIMEPlatform.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\WOW6432Node\CLSID\{034DF736-A378-4292-ACAE-A561088999F5}\InprocServer32 regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{034DF736-A378-4292-ACAE-A561088999F5}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{034DF736-A378-4292-ACAE-A561088999F5}\TypeLib\ = "{D68E2E9E-75B9-4D1A-99DB-5C83A17D5518}" regsvr32.exe Key deleted \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{034DF736-A378-4292-ACAE-A561088999F5}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\Software\Classes\kunlun.data\DefaultIcon BingIMEPlatform.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C031A-0000-0000-C000-000000000046}\TypeLib\ = "{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}" OfficeAssist.0195.80.1043.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C03D9-0000-0000-C000-000000000046} OfficeAssist.0195.80.1043.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\WOW6432Node\Interface\{D5D8E0B6-F42F-43B2-BE45-7A065242F6EE}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{974835C6-A61F-464D-BA3B-B9E731934C54} InstallUtils.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{08D6CD0F-98AA-468B-81F3-A6B2CB6C84C9}\ProxyStubClsid32 OfficeAssist.0195.80.1043.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\28321B55541988944B7A3EBCA47BEBCB\DefaultFeature4 msiexec.exe Key deleted \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\WOW6432Node\CLSID\{1077138E-896C-445E-BD31-CFCFFA4636C4}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\kunlun.data\ = "必应 Bing 输入法 数据更新文件" BingIMEPlatform.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C031F-0000-0000-C000-000000000046}\TypeLib\ = "{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}" OfficeAssist.0195.80.1043.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C0321-0000-0000-C000-000000000046}\TypeLib\ = "{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}" OfficeAssist.0195.80.1043.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\WOW6432Node\CLSID\{1077138E-896C-445E-BD31-CFCFFA4636C4}\VersionIndependentProgID\ = "PPTAssist.Control" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\TypeLib\{D68E2E9E-75B9-4D1A-99DB-5C83A17D5518}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\kunlun.skin\shell\open BingIMEPlatform.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C1534-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OfficeAssist.0195.80.1043.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C03D8-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OfficeAssist.0195.80.1043.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\WOW6432Node\CLSID\{034DF736-A378-4292-ACAE-A561088999F5}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{1077138E-896C-445E-BD31-CFCFFA4636C4}\Programmable regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exemsedge.exemsedge.exeidentity_helper.exerundll32.exeOfficeAssist.0195.80.1043.exeassistupdate.exenotify.exeOfficeAssist.0195.80.1043.exepid process 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe 3772 msedge.exe 3772 msedge.exe 4592 msedge.exe 4592 msedge.exe 4640 identity_helper.exe 4640 identity_helper.exe 4084 rundll32.exe 4084 rundll32.exe 4600 OfficeAssist.0195.80.1043.exe 4600 OfficeAssist.0195.80.1043.exe 2248 assistupdate.exe 2248 assistupdate.exe 2356 notify.exe 2356 notify.exe 4412 OfficeAssist.0195.80.1043.exe 4412 OfficeAssist.0195.80.1043.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
Processes:
msedge.exepid process 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
rundll32.exemsiexec.exemsiexec.exeOfficeAssist.0195.80.1043.exedescription pid process Token: SeDebugPrivilege 4084 rundll32.exe Token: SeShutdownPrivilege 764 msiexec.exe Token: SeIncreaseQuotaPrivilege 764 msiexec.exe Token: SeSecurityPrivilege 2336 msiexec.exe Token: SeCreateTokenPrivilege 764 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 764 msiexec.exe Token: SeLockMemoryPrivilege 764 msiexec.exe Token: SeIncreaseQuotaPrivilege 764 msiexec.exe Token: SeMachineAccountPrivilege 764 msiexec.exe Token: SeTcbPrivilege 764 msiexec.exe Token: SeSecurityPrivilege 764 msiexec.exe Token: SeTakeOwnershipPrivilege 764 msiexec.exe Token: