ebb8f7dc8b7b63a38b4c99064870b5d8da6305f9b8d426c8c8f8b3e1bb1423c7

Analysis

max time kernel
195s
max time network
159s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 23:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

搜狗导航增值机.exe
Size

532KB
MD5

74c6e0df472160ebb8482729aaa1baee
SHA1

6e1634bb00213a7e557591c3d451baf56291e9de
SHA256

2da1a40d86c8dc33f6851b1614b522cd2ca2f54f7d5f3ccf8fa38908db9271f3
SHA512

05e403abe730dbc7079e3e3cce5d9e6a797542aaec81c917ed84445e324421c725dc208d1af286234e72241a725b0e89e0e224cdfc67d813861422516835d345
SSDEEP

12288:+K2mhAMJ/cPlizen8lwBx7EshSpwreE+/8gfxsdjY9NhEi7D:v2O/Gliquw4P5E+/8gfxsFAEo

Score

8^/10

discovery persistence upx

Malware Config

Signatures

Downloads MZ/PE file

Drops file in Drivers directory 17 IoCs

Processes:

KINSTALLERS_66_4538.exe

description	ioc	process
File created	C:\Windows\system32\drivers\kisknl64.sys	KINSTALLERS_66_4538.exe
File created	C:\Windows\system32\drivers\ksskrpr.sys	KINSTALLERS_66_4538.exe
File created	C:\Windows\system32\drivers\kisnetm64.sys	KINSTALLERS_66_4538.exe
File created	C:\Windows\system32\drivers\kusbquery.sys	KINSTALLERS_66_4538.exe
File created	C:\Windows\system32\drivers\kusbquery64.sys	KINSTALLERS_66_4538.exe
File created	C:\Windows\system32\drivers\bc.sys	KINSTALLERS_66_4538.exe
File created	C:\Windows\system32\drivers\kdhacker.sys	KINSTALLERS_66_4538.exe
File created	C:\Windows\system32\drivers\kdhacker64.sys	KINSTALLERS_66_4538.exe
File created	C:\Windows\system32\drivers\kisnetm.sys	KINSTALLERS_66_4538.exe
File created	C:\Windows\system32\drivers\ksapi.sys	KINSTALLERS_66_4538.exe
File opened for modification	C:\Windows\SysWOW64\drivers\KAVBase.sys	KINSTALLERS_66_4538.exe
File opened for modification	C:\Windows\system32\drivers\bc.sys	KINSTALLERS_66_4538.exe
File created	C:\Windows\system32\drivers\kavbootc.sys	KINSTALLERS_66_4538.exe
File created	C:\Windows\system32\drivers\kisknl.sys	KINSTALLERS_66_4538.exe
File created	C:\Windows\system32\drivers\kavbootc64.sys	KINSTALLERS_66_4538.exe
File created	C:\Windows\system32\drivers\kisnetmxp.sys	KINSTALLERS_66_4538.exe
File created	C:\Windows\system32\drivers\ksapi64.sys	KINSTALLERS_66_4538.exe

Executes dropped EXE 5 IoCs

Processes:

手机验证码接收系统.exeKINSTALLERS_66_4538.exe官方.exe淘宝客PID劫持器.exeKINSTALLERS_66_4538.exe

pid process

1576 手机验证码接收系统.exe
924 KINSTALLERS_66_4538.exe
1120 官方.exe
1644 淘宝客PID劫持器.exe
1860 KINSTALLERS_66_4538.exe

pid	process
1576	手机验证码接收系统.exe
924	KINSTALLERS_66_4538.exe
1120	官方.exe
1644	淘宝客PID劫持器.exe
1860	KINSTALLERS_66_4538.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

KINSTALLERS_66_4538.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32\ThreadingModel = "Apartment"	KINSTALLERS_66_4538.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32	KINSTALLERS_66_4538.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32\ = "c:\\program files (x86)\\kingsoft\\kingsoft antivirus\\kavmenu64.dll"	KINSTALLERS_66_4538.exe

Sets file execution options in registry 2 TTPs 28 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

KINSTALLERS_66_4538.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kxescore.exe	KINSTALLERS_66_4538.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scomregsvrv8.exe	KINSTALLERS_66_4538.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kislive.exe	KINSTALLERS_66_4538.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ksignsp.exe	KINSTALLERS_66_4538.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KSIGNSP.EXE	KINSTALLERS_66_4538.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KXESCORE.EXE	KINSTALLERS_66_4538.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCOMREGSVRV8.EXE	KINSTALLERS_66_4538.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISADDIN.EXE	KINSTALLERS_66_4538.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kiscall.exe	KINSTALLERS_66_4538.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISLIVE.EXE	KINSTALLERS_66_4538.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\krecycle.exe	KINSTALLERS_66_4538.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uninst.exe	KINSTALLERS_66_4538.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavlog2.exe	KINSTALLERS_66_4538.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KDRVMGR.EXE	KINSTALLERS_66_4538.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kisaddin.exe	KINSTALLERS_66_4538.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISCALL.EXE	KINSTALLERS_66_4538.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kismain.exe	KINSTALLERS_66_4538.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KXETRAY.EXE	KINSTALLERS_66_4538.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISMAIN.EXE	KINSTALLERS_66_4538.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ksetupwiz.exe	KINSTALLERS_66_4538.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kxetray.exe	KINSTALLERS_66_4538.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kdrvmgr.exe	KINSTALLERS_66_4538.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRECYCLE.EXE	KINSTALLERS_66_4538.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KSETUPWIZ.EXE	KINSTALLERS_66_4538.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVLOG2.EXE	KINSTALLERS_66_4538.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kscan.exe	KINSTALLERS_66_4538.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KSCAN.EXE	KINSTALLERS_66_4538.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UNINST.EXE	KINSTALLERS_66_4538.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\官方.exe	upx
\Users\Admin\AppData\Local\Temp\官方.exe	upx
\Users\Admin\AppData\Local\Temp\官方.exe	upx
\Users\Admin\AppData\Local\Temp\官方.exe	upx
C:\Users\Admin\AppData\Local\Temp\官方.exe	upx
behavioral1/memory/1120-96-0x0000000000400000-0x0000000000410000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\kingsoftkonline\KINSTALLERS_66_4538.exe	upx
C:\Users\Admin\AppData\Local\Temp\kingsoftkonline\KINSTALLERS_66_4538.exe	upx
C:\Users\Admin\AppData\Local\Temp\kingsoftkonline\KINSTALLERS_66_4538.exe	upx
\Users\Admin\AppData\Local\Temp\kingsoftkonline\KINSTALLERS_66_4538.exe	upx
\Users\Admin\AppData\Local\Temp\kingsoftkonline\KINSTALLERS_66_4538.exe	upx
behavioral1/memory/1860-113-0x0000000000580000-0x00000000006F5000-memory.dmp	upx
behavioral1/memory/1860-114-0x0000000000400000-0x0000000000575000-memory.dmp	upx
behavioral1/memory/1120-116-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/1860-118-0x0000000000400000-0x0000000000575000-memory.dmp	upx