SeLoadDriverPrivilege 764 msiexec.exe Token: SeSystemProfilePrivilege 764 msiexec.exe Token: SeSystemtimePrivilege 764 msiexec.exe Token: SeProfSingleProcessPrivilege 764 msiexec.exe Token: SeIncBasePriorityPrivilege 764 msiexec.exe Token: SeCreatePagefilePrivilege 764 msiexec.exe Token: SeCreatePermanentPrivilege 764 msiexec.exe Token: SeBackupPrivilege 764 msiexec.exe Token: SeRestorePrivilege 764 msiexec.exe Token: SeShutdownPrivilege 764 msiexec.exe Token: SeDebugPrivilege 764 msiexec.exe Token: SeAuditPrivilege 764 msiexec.exe Token: SeSystemEnvironmentPrivilege 764 msiexec.exe Token: SeChangeNotifyPrivilege 764 msiexec.exe Token: SeRemoteShutdownPrivilege 764 msiexec.exe Token: SeUndockPrivilege 764 msiexec.exe Token: SeSyncAgentPrivilege 764 msiexec.exe Token: SeEnableDelegationPrivilege 764 msiexec.exe Token: SeManageVolumePrivilege 764 msiexec.exe Token: SeImpersonatePrivilege 764 msiexec.exe Token: SeCreateGlobalPrivilege 764 msiexec.exe Token: SeRestorePrivilege 2336 msiexec.exe Token: SeTakeOwnershipPrivilege 2336 msiexec.exe Token: SeRestorePrivilege 2336 msiexec.exe Token: SeTakeOwnershipPrivilege 2336 msiexec.exe Token: SeRestorePrivilege 2336 msiexec.exe Token: SeTakeOwnershipPrivilege 2336 msiexec.exe Token: SeRestorePrivilege 2336 msiexec.exe Token: SeTakeOwnershipPrivilege 2336 msiexec.exe Token: SeRestorePrivilege 2336 msiexec.exe Token: SeTakeOwnershipPrivilege 2336 msiexec.exe Token: SeDebugPrivilege 4600 OfficeAssist.0195.80.1043.exe Token: SeRestorePrivilege 2336 msiexec.exe Token: SeTakeOwnershipPrivilege 2336 msiexec.exe Token: SeRestorePrivilege 2336 msiexec.exe Token: SeTakeOwnershipPrivilege 2336 msiexec.exe Token: SeRestorePrivilege 2336 msiexec.exe Token: SeTakeOwnershipPrivilege 2336 msiexec.exe Token: SeRestorePrivilege 2336 msiexec.exe Token: SeTakeOwnershipPrivilege 2336 msiexec.exe Token: SeRestorePrivilege 2336 msiexec.exe Token: SeTakeOwnershipPrivilege 2336 msiexec.exe Token: SeRestorePrivilege 2336 msiexec.exe Token: SeTakeOwnershipPrivilege 2336 msiexec.exe Token: SeRestorePrivilege 2336 msiexec.exe Token: SeTakeOwnershipPrivilege 2336 msiexec.exe Token: SeRestorePrivilege 2336 msiexec.exe Token: SeTakeOwnershipPrivilege 2336 msiexec.exe Token: SeRestorePrivilege 2336 msiexec.exe Token: SeTakeOwnershipPrivilege 2336 msiexec.exe Token: SeRestorePrivilege 2336 msiexec.exe Token: SeTakeOwnershipPrivilege 2336 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msedge.exepid process 4592 msedge.exe 4592 msedge.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
MYLogger.exeMYLogger.exepid process 4688 MYLogger.exe 4688 MYLogger.exe 1340 MYLogger.exe 1340 MYLogger.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exemsedge.exedescription pid process target process PID 4816 wrote to memory of 4592 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe msedge.exe PID 4816 wrote to memory of 4592 4816 a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe msedge.exe PID 4592 wrote to memory of 3668 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3668 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3456 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3456 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3456 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3456 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3456 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3456 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3456 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3456 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3456 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3456 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3456 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3456 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3456 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3456 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3456 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3456 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3456 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3456 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3456 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3456 