Loads dropped DLL 27 IoCs

Processes:

搜狗导航增值机.exe手机验证码接收系统.exeKINSTALLERS_66_4538.exeKINSTALLERS_66_4538.exe

pid	process
940	搜狗导航增值机.exe
940	搜狗导航增值机.exe
940	搜狗导航增值机.exe
940	搜狗导航增值机.exe
940	搜狗导航增值机.exe
940	搜狗导航增值机.exe
940	搜狗导航增值机.exe
1576	手机验证码接收系统.exe
1576	手机验证码接收系统.exe
1576	手机验证码接收系统.exe
1576	手机验证码接收系统.exe
1576	手机验证码接收系统.exe
1576	手机验证码接收系统.exe
1576	手机验证码接收系统.exe
1576	手机验证码接收系统.exe
1576	手机验证码接收系统.exe
924	KINSTALLERS_66_4538.exe
924	KINSTALLERS_66_4538.exe
924	KINSTALLERS_66_4538.exe
924	KINSTALLERS_66_4538.exe
1860	KINSTALLERS_66_4538.exe
1860	KINSTALLERS_66_4538.exe
1860	KINSTALLERS_66_4538.exe
1860	KINSTALLERS_66_4538.exe
1860	KINSTALLERS_66_4538.exe
1860	KINSTALLERS_66_4538.exe
1860	KINSTALLERS_66_4538.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

KINSTALLERS_66_4538.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	KINSTALLERS_66_4538.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kxesc = "\"c:\\program files (x86)\\kingsoft\\kingsoft antivirus\\kxetray.exe\" -autorun"	KINSTALLERS_66_4538.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

Processes:

KINSTALLERS_66_4538.exe

description	ioc	process
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kcomponent.dll	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\ksdectrl.dll	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kvipcore.dll	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\ressrc\chs\kws\icon\kwsdownicon.gif	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\ressrc\chs\kws\icon\kws_adult.gif	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\hotspot.xml	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\protect.dat	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\skin\theme\binglanbeiji.dubatheme	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kavbootc.sys	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\webui\icon\bkplugin.gif	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\se.dat	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kdownloader.exe	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\kavquara.dll	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxecore\kxelog.dll	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\ressrc\chs\extendimg\5.png	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\webui\icon\fdlocal.cfg	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\apdev.dat	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\kqsccfg.dat	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\data.fsg	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kdrvmgr.exe	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kdefendpop.dll	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\kusbscan.dll	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\ressrc\chs\kws\icon\kws_unknown.gif	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\ressrc\chs\web\kingsoft_weibo.htm	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\cloudpop\1.0.0\pop_cd_cleanrubbish2\skin.ksfskin	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kskinmgr.dll	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\ressrc\chs\kws\icon\commentbgunkownltb.gif	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\ksde\kmctrl.dll	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kusbcore.dll	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kavstart.ini	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\kae\karchive.dat	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\ksde\progrule.dat	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\ktrashmon.dll	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\ksbwdt.ini	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kvmpid2.kid	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kvipwiz.exe	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kismain.dll	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\ksextfix.dll	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kvip.dll	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\lblocker.dll	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\kccprotocol_cfg.ini	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\ressrc\chs\web\kingsoft_bbs.htm	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\ksde\deheurcfg.ini	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\ksdmalwarez.dat	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\operation\cas\kfmt.datx	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kstools.dll	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\netbuyprot.dll	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\ressrc\chs\kws\icon\commentbgadulttrs.gif	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\clear.xml	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kdh.dat	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\ksapi.sys	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\ressrc\chs\kws\icon\commentbgadultltb.gif	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\ressrc\chs\kws\icon\kws_safe_no.gif	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\defbro.dat	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\uni0nst.exe	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kminitray.dll	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\ksnetm\kmonstat.dll	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\ksde\ksdecs.dll	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\webui\icon\bkfilter.gif	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\system_add.dat	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\skin\theme\themelist.dat	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\ksapi64.sys	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\ressrc\chs\extendimg\2.jpg	KINSTALLERS_66_4538.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\ressrc\chs\kws\icon\commentbgsafetrs.gif	KINSTALLERS_66_4538.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 30 IoCs

Processes:

KINSTALLERS_66_4538.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\Shellex\ContextMenuHandlers\duba_64bit	KINSTALLERS_66_4538.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32	KINSTALLERS_66_4538.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32\ = "c:\\program files (x86)\\kingsoft\\kingsoft antivirus\\kavmenu64.dll"	KINSTALLERS_66_4538.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\duba_64bit\ = "{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}"	KINSTALLERS_66_4538.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\duba_32bit	KINSTALLERS_66_4538.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}\InprocServer32\ThreadingModel = "Apartment"	KINSTALLERS_66_4538.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	KINSTALLERS_66_4538.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers	KINSTALLERS_66_4538.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers\duba_64bit\ = "{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}"	KINSTALLERS_66_4538.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}	KINSTALLERS_66_4538.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}\ = "CKavMenuShell Class"	KINSTALLERS_66_4538.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32\ThreadingModel = "Apartment"	KINSTALLERS_66_4538.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers\duba_64bit	KINSTALLERS_66_4538.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	KINSTALLERS_66_4538.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers	KINSTALLERS_66_4538.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\duba_32bit\ = "{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}"	KINSTALLERS_66_4538.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers\duba_32bit\ = "{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}"	KINSTALLERS_66_4538.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\duba_32bit	KINSTALLERS_66_4538.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}	KINSTALLERS_66_4538.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\Shellex\ContextMenuHandlers\duba_64bit	KINSTALLERS_66_4538.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\Shellex\ContextMenuHandlers\duba_64bit	KINSTALLERS_66_4538.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}\InprocServer32	KINSTALLERS_66_4538.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers\duba_32bit	KINSTALLERS_66_4538.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\duba_64bit\ = "{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}"	KINSTALLERS_66_4538.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex	KINSTALLERS_66_4538.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}\InprocServer32\ = "c:\\program files (x86)\\kingsoft\\kingsoft antivirus\\kavmenu.dll"	KINSTALLERS_66_4538.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\duba_32bit\ = "{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}"	KINSTALLERS_66_4538.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\duba_32bit	KINSTALLERS_66_4538.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\duba_64bit\ = "{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}"	KINSTALLERS_66_4538.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\duba_32bit\ = "{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}"	KINSTALLERS_66_4538.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1984 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

KINSTALLERS_66_4538.exe

description pid process

Token: SeDebugPrivilege 1860 KINSTALLERS_66_4538.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

淘宝客PID劫持器.exe

pid process

1644 淘宝客PID劫持器.exe
1644 淘宝客PID劫持器.exe

pid	process
1984	PING.EXE

description	pid	process
Token: SeDebugPrivilege	1860	KINSTALLERS_66_4538.exe

pid	process
1644	淘宝客PID劫持器.exe
1644	淘宝客PID劫持器.exe

Suspicious use of WriteProcessMemory 63 IoCs

Processes:

搜狗导航增值机.exe手机验证码接收系统.exe官方.execmd.exeKINSTALLERS_66_4538.exe

description	pid	process	target process
PID 940 wrote to memory of 1576	940	搜狗导航增值机.exe	手机验证码接收系统.exe
PID 940 wrote to memory of 1576	940	搜狗导航增值机.exe	手机验证码接收系统.exe
PID 940 wrote to memory of 1576	940	搜狗导航增值机.exe	手机验证码接收系统.exe
PID 940 wrote to memory of 1576	940	搜狗导航增值机.exe	手机验证码接收系统.exe
PID 940 wrote to memory of 1576	940	搜狗导航增值机.exe	手机验证码接收系统.exe
PID 940 wrote to memory of 1576	940	搜狗导航增值机.exe	手机验证码接收系统.exe
PID 940 wrote to memory of 1576	940	搜狗导航增值机.exe	手机验证码接收系统.exe
PID 940 wrote to memory of 924	940	搜狗导航增值机.exe	KINSTALLERS_66_4538.exe
PID 940 wrote to memory of 924	940	搜狗导航增值机.exe	KINSTALLERS_66_4538.exe
PID 940 wrote to memory of 924	940	搜狗导航增值机.exe	KINSTALLERS_66_4538.exe
PID 940 wrote to memory of 924	940	搜狗导航增值机.exe	KINSTALLERS_66_4538.exe
PID 940 wrote to memory of 924	940	搜狗导航增值机.exe	KINSTALLERS_66_4538.exe
PID 940 wrote to memory of 924	940	搜狗导航增值机.exe	KINSTALLERS_66_4538.exe
PID 940 wrote to memory of 924	940	搜狗导航增值机.exe	KINSTALLERS_66_4538.exe
PID 1576 wrote to memory of 1120	1576	手机验证码接收系统.exe	官方.exe
PID 1576 wrote to memory of 1120	1576	手机验证码接收系统.exe	官方.exe
PID 1576 wrote to memory of 1120	1576	手机验证码接收系统.exe	官方.exe
PID 1576 wrote to memory of 1120	1576	手机验证码接收系统.exe	官方.exe
PID 1576 wrote to memory of 1120	1576	手机验证码接收系统.exe	官方.exe
PID 1576 wrote to memory of 1120	1576	手机验证码接收系统.exe	官方.exe
PID 1576 wrote to memory of 1120	1576	手机验证码接收系统.exe	官方.exe
PID 1576 wrote to memory of 1644	1576	手机验证码接收系统.exe	淘宝客PID劫持器.exe
PID 1576 wrote to memory of 1644	1576	手机验证码接收系统.exe	淘宝客PID劫持器.exe
PID 1576 wrote to memory of 1644	1576	手机验证码接收系统.exe	淘宝客PID劫持器.exe
PID 1576 wrote to memory of 1644	1576	手机验证码接收系统.exe	淘宝客PID劫持器.exe
PID 1576 wrote to memory of 1644	1576	手机验证码接收系统.exe	淘宝客PID劫持器.exe
PID 1576 wrote to memory of 1644	1576	手机验证码接收系统.exe	淘宝客PID劫持器.exe
PID 1576 wrote to memory of 1644	1576	手机验证码接收系统.exe	淘宝客PID劫持器.exe
PID 1120 wrote to memory of 1052	1120	官方.exe	cmd.exe
PID 1120 wrote to memory of 1052	1120	官方.exe	cmd.exe
PID 1120 wrote to memory of 1052	1120	官方.exe	cmd.exe
PID 1120 wrote to memory of 1052	1120	官方.exe	cmd.exe
PID 1120 wrote to memory of 1052	1120	官方.exe	cmd.exe
PID 1120 wrote to memory of 1052	1120	官方.exe	cmd.exe
PID 1120 wrote to memory of 1052	1120	官方.exe	cmd.exe
PID 1576 wrote to memory of 1544	1576	手机验证码接收系统.exe	WScript.exe
PID 1576 wrote to memory of 1544	1576	手机验证码接收系统.exe	WScript.exe
PID 1576 wrote to memory of 1544	1576	手机验证码接收系统.exe	WScript.exe
PID 1576 wrote to memory of 1544	1576	手机验证码接收系统.exe	WScript.exe
PID 1576 wrote to memory of 1544	1576	手机验证码接收系统.exe	WScript.exe
PID 1576 wrote to memory of 1544	1576	手机验证码接收系统.exe	WScript.exe
PID 1576 wrote to memory of 1544	1576	手机验证码接收系统.exe	WScript.exe
PID 1052 wrote to memory of 1984	1052	cmd.exe	PING.EXE
PID 1052 wrote to memory of 1984	1052	cmd.exe	PING.EXE
PID 1052 wrote to memory of 1984	1052	cmd.exe	PING.EXE
PID 1052 wrote to memory of 1984	1052	cmd.exe	PING.EXE
PID 1052 wrote to memory of 1984	1052	cmd.exe	PING.EXE
PID 1052 wrote to memory of 1984	1052	cmd.exe	PING.EXE
PID 1052 wrote to memory of 1984	1052	cmd.exe	PING.EXE
PID 1052 wrote to memory of 1564	1052	cmd.exe	WScript.exe
PID 1052 wrote to memory of 1564	1052	cmd.exe	WScript.exe
PID 1052 wrote to memory of 1564	1052	cmd.exe	WScript.exe
PID 1052 wrote to memory of 1564	1052	cmd.exe	WScript.exe
PID 1052 wrote to memory of 1564	1052	cmd.exe	WScript.exe
PID 1052 wrote to memory of 1564	1052	cmd.exe	WScript.exe
PID 1052 wrote to memory of 1564	1052	cmd.exe	WScript.exe
PID 924 wrote to memory of 1860	924	KINSTALLERS_66_4538.exe	KINSTALLERS_66_4538.exe
PID 924 wrote to memory of 1860	924	KINSTALLERS_66_4538.exe	KINSTALLERS_66_4538.exe
PID 924 wrote to memory of 1860	924	KINSTALLERS_66_4538.exe	KINSTALLERS_66_4538.exe
PID 924 wrote to memory of 1860	924	KINSTALLERS_66_4538.exe	KINSTALLERS_66_4538.exe
PID 924 wrote to memory of 1860	924	KINSTALLERS_66_4538.exe	KINSTALLERS_66_4538.exe
PID 924 wrote to memory of 1860	924	KINSTALLERS_66_4538.exe	KINSTALLERS_66_4538.exe
PID 924 wrote to memory of 1860	924	KINSTALLERS_66_4538.exe	KINSTALLERS_66_4538.exe