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3456 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3456 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3456 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3456 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3456 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3456 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3456 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3456 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3456 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3456 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3456 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3456 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3456 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3456 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3456 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3456 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3456 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3456 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3456 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3456 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3772 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3772 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3316 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3316 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3316 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3316 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3316 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3316 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3316 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3316 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3316 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3316 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3316 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3316 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3316 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3316 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3316 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3316 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3316 4592 msedge.exe msedge.exe PID 4592 wrote to memory of 3316 4592 msedge.exe msedge.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe"C:\Users\Admin\AppData\Local\Temp\a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://f.handanxinyuan.com/a87aabec4e7725a94622acd75e083f3f17702ee0d92fd5bf712ca9dbdb932c76.exe/40.jpg3⤵
- Adds Run key to start application
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc2f4346f8,0x7ffc2f434708,0x7ffc2f4347184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,7258610181185161274,5283096122342339114,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:24⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,7258610181185161274,5283096122342339114,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,7258610181185161274,5283096122342339114,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2964 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7258610181185161274,5283096122342339114,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7258610181185161274,5283096122342339114,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2100,7258610181185161274,5283096122342339114,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5360 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7258610181185161274,5283096122342339114,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2100,7258610181185161274,5283096122342339114,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3832 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7258610181185161274,5283096122342339114,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3976 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7258610181185161274,5283096122342339114,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,7258610181185161274,5283096122342339114,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6004 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff6ea205460,0x7ff6ea205470,0x7ff6ea2054805⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,7258610181185161274,5283096122342339114,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6004 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2100,7258610181185161274,5283096122342339114,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5108 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2100,7258610181185161274,5283096122342339114,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6188 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2100,7258610181185161274,5283096122342339114,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2576 /prefetch:84⤵