C:\Users\Admin\AppData\Local\Temp\搜狗导航增值机.exe
"C:\Users\Admin\AppData\Local\Temp\搜狗导航增值机.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:940

C:\Users\Admin\AppData\Local\Temp\手机验证码接收系统.exe
"C:\Users\Admin\AppData\Local\Temp\手机验证码接收系统.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1576

C:\Users\Admin\AppData\Local\Temp\官方.exe
"C:\Users\Admin\AppData\Local\Temp\官方.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\FD53.tmp\setup.bat" "
4⤵
- Suspicious use of WriteProcessMemory
PID:1052

C:\Windows\SysWOW64\PING.EXE
ping -n 3 127.0.0.1
5⤵
- Runs ping.exe
PID:1984

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\123.VBS"
5⤵
PID:1564

C:\Users\Admin\AppData\Local\Temp\淘宝客PID劫持器.exe
"C:\Users\Admin\AppData\Local\Temp\淘宝客PID劫持器.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1644

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\123.VBS"
3⤵
PID:1544

C:\Users\Admin\AppData\Local\Temp\KINSTALLERS_66_4538.exe
"C:\Users\Admin\AppData\Local\Temp\KINSTALLERS_66_4538.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:924

C:\Users\Admin\AppData\Local\Temp\kingsoftkonline\KINSTALLERS_66_4538.exe
"C:\Users\Admin\AppData\Local\Temp\kingsoftkonline\KINSTALLERS_66_4538.exe" /s
3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Registers COM server for autorun
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1860

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\123.VBS
Filesize
398B

MD5
b3515d5ceabbcf4ae352adf668e4aa26

SHA1
cef8001c51225008419dcf98553ce4c8e693bb48

SHA256
220776a333307c6f3ae27222bf5b916b3628647cbbe2b539c934423a6c6c4ecf

SHA512
59db9b37e46220a9437bbbec5d8f977a02ca2c1430d3b3a6262fbf5792ea7dea8575396b0dfa6ea889d902f3439049ebd3dd1bca6efb89a690b4d105572237d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\123.VBS
Filesize
398B

MD5
b3515d5ceabbcf4ae352adf668e4aa26

SHA1
cef8001c51225008419dcf98553ce4c8e693bb48

SHA256
220776a333307c6f3ae27222bf5b916b3628647cbbe2b539c934423a6c6c4ecf

SHA512
59db9b37e46220a9437bbbec5d8f977a02ca2c1430d3b3a6262fbf5792ea7dea8575396b0dfa6ea889d902f3439049ebd3dd1bca6efb89a690b4d105572237d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\FD53.tmp\setup.bat
Filesize
34B

MD5
e1b9eb7f7d775d0d49d8ace123a88fc7

SHA1
a97bd323f7ba1d85fa53360e85137fc16a4de204

SHA256
11d81cc1aeebb5ef06dcf2b90bfdbec35d689a4776838882410f2aca3b00b101

SHA512
50ab4c7295ece4f6712bc488fffea83fa24a296c6d6538a554a4bedc2a90f54f359e304f3bf3975a27157c41cb45132b839e1efcb1e930e7fbd2fe16d21b65b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\KINSTALLERS_66_4538.exe
Filesize
58KB

MD5
f729d886356835c780a1ec4486f60576

SHA1
40fafe8a61965919a4cc32a079ec5747fdddcd3e

SHA256
7ae1beac54fb6511a53be696006ed0fbe1e0bfb76dd9b68f135e97ccf0ccde2e

SHA512
fcacc65d9154e262fcc790945becc673d8eb98410231d521249257e9c3e4c2dfc01854e7c7a86e39e68fa7024859f888cdf3f2cbb820dc068998fc5b506996c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\KINSTALLERS_66_4538.exe
Filesize
58KB

MD5
f729d886356835c780a1ec4486f60576

SHA1
40fafe8a61965919a4cc32a079ec5747fdddcd3e

SHA256
7ae1beac54fb6511a53be696006ed0fbe1e0bfb76dd9b68f135e97ccf0ccde2e

SHA512
fcacc65d9154e262fcc790945becc673d8eb98410231d521249257e9c3e4c2dfc01854e7c7a86e39e68fa7024859f888cdf3f2cbb820dc068998fc5b506996c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\kingsoftkonline\KINSTALLERS_66_4538.exe
Filesize
30.1MB

MD5
cc8ff25a6404a2a99af9c515850ab0d6

SHA1
9b1b235cf30cf848c257cb3a0199ae6be3f968c5

SHA256
336493f13f3b205c1ec7898a0393cfe2765305dfedf1e90366cef185be1d9d03

SHA512
2db0f4dada8fd8294ce12b9c795593a8da5a69507114650f5c8c2ec070c00b849bbb89e13976b8f52e544877b424c191cd87321ca7e31700d8e5471f571b6f93

Download Submit
C:\Users\Admin\AppData\Local\Temp\kingsoftkonline\KINSTALLERS_66_4538.exe
Filesize
30.1MB

MD5
cc8ff25a6404a2a99af9c515850ab0d6

SHA1
9b1b235cf30cf848c257cb3a0199ae6be3f968c5

SHA256
336493f13f3b205c1ec7898a0393cfe2765305dfedf1e90366cef185be1d9d03

SHA512
2db0f4dada8fd8294ce12b9c795593a8da5a69507114650f5c8c2ec070c00b849bbb89e13976b8f52e544877b424c191cd87321ca7e31700d8e5471f571b6f93

Download Submit
C:\Users\Admin\AppData\Local\Temp\官方.exe
Filesize
21KB

MD5
5a76883d66f3d880ca3e6a69ad693013

SHA1
d8f8177aedeb1e9779b88ff464251e2fb2e0b3f6

SHA256
68d447639d7a0588c7ac29506ae66a41006c3922ef32adc6bb2da43556a6b3e5

SHA512
dd93083e312768a3efa630734f53eb3180552a882095cda8ab4115a91c836e4b3e5a24412de4f53a9ab064f8dc64002079a8ae6556df1980881c68475d3bde02

Download Submit
C:\Users\Admin\AppData\Local\Temp\手机验证码接收系统.exe
Filesize
456KB

MD5
653564b090dac7f2896856c54dc17312

SHA1
7d1c31329d59ceb766e45c340b21985ea8d149b5

SHA256
d04412c4cbcc986ccfd847bda6de2dedf97c1ac5da8a9318048e14a4f62f45dc

SHA512
c7c17866a9d0f10aea21a66efade0e9c419eaf0ccccfb3826e736101691ed07c06e18b186db06cdaf2402f15ab9b428c9e18cd4ab0157a82d246858bb1f24f0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\手机验证码接收系统.exe
Filesize
456KB

MD5
653564b090dac7f2896856c54dc17312

SHA1
7d1c31329d59ceb766e45c340b21985ea8d149b5

SHA256
d04412c4cbcc986ccfd847bda6de2dedf97c1ac5da8a9318048e14a4f62f45dc

SHA512
c7c17866a9d0f10aea21a66efade0e9c419eaf0ccccfb3826e736101691ed07c06e18b186db06cdaf2402f15ab9b428c9e18cd4ab0157a82d246858bb1f24f0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\淘宝客PID劫持器.exe
Filesize
772KB

MD5
13e8c8ed061b041e160c496fe8eb4ff2

SHA1
cf65914ea3c6743b4d1c916c402c0f95f21498f4

SHA256
52a5fb7bbc26d536cad0ff7a9474aa27f9f4ad039f9489fb6fe8ce44a315fc25

SHA512
c590dbfd6c6b13c1057d6fa8f981a233d2cdb1e775f037ba23127234d8d677dacc8582adf8d50051b2b2aba214e31cb6c430797372b49ff59605253e5068c1de

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kavmenu.dll
Filesize
42KB

MD5
8d9f203a21f2763e51ed097286bf34fa

SHA1
3f19728df55fd05a72b12941b6f530cfaafc1a30

SHA256
05e2a3fa3506b8e6d66adbb9841672de18e7ea93fda41c6b7bc2cff78b5ebb36

SHA512
4fecd387165d3b83eed70778943c7e9eca27a9fe04b969b2d8e8946b1e20148d523d1f1ad33ce9d0eead21f3b395906d493ad7a76c87e87e41c070a63916f963

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\security\kavbootc.sys
Filesize
27KB

MD5
725d897352ec1bb8ea219282b343e5af

SHA1
5f4e986d09cc211f916be0b89d0199077010c178

SHA256
fbb90272c9a4cf87eb0495edcf38c922e9a71c12ea2b197d8011c309ff12477e

SHA512
2b2962a869605dfeb2f20252f4dceb31a5e09c377440174079d7f50639eb4bed5a68f26420c73d28494d41ceb06581a9952543aeff13b2822040e55c6ad2cb7f