-
C:\Users\Admin\AppData\Local\Temp\nsoC422.tmp\9377mycs_Y_mgaz2_01.exe9377mycs_Y_mgaz2_01.exe3⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
-
C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MYLogger.exe"C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MYLogger.exe" "C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MeiYing.dll"4⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MYLogger.exe"C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MYLogger.exe" "C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MeiYing.dll" "1"5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MYLogger.exe"C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MYLogger.exe" "C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MeiYing.dll"4⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MYLogger.exe"C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MYLogger.exe" "C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MeiYing.dll" "1"5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\tongji.dll",10004⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\nsoC422.tmp\BingPy_1.5.73.04_pptv8.exeBingPy_1.5.73.04_pptv8.exe3⤵
- Executes dropped EXE
-
C:\Windows\system32\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\LocalLow\KunlunInput\InstallerCache\1.5.73.04.msi" /quiet4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\BingIMEtmp1.exe/quiet4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\nsoC422.tmp\OfficeAssist.0195.80.1043.exeOfficeAssist.0195.80.1043.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\kingsoft\20221125_214104\OfficeAssist.0195.80.1043.exe"C:\ProgramData\kingsoft\20221125_214104\OfficeAssist.0195.80.1043.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\PPTAssist\pptassist.dll"5⤵
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\PPTAssist\pptassist64.dll"5⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Users\Admin\AppData\Local\PPTAssist\pptassist64.dll"6⤵
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
-
C:\Users\Admin\AppData\Local\PPTAssist\assistupdate.exe"C:\Users\Admin\AppData\Local\PPTAssist\assistupdate.exe" -createtask5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\PPTAssist\notify.exe"C:\Users\Admin\AppData\Local\PPTAssist\notify.exe" /from:ksostart5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 406FD0339D5410CE9EF06575C6284EB52⤵
- Loads dropped DLL
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F8D7BD7310CF1F887D3B533CD72DDAEB E Global\MSI00002⤵
- Loads dropped DLL
-
C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\bin64\InstallUtils.exe"C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\bin64\InstallUtils.exe" /Install2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\bin64\InstallUtils.exe"C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\bin64\InstallUtils.exe" /Installuser2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\bin64\InstallUtils.exe"C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\bin64\InstallUtils.exe" /settings IsEnglishAssistOn=02⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\bin32\SaveUidToConfigFile.exe"C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\bin32\SaveUidToConfigFile.exe" "C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\uid_configuration.txt"2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\bin32\InstallUtils.exe"C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\bin32\InstallUtils.exe" /setdefault2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\BingIMEPlatform.exe"C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\BingIMEPlatform.exe"2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\BingIMEPlatform.exe"C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\BingIMEPlatform.exe" /regfiletypes2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\klconsole.exe"C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\klconsole.exe" -cmd