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\security\kavbootc.sys
Filesize
27KB

MD5
725d897352ec1bb8ea219282b343e5af

SHA1
5f4e986d09cc211f916be0b89d0199077010c178

SHA256
fbb90272c9a4cf87eb0495edcf38c922e9a71c12ea2b197d8011c309ff12477e

SHA512
2b2962a869605dfeb2f20252f4dceb31a5e09c377440174079d7f50639eb4bed5a68f26420c73d28494d41ceb06581a9952543aeff13b2822040e55c6ad2cb7f

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\security\ksde\kisknl.sys
Filesize
207KB

MD5
5386705763928234bbf1e9ec8fb2f185

SHA1
9654babee332cd26c5d4d63134f638217a2378af

SHA256
fb065a5a3a9d003d6493a5a7fc596088fbb5fdff7da479d4d62b7aeb77b62c6a

SHA512
38bf550aebffd3c909f85ca7b0d08239e4f418e1811f71a564ade22712b36c44162164e16b28c0178f40b5fbc79fc34cafcd292a7d355de0533fd6b80e231753

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\security\ksde\kisknl.sys
Filesize
207KB

MD5
5386705763928234bbf1e9ec8fb2f185

SHA1
9654babee332cd26c5d4d63134f638217a2378af

SHA256
fb065a5a3a9d003d6493a5a7fc596088fbb5fdff7da479d4d62b7aeb77b62c6a

SHA512
38bf550aebffd3c909f85ca7b0d08239e4f418e1811f71a564ade22712b36c44162164e16b28c0178f40b5fbc79fc34cafcd292a7d355de0533fd6b80e231753

Download Submit
\Users\Admin\AppData\Local\Temp\KINSTALLERS_66_4538.exe
Filesize
58KB

MD5
f729d886356835c780a1ec4486f60576

SHA1
40fafe8a61965919a4cc32a079ec5747fdddcd3e

SHA256
7ae1beac54fb6511a53be696006ed0fbe1e0bfb76dd9b68f135e97ccf0ccde2e

SHA512
fcacc65d9154e262fcc790945becc673d8eb98410231d521249257e9c3e4c2dfc01854e7c7a86e39e68fa7024859f888cdf3f2cbb820dc068998fc5b506996c8

Download Submit
\Users\Admin\AppData\Local\Temp\KINSTALLERS_66_4538.exe
Filesize
58KB

MD5
f729d886356835c780a1ec4486f60576

SHA1
40fafe8a61965919a4cc32a079ec5747fdddcd3e

SHA256
7ae1beac54fb6511a53be696006ed0fbe1e0bfb76dd9b68f135e97ccf0ccde2e

SHA512
fcacc65d9154e262fcc790945becc673d8eb98410231d521249257e9c3e4c2dfc01854e7c7a86e39e68fa7024859f888cdf3f2cbb820dc068998fc5b506996c8

Download Submit
\Users\Admin\AppData\Local\Temp\KINSTALLERS_66_4538.exe
Filesize
58KB

MD5
f729d886356835c780a1ec4486f60576

SHA1
40fafe8a61965919a4cc32a079ec5747fdddcd3e

SHA256
7ae1beac54fb6511a53be696006ed0fbe1e0bfb76dd9b68f135e97ccf0ccde2e

SHA512
fcacc65d9154e262fcc790945becc673d8eb98410231d521249257e9c3e4c2dfc01854e7c7a86e39e68fa7024859f888cdf3f2cbb820dc068998fc5b506996c8

Download Submit
\Users\Admin\AppData\Local\Temp\KINSTALLERS_66_4538.exe
Filesize
58KB

MD5
f729d886356835c780a1ec4486f60576

SHA1
40fafe8a61965919a4cc32a079ec5747fdddcd3e

SHA256
7ae1beac54fb6511a53be696006ed0fbe1e0bfb76dd9b68f135e97ccf0ccde2e

SHA512
fcacc65d9154e262fcc790945becc673d8eb98410231d521249257e9c3e4c2dfc01854e7c7a86e39e68fa7024859f888cdf3f2cbb820dc068998fc5b506996c8

Download Submit
\Users\Admin\AppData\Local\Temp\KINSTALLERS_66_4538.exe
Filesize
58KB

MD5
f729d886356835c780a1ec4486f60576

SHA1
40fafe8a61965919a4cc32a079ec5747fdddcd3e

SHA256
7ae1beac54fb6511a53be696006ed0fbe1e0bfb76dd9b68f135e97ccf0ccde2e

SHA512
fcacc65d9154e262fcc790945becc673d8eb98410231d521249257e9c3e4c2dfc01854e7c7a86e39e68fa7024859f888cdf3f2cbb820dc068998fc5b506996c8

Download Submit
\Users\Admin\AppData\Local\Temp\KINSTALLERS_66_4538.exe
Filesize
58KB

MD5
f729d886356835c780a1ec4486f60576

SHA1
40fafe8a61965919a4cc32a079ec5747fdddcd3e

SHA256
7ae1beac54fb6511a53be696006ed0fbe1e0bfb76dd9b68f135e97ccf0ccde2e

SHA512
fcacc65d9154e262fcc790945becc673d8eb98410231d521249257e9c3e4c2dfc01854e7c7a86e39e68fa7024859f888cdf3f2cbb820dc068998fc5b506996c8

Download Submit
\Users\Admin\AppData\Local\Temp\KINSTALLERS_66_4538.exe
Filesize
58KB

MD5
f729d886356835c780a1ec4486f60576

SHA1
40fafe8a61965919a4cc32a079ec5747fdddcd3e

SHA256
7ae1beac54fb6511a53be696006ed0fbe1e0bfb76dd9b68f135e97ccf0ccde2e

SHA512
fcacc65d9154e262fcc790945becc673d8eb98410231d521249257e9c3e4c2dfc01854e7c7a86e39e68fa7024859f888cdf3f2cbb820dc068998fc5b506996c8

Download Submit
\Users\Admin\AppData\Local\Temp\kingsoftkonline\KINSTALLERS_66_4538.exe
Filesize
30.1MB

MD5
cc8ff25a6404a2a99af9c515850ab0d6

SHA1
9b1b235cf30cf848c257cb3a0199ae6be3f968c5

SHA256
336493f13f3b205c1ec7898a0393cfe2765305dfedf1e90366cef185be1d9d03

SHA512
2db0f4dada8fd8294ce12b9c795593a8da5a69507114650f5c8c2ec070c00b849bbb89e13976b8f52e544877b424c191cd87321ca7e31700d8e5471f571b6f93

Download Submit
\Users\Admin\AppData\Local\Temp\kingsoftkonline\KINSTALLERS_66_4538.exe
Filesize
30.1MB

MD5
cc8ff25a6404a2a99af9c515850ab0d6

SHA1
9b1b235cf30cf848c257cb3a0199ae6be3f968c5

SHA256
336493f13f3b205c1ec7898a0393cfe2765305dfedf1e90366cef185be1d9d03

SHA512
2db0f4dada8fd8294ce12b9c795593a8da5a69507114650f5c8c2ec070c00b849bbb89e13976b8f52e544877b424c191cd87321ca7e31700d8e5471f571b6f93

Download Submit
\Users\Admin\AppData\Local\Temp\kingsoftkonline\KINSTALLERS_66_4538.exe
Filesize
30.1MB

MD5
cc8ff25a6404a2a99af9c515850ab0d6

SHA1
9b1b235cf30cf848c257cb3a0199ae6be3f968c5

SHA256
336493f13f3b205c1ec7898a0393cfe2765305dfedf1e90366cef185be1d9d03

SHA512
2db0f4dada8fd8294ce12b9c795593a8da5a69507114650f5c8c2ec070c00b849bbb89e13976b8f52e544877b424c191cd87321ca7e31700d8e5471f571b6f93

Download Submit
\Users\Admin\AppData\Local\Temp\官方.exe
Filesize
21KB

MD5
5a76883d66f3d880ca3e6a69ad693013

SHA1
d8f8177aedeb1e9779b88ff464251e2fb2e0b3f6

SHA256
68d447639d7a0588c7ac29506ae66a41006c3922ef32adc6bb2da43556a6b3e5

SHA512
dd93083e312768a3efa630734f53eb3180552a882095cda8ab4115a91c836e4b3e5a24412de4f53a9ab064f8dc64002079a8ae6556df1980881c68475d3bde02

Download Submit
\Users\Admin\AppData\Local\Temp\官方.exe
Filesize
21KB

MD5
5a76883d66f3d880ca3e6a69ad693013

SHA1
d8f8177aedeb1e9779b88ff464251e2fb2e0b3f6

SHA256
68d447639d7a0588c7ac29506ae66a41006c3922ef32adc6bb2da43556a6b3e5

SHA512
dd93083e312768a3efa630734f53eb3180552a882095cda8ab4115a91c836e4b3e5a24412de4f53a9ab064f8dc64002079a8ae6556df1980881c68475d3bde02

Download Submit
\Users\Admin\AppData\Local\Temp\官方.exe
Filesize
21KB

MD5
5a76883d66f3d880ca3e6a69ad693013

SHA1
d8f8177aedeb1e9779b88ff464251e2fb2e0b3f6

SHA256
68d447639d7a0588c7ac29506ae66a41006c3922ef32adc6bb2da43556a6b3e5

SHA512
dd93083e312768a3efa630734f53eb3180552a882095cda8ab4115a91c836e4b3e5a24412de4f53a9ab064f8dc64002079a8ae6556df1980881c68475d3bde02

Download Submit
\Users\Admin\AppData\Local\Temp\官方.exe
Filesize
21KB

MD5
5a76883d66f3d880ca3e6a69ad693013

SHA1
d8f8177aedeb1e9779b88ff464251e2fb2e0b3f6

SHA256
68d447639d7a0588c7ac29506ae66a41006c3922ef32adc6bb2da43556a6b3e5

SHA512
dd93083e312768a3efa630734f53eb3180552a882095cda8ab4115a91c836e4b3e5a24412de4f53a9ab064f8dc64002079a8ae6556df1980881c68475d3bde02

Download Submit
\Users\Admin\AppData\Local\Temp\手机验证码接收系统.exe
Filesize
456KB

MD5
653564b090dac7f2896856c54dc17312

SHA1
7d1c31329d59ceb766e45c340b21985ea8d149b5

SHA256
d04412c4cbcc986ccfd847bda6de2dedf97c1ac5da8a9318048e14a4f62f45dc

SHA512
c7c17866a9d0f10aea21a66efade0e9c419eaf0ccccfb3826e736101691ed07c06e18b186db06cdaf2402f15ab9b428c9e18cd4ab0157a82d246858bb1f24f0a

Download Submit
\Users\Admin\AppData\Local\Temp\手机验证码接收系统.exe
Filesize
456KB

MD5
653564b090dac7f2896856c54dc17312

SHA1
7d1c31329d59ceb766e45c340b21985ea8d149b5

SHA256
d04412c4cbcc986ccfd847bda6de2dedf97c1ac5da8a9318048e14a4f62f45dc

SHA512
c7c17866a9d0f10aea21a66efade0e9c419eaf0ccccfb3826e736101691ed07c06e18b186db06cdaf2402f15ab9b428c9e18cd4ab0157a82d246858bb1f24f0a