upgrade2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\klconsole.exe"C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\klconsole.exe" -cmd create123url2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\klconsole.exe"C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\klconsole.exe" -cmd 123shortcutfortianji2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\klconsole.exe"C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\klconsole.exe" -cmd setLastSetDHPDSETime2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\bin64\InstallUtils.exe"C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\bin64\InstallUtils.exe" /DelFiles2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\bin32\InstallUtils.exe"C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\bin32\InstallUtils.exe" /Firstrun2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\BingIMEUpdateService.exe"C:\Program Files (x86)\Microsoft Bing Pinyin\1.5.73.04\Shared\BingIMEUpdateService.exe"1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MYLogger.exeFilesize
377KB
MD5e62edf270beee5820e781404b6792cbc
SHA1b4a31e93ee812786deeab21fc990e1fa72d18f20
SHA256cc6d069c6e4ce7da54901094753cd9df36dcb095b9ead758e809887c2643a5ba
SHA512d0a208e4e692114e0ecfce35c9e33ab69296484b632446f04e8cebd3fef52b4e7fed5877f2321e179a1cb6a822161a6d31370a68b19cc5277819cbbc350c159a
-
C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MYLogger.exeFilesize
377KB
MD5e62edf270beee5820e781404b6792cbc
SHA1b4a31e93ee812786deeab21fc990e1fa72d18f20
SHA256cc6d069c6e4ce7da54901094753cd9df36dcb095b9ead758e809887c2643a5ba
SHA512d0a208e4e692114e0ecfce35c9e33ab69296484b632446f04e8cebd3fef52b4e7fed5877f2321e179a1cb6a822161a6d31370a68b19cc5277819cbbc350c159a
-
C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MYLogger.exeFilesize
377KB
MD5e62edf270beee5820e781404b6792cbc
SHA1b4a31e93ee812786deeab21fc990e1fa72d18f20
SHA256cc6d069c6e4ce7da54901094753cd9df36dcb095b9ead758e809887c2643a5ba
SHA512d0a208e4e692114e0ecfce35c9e33ab69296484b632446f04e8cebd3fef52b4e7fed5877f2321e179a1cb6a822161a6d31370a68b19cc5277819cbbc350c159a
-
C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MYLogger.exeFilesize
377KB
MD5e62edf270beee5820e781404b6792cbc
SHA1b4a31e93ee812786deeab21fc990e1fa72d18f20
SHA256cc6d069c6e4ce7da54901094753cd9df36dcb095b9ead758e809887c2643a5ba
SHA512d0a208e4e692114e0ecfce35c9e33ab69296484b632446f04e8cebd3fef52b4e7fed5877f2321e179a1cb6a822161a6d31370a68b19cc5277819cbbc350c159a
-
C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MYLogger.exeFilesize
377KB
MD5e62edf270beee5820e781404b6792cbc
SHA1b4a31e93ee812786deeab21fc990e1fa72d18f20
SHA256cc6d069c6e4ce7da54901094753cd9df36dcb095b9ead758e809887c2643a5ba
SHA512d0a208e4e692114e0ecfce35c9e33ab69296484b632446f04e8cebd3fef52b4e7fed5877f2321e179a1cb6a822161a6d31370a68b19cc5277819cbbc350c159a
-
C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MYLogger.iniFilesize
245B
MD56c91d263eccb57f415a85307926dedf6
SHA1919aaa48092575ec26a4260e715083bd6ad6176d
SHA2562c165de6432f5582fe9a238b482e57f3a659f912a2f7e626f0baa96b837ddc1d
SHA5129564b395363ebbaa98936c43002e0b981057a14b2b6b23f7c8f5eaeebc86e7357060e064b7de2537a593909c814a95d55dac60d1acaf227d85bd7c199f348f5c
-
C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MeiYing.dllFilesize
463KB
MD5b383bf5a47c46d6a22b1c3d383edc87c
SHA1abfac8a4beb27df27fe9353ed70a30677f7bcaed
SHA256aab3e362c47d454e48f265213bab6e582c3b5c6b7167e54d477c68b9d3dc5b8e
SHA51292618f2db31110bdcb2937a8dc44a81640be8ff589266ade343c9301ee7bf1479995c6b14b6f06e52c2b1e52c4c91f254ca58d664a1cea10e1a1b2d1cf292d29
-
C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MeiYing.dllFilesize
463KB
MD5b383bf5a47c46d6a22b1c3d383edc87c
SHA1abfac8a4beb27df27fe9353ed70a30677f7bcaed
SHA256aab3e362c47d454e48f265213bab6e582c3b5c6b7167e54d477c68b9d3dc5b8e
SHA51292618f2db31110bdcb2937a8dc44a81640be8ff589266ade343c9301ee7bf1479995c6b14b6f06e52c2b1e52c4c91f254ca58d664a1cea10e1a1b2d1cf292d29