Download Submit
\Users\Admin\AppData\Local\Temp\手机验证码接收系统.exe
Filesize
456KB

MD5
653564b090dac7f2896856c54dc17312

SHA1
7d1c31329d59ceb766e45c340b21985ea8d149b5

SHA256
d04412c4cbcc986ccfd847bda6de2dedf97c1ac5da8a9318048e14a4f62f45dc

SHA512
c7c17866a9d0f10aea21a66efade0e9c419eaf0ccccfb3826e736101691ed07c06e18b186db06cdaf2402f15ab9b428c9e18cd4ab0157a82d246858bb1f24f0a

Download Submit
\Users\Admin\AppData\Local\Temp\淘宝客PID劫持器.exe
Filesize
772KB

MD5
13e8c8ed061b041e160c496fe8eb4ff2

SHA1
cf65914ea3c6743b4d1c916c402c0f95f21498f4

SHA256
52a5fb7bbc26d536cad0ff7a9474aa27f9f4ad039f9489fb6fe8ce44a315fc25

SHA512
c590dbfd6c6b13c1057d6fa8f981a233d2cdb1e775f037ba23127234d8d677dacc8582adf8d50051b2b2aba214e31cb6c430797372b49ff59605253e5068c1de

Download Submit
\Users\Admin\AppData\Local\Temp\淘宝客PID劫持器.exe
Filesize
772KB

MD5
13e8c8ed061b041e160c496fe8eb4ff2

SHA1
cf65914ea3c6743b4d1c916c402c0f95f21498f4

SHA256
52a5fb7bbc26d536cad0ff7a9474aa27f9f4ad039f9489fb6fe8ce44a315fc25

SHA512
c590dbfd6c6b13c1057d6fa8f981a233d2cdb1e775f037ba23127234d8d677dacc8582adf8d50051b2b2aba214e31cb6c430797372b49ff59605253e5068c1de

Download Submit
\Users\Admin\AppData\Local\Temp\淘宝客PID劫持器.exe
Filesize
772KB

MD5
13e8c8ed061b041e160c496fe8eb4ff2

SHA1
cf65914ea3c6743b4d1c916c402c0f95f21498f4

SHA256
52a5fb7bbc26d536cad0ff7a9474aa27f9f4ad039f9489fb6fe8ce44a315fc25

SHA512
c590dbfd6c6b13c1057d6fa8f981a233d2cdb1e775f037ba23127234d8d677dacc8582adf8d50051b2b2aba214e31cb6c430797372b49ff59605253e5068c1de

Download Submit
\Users\Admin\AppData\Local\Temp\淘宝客PID劫持器.exe
Filesize
772KB

MD5
13e8c8ed061b041e160c496fe8eb4ff2

SHA1
cf65914ea3c6743b4d1c916c402c0f95f21498f4

SHA256
52a5fb7bbc26d536cad0ff7a9474aa27f9f4ad039f9489fb6fe8ce44a315fc25

SHA512
c590dbfd6c6b13c1057d6fa8f981a233d2cdb1e775f037ba23127234d8d677dacc8582adf8d50051b2b2aba214e31cb6c430797372b49ff59605253e5068c1de

Download Submit
\Users\Admin\AppData\Local\Temp\淘宝客PID劫持器.exe
Filesize
772KB

MD5
13e8c8ed061b041e160c496fe8eb4ff2

SHA1
cf65914ea3c6743b4d1c916c402c0f95f21498f4

SHA256
52a5fb7bbc26d536cad0ff7a9474aa27f9f4ad039f9489fb6fe8ce44a315fc25

SHA512
c590dbfd6c6b13c1057d6fa8f981a233d2cdb1e775f037ba23127234d8d677dacc8582adf8d50051b2b2aba214e31cb6c430797372b49ff59605253e5068c1de

Download Submit
memory/924-66-0x0000000000000000-mapping.dmp

Download
memory/924-106-0x0000000002910000-0x0000000002A85000-memory.dmp

Filesize
1.5MB

Download
memory/940-54-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download
memory/1052-85-0x0000000000000000-mapping.dmp

Download
memory/1120-72-0x0000000000000000-mapping.dmp

Download
memory/1120-96-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1120-116-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1544-91-0x0000000000000000-mapping.dmp

Download
memory/1564-103-0x0000000000000000-mapping.dmp

Download
memory/1576-97-0x00000000030E0000-0x00000000031B1000-memory.dmp

Filesize
836KB

Download
memory/1576-95-0x0000000000610000-0x0000000000620000-memory.dmp

Filesize
64KB

Download
memory/1576-94-0x0000000000600000-0x0000000000610000-memory.dmp

Filesize
64KB

Download
memory/1576-93-0x0000000000600000-0x0000000000610000-memory.dmp

Filesize
64KB

Download
memory/1576-58-0x0000000000000000-mapping.dmp

Download
memory/1644-98-0x0000000000400000-0x00000000004D1000-memory.dmp

Filesize
836KB

Download
memory/1644-82-0x0000000000000000-mapping.dmp

Download
memory/1644-119-0x0000000000400000-0x00000000004D1000-memory.dmp

Filesize
836KB

Download
memory/1860-107-0x0000000000000000-mapping.dmp

Download
memory/1860-118-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download
memory/1860-117-0x0000000000580000-0x00000000006F5000-memory.dmp

Filesize
1.5MB

Download
memory/1860-115-0x0000000000580000-0x00000000006F5000-memory.dmp

Filesize
1.5MB

Download
memory/1860-114-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download
memory/1860-113-0x0000000000580000-0x00000000006F5000-memory.dmp

Filesize
1.5MB

Download
memory/1860-125-0x0000000000320000-0x000000000032E000-memory.dmp

Filesize
56KB

Download
memory/1860-126-0x0000000000320000-0x000000000032E000-memory.dmp

Filesize
56KB

Download
memory/1860-127-0x0000000004D40000-0x0000000004DBC000-memory.dmp

Filesize
496KB

Download
memory/1860-128-0x0000000004D40000-0x0000000004DBC000-memory.dmp

Filesize
496KB

Download
memory/1984-101-0x0000000000000000-mapping.dmp

Download