-
C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MeiYing.dllFilesize
463KB
MD5b383bf5a47c46d6a22b1c3d383edc87c
SHA1abfac8a4beb27df27fe9353ed70a30677f7bcaed
SHA256aab3e362c47d454e48f265213bab6e582c3b5c6b7167e54d477c68b9d3dc5b8e
SHA51292618f2db31110bdcb2937a8dc44a81640be8ff589266ade343c9301ee7bf1479995c6b14b6f06e52c2b1e52c4c91f254ca58d664a1cea10e1a1b2d1cf292d29
-
C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MeiYing.dllFilesize
463KB
MD5b383bf5a47c46d6a22b1c3d383edc87c
SHA1abfac8a4beb27df27fe9353ed70a30677f7bcaed
SHA256aab3e362c47d454e48f265213bab6e582c3b5c6b7167e54d477c68b9d3dc5b8e
SHA51292618f2db31110bdcb2937a8dc44a81640be8ff589266ade343c9301ee7bf1479995c6b14b6f06e52c2b1e52c4c91f254ca58d664a1cea10e1a1b2d1cf292d29
-
C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MeiYing.dllFilesize
463KB
MD5b383bf5a47c46d6a22b1c3d383edc87c
SHA1abfac8a4beb27df27fe9353ed70a30677f7bcaed
SHA256aab3e362c47d454e48f265213bab6e582c3b5c6b7167e54d477c68b9d3dc5b8e
SHA51292618f2db31110bdcb2937a8dc44a81640be8ff589266ade343c9301ee7bf1479995c6b14b6f06e52c2b1e52c4c91f254ca58d664a1cea10e1a1b2d1cf292d29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_86C2A03C133240EC4C95180B9FD368BBFilesize
471B
MD5f6122d81947d748dc6f9827822c92d12
SHA1839a2d45d347594068364d51f64c9f4feda3f507
SHA2564fa3033581877934483306fc308ec05ce0650b9fedfcdf452c5372962fc899e2
SHA512a125f2b827a17271a91f7141c8c23852bebe15d4e232cfe47efd9e4c57fbd492d4f9d0fb12fb1de8a723c86ffe07dbbc82bf8f9efa9bf39093c1c58d2fde17e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_86C2A03C133240EC4C95180B9FD368BBFilesize
430B
MD5dc52188ea3c5fe1917bd408a45862951
SHA19f740038342a1bed45264c37e1c870833b910a58
SHA256266c519fdf47ce2c63ae44b2c8aa9ce8170f717adfb068e1be426c8243eb0951
SHA512743ea3949e613cc8b4f2b7da9f3dd0564b303692a98d66627c79f9ee315c355089d17338ea504ff8473ec8fd0886483c9453040eab2f618c402cf2869aef3699
-
C:\Users\Admin\AppData\Local\Temp\nsoC422.tmp\9377mycs_Y_mgaz2_01.exeFilesize
986KB
MD53fed8fad8536be426192f52017ee929a
SHA1365e5493c7b38e5adb00f66e9ab4319e3605beba
SHA256a0eafb1bb3c340174fc49d4cd9f2d4b3d800de631bbde2cb1ed7f4e97f6f1a67
SHA5124e41d6b11de739c71e14a26e6d1b4698602a2ff544ffd715fdad9134a527bfe99e75af49feb890dfc3f649202eb9c40f0e2b9f2b8fe4ead39b5b603a4200d7c9
-
C:\Users\Admin\AppData\Local\Temp\nsoC422.tmp\9377mycs_Y_mgaz2_01.exeFilesize
986KB
MD53fed8fad8536be426192f52017ee929a
SHA1365e5493c7b38e5adb00f66e9ab4319e3605beba
SHA256a0eafb1bb3c340174fc49d4cd9f2d4b3d800de631bbde2cb1ed7f4e97f6f1a67
SHA5124e41d6b11de739c71e14a26e6d1b4698602a2ff544ffd715fdad9134a527bfe99e75af49feb890dfc3f649202eb9c40f0e2b9f2b8fe4ead39b5b603a4200d7c9
-
C:\Users\Admin\AppData\Local\Temp\nsoC422.tmp\System.dllFilesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
C:\Users\Admin\AppData\Local\Temp\nsoC422.tmp\inetc.dllFilesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
C:\Users\Admin\AppData\Local\Temp\nsoC422.tmp\inetc.dllFilesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
C:\Users\Admin\AppData\Local\Temp\nsoC422.tmp\inetc.dllFilesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
C:\Users\Admin\AppData\Local\Temp\nsoC422.tmp\inetc.dllFilesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
C:\Users\Admin\AppData\Local\Temp\nsoC422.tmp\inetc.dllFilesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
C:\Users\Admin\AppData\Local\Temp\nsoC422.tmp\inetc.dllFilesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
C:\Users\Admin\AppData\Local\Temp\nsoC422.tmp\inetc.dllFilesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
C:\Users\Admin\AppData\Local\Temp\nsoC422.tmp\inetc.dllFilesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
C:\Users\Admin\AppData\Local\Temp\nsoC422.tmp\inetc.dllFilesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
C:\Users\Admin\AppData\Local\Temp\nsoC422.tmp\inetc.dllFilesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
C:\Users\Admin\AppData\Local\Temp\nsoC422.tmp\inetc.dllFilesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
C:\Users\Admin\AppData\Local\Temp\nsoC422.tmp\inetc.dllFilesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
C:\Users\Admin\AppData\Local\Temp\nsoC422.tmp\inetc.dllFilesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
C:\Users\Admin\AppData\Local\Temp\nsoC422.tmp\inetc.dllFilesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
C:\Users\Admin\AppData\Local\Temp\nsoC422.tmp\inetc.dllFilesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
C:\Users\Admin\AppData\Local\Temp\nsoC422.tmp\inetc.dllFilesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
C:\Users\Admin\AppData\Local\Temp\nsoC422.tmp\inetc.dllFilesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
C:\Users\Admin\AppData\Local\Temp\nsoC422.tmp\inetc.dllFilesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
C:\Users\Admin\AppData\Local\Temp\nsoC422.tmp\inetc.dllFilesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
C:\Users\Admin\AppData\Local\Temp\nsoC422.tmp\inetc.dllFilesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
C:\Users\Admin\AppData\Local\Temp\nsoC422.tmp\inetc.dllFilesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
C:\Users\Admin\AppData\Local\Temp\nsoC422.tmp\inetc.dllFilesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
C:\Users\Admin\AppData\Local\Temp\nsoC422.tmp\nsProcess.dllFilesize
4KB
MD505450face243b3a7472407b999b03a72
SHA1ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
SHA25695fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
SHA512f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
-
C:\Users\Admin\AppData\Local\Temp\nsoC422.tmp\nsProcess.dllFilesize
4KB
MD505450face243b3a7472407b999b03a72
SHA1ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
SHA25695fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
SHA512f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
-
C:\Users\Admin\AppData\Local\Temp\nstB9.tmp\CheckBoxes.dllFilesize
56KB
MD50a5bc22d02bcbf9f1ef8eb23c6188fbd
SHA1e5546e88931c6d6da7f9ec611f5400db2ca5713a
SHA2563640369d7a26f3fdd5b2b69c984b882560d754f3c744fd206724170ced345a7f
SHA512f372e2f3cb3a75447337dea61bae8ddaf293e9a24561ccd2b56e7fe3c1753f05de706bbd6141840a8f0eababcbc35aa2fe8d534755d148fffc9a7502a4defb8f
-
C:\Users\Admin\AppData\Local\Temp\nstB9.tmp\CheckBoxes.dllFilesize
56KB
MD50a5bc22d02bcbf9f1ef8eb23c6188fbd
SHA1e5546e88931c6d6da7f9ec611f5400db2ca5713a
SHA2563640369d7a26f3fdd5b2b69c984b882560d754f3c744fd206724170ced345a7f
SHA512f372e2f3cb3a75447337dea61bae8ddaf293e9a24561ccd2b56e7fe3c1753f05de706bbd6141840a8f0eababcbc35aa2fe8d534755d148fffc9a7502a4defb8f
-
C:\Users\Admin\AppData\Local\Temp\nstB9.tmp\System.dllFilesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
C:\Users\Admin\AppData\Local\Temp\nstB9.tmp\inetc.dllFilesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
C:\Users\Admin\AppData\Local\Temp\nstB9.tmp\inetc.dllFilesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
C:\Users\Admin\AppData\Local\Temp\nstB9.tmp\inetc.dllFilesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
C:\Users\Admin\AppData\Local\Temp\nstB9.tmp\inetc.dllFilesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
C:\Users\Admin\AppData\Local\Temp\nstB9.tmp\ip.dllFilesize
16KB
MD54df6320e8281512932a6e86c98de2c17
SHA1ae6336192d27874f9cd16cd581f1c091850cf494
SHA2567744a495ceacf8584d4f6786699e94a09935a94929d4861142726562af53faa4
SHA5127c468de59614f506a2ce8445ef00267625e5a8e483913cdd18636cea543be0ca241891e75979a55bb67eecc11a7ac0649b48b55a10e9a01362a0250839462d3b
-
C:\Users\Admin\AppData\Local\Temp\nstB9.tmp\ip.dllFilesize
16KB
MD54df6320e8281512932a6e86c98de2c17
SHA1ae6336192d27874f9cd16cd581f1c091850cf494
SHA2567744a495ceacf8584d4f6786699e94a09935a94929d4861142726562af53faa4
SHA5127c468de59614f506a2ce8445ef00267625e5a8e483913cdd18636cea543be0ca241891e75979a55bb67eecc11a7ac0649b48b55a10e9a01362a0250839462d3b
-
C:\Users\Admin\AppData\Local\Temp\nstB9.tmp\webctl.dllFilesize
219KB
MD58250d6c6d6ba52b54379fd4766a8011b
SHA16b69ece2c777be1ca311571432eaa8a51a6c5685
SHA2562a0af1055e9295115abf25d766dc3cb837cb8da4f2d11aeb233b17ccbfeebb60
SHA5120d11c9518917d6a57fe5298c29521cba9ebe1f9f35bab698af4f1bb7e3c1ea2004e82379ecfcba3715724fe2bdd72b1b19f74628b97b2ab84eedd7c571808fdd
-
C:\Users\Admin\AppData\Local\Temp\nstB9.tmp\webctl.dllFilesize
219KB
MD58250d6c6d6ba52b54379fd4766a8011b
SHA16b69ece2c777be1ca311571432eaa8a51a6c5685
SHA2562a0af1055e9295115abf25d766dc3cb837cb8da4f2d11aeb233b17ccbfeebb60
SHA5120d11c9518917d6a57fe5298c29521cba9ebe1f9f35bab698af4f1bb7e3c1ea2004e82379ecfcba3715724fe2bdd72b1b19f74628b97b2ab84eedd7c571808fdd
-
C:\Users\Admin\AppData\Local\Temp\tongji.dllFilesize
174KB
MD5a44fdb269cb8251119f04e3c1c0fbe9a
SHA117d1694aafc8a7c07ab64ca0d737c1cbcfa5d2c7
SHA256474488dfa44b23dedc529c76c8884760b7f66027d2697156e03b3e7272041866
SHA51248d2a3cf1c92f85cc07d72b6765682b55e1be72bc695ee5329da0a1e96720d09fd4e90953d4b5882309118a430794873d64ee50f35331a179461388dd87442b5
-
C:\Users\Admin\AppData\Local\Temp\tongji.dllFilesize
174KB
MD5a44fdb269cb8251119f04e3c1c0fbe9a
SHA117d1694aafc8a7c07ab64ca0d737c1cbcfa5d2c7
SHA256474488dfa44b23dedc529c76c8884760b7f66027d2697156e03b3e7272041866
SHA51248d2a3cf1c92f85cc07d72b6765682b55e1be72bc695ee5329da0a1e96720d09fd4e90953d4b5882309118a430794873d64ee50f35331a179461388dd87442b5
-
\??\pipe\LOCAL\crashpad_4592_LXGYFYPJYXDDOUAWMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/348-227-0x0000000000000000-mapping.dmp
-
memory/396-244-0x0000000000000000-mapping.dmp
-
memory/412-206-0x0000000002171000-0x0000000002178000-memory.dmpFilesize
28KB
-
memory/412-203-0x0000000002170000-0x0000000002180000-memory.dmpFilesize
64KB
-
memory/412-199-0x0000000003300000-0x0000000003346000-memory.dmpFilesize
280KB
-
memory/412-209-0x0000000002171000-0x0000000002174000-memory.dmpFilesize
12KB
-
memory/412-187-0x0000000000000000-mapping.dmp
-
memory/764-238-0x0000000000000000-mapping.dmp
-
memory/952-236-0x0000000000000000-mapping.dmp
-
memory/1004-228-0x0000000000000000-mapping.dmp
-
memory/1316-243-0x0000000000000000-mapping.dmp
-
memory/1340-216-0x0000000000000000-mapping.dmp
-
memory/1344-166-0x0000000000000000-mapping.dmp
-
memory/1456-260-0x0000000000000000-mapping.dmp
-
memory/1772-252-0x0000000000000000-mapping.dmp
-
memory/1944-257-0x0000000000000000-mapping.dmp
-
memory/2124-251-0x0000000000000000-mapping.dmp
-
memory/2124-261-0x0000000000000000-mapping.dmp
-
memory/2248-263-0x0000000000000000-mapping.dmp
-
memory/2284-254-0x0000000000000000-mapping.dmp
-
memory/2288-276-0x0000000000000000-mapping.dmp
-
memory/2356-264-0x0000000000000000-mapping.dmp
-
memory/2384-256-0x0000000000000000-mapping.dmp
-
memory/2744-271-0x0000000000000000-mapping.dmp
-
memory/2952-170-0x0000000000000000-mapping.dmp
-
memory/2996-262-0x0000000000000000-mapping.dmp
-
memory/3056-266-0x0000000000000000-mapping.dmp
-
memory/3092-176-0x0000000000000000-mapping.dmp
-
memory/3184-272-0x0000000000000000-mapping.dmp
-
memory/3232-164-0x0000000000000000-mapping.dmp
-
memory/3316-160-0x0000000000000000-mapping.dmp
-
memory/3352-162-0x0000000000000000-mapping.dmp
-
memory/3456-156-0x0000000000000000-mapping.dmp
-
memory/3484-267-0x0000000000000000-mapping.dmp
-
memory/3668-154-0x0000000000000000-mapping.dmp
-
memory/3688-259-0x0000000000000000-mapping.dmp
-
memory/3772-157-0x0000000000000000-mapping.dmp
-
memory/3964-273-0x0000000000000000-mapping.dmp
-
memory/4036-255-0x0000000000000000-mapping.dmp
-
memory/4084-225-0x0000000072D60000-0x0000000072DE0000-memory.dmpFilesize
512KB
-
memory/4084-218-0x0000000000000000-mapping.dmp
-
memory/4084-226-0x000000006FFF0000-0x0000000070000000-memory.dmpFilesize
64KB
-
memory/4084-224-0x000000006FFF0000-0x0000000070000000-memory.dmpFilesize
64KB
-
memory/4244-172-0x0000000000000000-mapping.dmp
-
memory/4252-250-0x0000000000000000-mapping.dmp
-
memory/4376-168-0x0000000000000000-mapping.dmp
-
memory/4412-246-0x0000000000000000-mapping.dmp
-
memory/4412-274-0x0000000002020000-0x000000000202B000-memory.dmpFilesize
44KB
-
memory/4432-253-0x0000000000000000-mapping.dmp
-
memory/4568-278-0x0000000000000000-mapping.dmp
-
memory/4588-174-0x0000000000000000-mapping.dmp
-
memory/4592-150-0x0000000000000000-mapping.dmp
-
memory/4600-249-0x0000000000000000-mapping.dmp
-
memory/4624-175-0x0000000000000000-mapping.dmp
-
memory/4640-177-0x0000000000000000-mapping.dmp
-
memory/4688-213-0x0000000000000000-mapping.dmp
-
memory/4816-237-0x0000000000521000-0x0000000000524000-memory.dmpFilesize
12KB
-
memory/4816-143-0x0000000004D11000-0x0000000004D14000-memory.dmpFilesize
12KB
-
memory/4816-137-0x0000000004F71000-0x0000000004F74000-memory.dmpFilesize
12KB
-
memory/5036-258-0x0000000000000000-mapping.dmp