f4c5c0bd54c2f59b13053c3033c9bf8b2ce3844a0807c7d002b2ea818c8c4ac6

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 02:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f4c5c0bd54c2f59b13053c3033c9bf8b2ce3844a0807c7d002b2ea818c8c4ac6.exe
Size

171KB
MD5

5aec2a1b0e1b9343fc6bc12805b2caee
SHA1

38dafa221d0343374b89a76279693db45b126e9e
SHA256

f4c5c0bd54c2f59b13053c3033c9bf8b2ce3844a0807c7d002b2ea818c8c4ac6
SHA512

5b7b28312034fb282fdcb671998636e74df7138dd221a0ec12b3cd3f507fea896b60efeef4763bfb0a2ddfa591561e35ea5247d49b217cf4b2376bdaf8664103
SSDEEP

3072:Z4eYZ4+1JXJJXV+ut1sdZOZF0KWzsCi3ZhkP+YT6erSvy4rUhwRnw0auv:C5O8x+kS7kFpWzA3MWYT+vy4hw0a2

Score

8^/10

bootkit discovery persistence spyware stealer upx

Malware Config

Signatures

Downloads MZ/PE file

Drops file in Drivers directory 20 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\ksskrpr.sys	duba_1_235.exe
File opened for modification	C:\Windows\system32\drivers\sysmon.sys	install1078565.exe
File created	C:\Windows\system32\drivers\rsutils.sys	install1078565.exe
File created	C:\Windows\system32\drivers\rsndisp.sys	install1078565.exe
File opened for modification	C:\Windows\system32\drivers\bc.sys	duba_1_235.exe
File created	C:\Windows\system32\drivers\kisknl64.sys	duba_1_235.exe
File created	C:\Windows\system32\drivers\ksapi64.sys	duba_1_235.exe
File created	C:\Windows\system32\drivers\sysmon.sys	install1078565.exe
File opened for modification	C:\Windows\system32\drivers\rsndisp.sys	install1078565.exe
File created	C:\Windows\system32\drivers\kisnetmxp.sys	duba_1_235.exe
File opened for modification	C:\Windows\system32\drivers\kisknl.sys	kxescore.exe
File created	C:\Windows\system32\drivers\kisknl.sys	kxescore.exe
File opened for modification	C:\Windows\SysWOW64\drivers\KAVBase.sys	duba_1_235.exe
File opened for modification	C:\Windows\SysWOW64\drivers\kisknl.sys	kxescore.exe
File opened for modification	C:\Windows\system32\drivers\rsutils.sys	install1078565.exe
File created	C:\Windows\system32\drivers\bc.sys	duba_1_235.exe
File created	C:\Windows\system32\drivers\kisknl.sys	duba_1_235.exe
File created	C:\Windows\system32\drivers\kisnetm.sys	duba_1_235.exe
File created	C:\Windows\system32\drivers\kisnetm64.sys	duba_1_235.exe
File created	C:\Windows\system32\drivers\ksapi.sys	duba_1_235.exe

Executes dropped EXE 47 IoCs

pid	Process
1392	KeLe2014Beta3.6.2Promote0326_20090195130.exe
3656	zzaz_01.exe
3508	GGExit.exe
5020	install1078565.exe
4684	ServiceClient.exe
2156	ServiceClient.exe
3420	ResideClient.exe
2836	RsMgrSvc.exe
4544	Kele55.exe
4608	Update.exe
2548	popwndexe.exe
3968	Update.exe
3416	LTLogger.exe
5212	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
5556	duba_1_235.exe
5948	ravmond.exe
5980	ravmond.exe
4784	kavlog2.exe
5224	kxetray.exe
5256	kxescore.exe
2240	kislive.exe
3500	kxescore.exe
1412	syspin.exe
5584	FileAssociationsTool.exe
5800	FileAssociationsTool.exe
5512	FileAssociationsTool.exe
3496	FileAssociationsTool.exe
6092	SHImageViewer.exe
5624	kwsprotect64.exe
2616	FileAssociationsTool.exe
6068	FileAssociationsTool.exe
5404	FileAssociationsTool.exe
3452	FileAssociationsTool.exe
2368	SHPlayer.exe
6316	SHCefEngine.exe
2888	Process not Found
6580	SHCefEngine.exe
6600	CrashSubmit.exe
6616	SHCefEngine.exe
6160	SHCefEngine.exe
5560	SHCefEngine.exe
4272	SHCefEngine.exe
6356	CrashSubmit.exe
7104	msedge.exe
3356	CrashSubmit.exe
6604	SHCefEngine.exe
6824	SHCefEngine.exe

Registers COM server for autorun 1 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{A9B9EEE8-9B80-40AA-B05B-BD3B2F6273C6}\InprocServer32	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{A9B9EEE8-9B80-40AA-B05B-BD3B2F6273C6}\InprocServer32\ = "shdocvw.dll"	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{A9B9EEE8-9B80-40AA-B05B-BD3B2F6273C6}\InprocServer32\ThreadingModel = "Apartment"	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32	duba_1_235.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32\ = "c:\\program files (x86)\\kingsoft\\kingsoft antivirus\\kavmenu64.dll"	duba_1_235.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32\ThreadingModel = "Apartment"	duba_1_235.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SHServicePlatform\Parameters\ServiceDll = "C:\\Users\\Admin\\AppData\\Roaming\\SHApp\\7.0.18.0\\shsp.dll"	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe

Sets file execution options in registry 2 TTPs 28 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KISCALL.EXE	duba_1_235.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\krecycle.exe	duba_1_235.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kxescore.exe	duba_1_235.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scomregsvrv8.exe	duba_1_235.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kiscall.exe	duba_1_235.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ksignsp.exe	duba_1_235.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kisaddin.exe	duba_1_235.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kismain.exe	duba_1_235.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KXESCORE.EXE	duba_1_235.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SCOMREGSVRV8.EXE	duba_1_235.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavlog2.exe	duba_1_235.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KISADDIN.EXE	duba_1_235.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KISLIVE.EXE	duba_1_235.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KRECYCLE.EXE	duba_1_235.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kxetray.exe	duba_1_235.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KXETRAY.EXE	duba_1_235.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kdrvmgr.exe	duba_1_235.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kscan.exe	duba_1_235.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KAVLOG2.EXE	duba_1_235.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KDRVMGR.EXE	duba_1_235.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KSCAN.EXE	duba_1_235.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ksetupwiz.exe	duba_1_235.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KSETUPWIZ.EXE	duba_1_235.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KSIGNSP.EXE	duba_1_235.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kislive.exe	duba_1_235.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\UNINST.EXE	duba_1_235.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KISMAIN.EXE	duba_1_235.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uninst.exe	duba_1_235.exe

Sets service image path in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\kisknl\ImagePath = "\\??\\C:\\Windows\\system32\\drivers\\kisknl.sys"	kxescore.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\kisknl\ImagePath = "\\??\\C:\\Windows\\system32\\drivers\\kisknl.sys"	kxescore.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0001000000022e75-175.dat	upx
behavioral2/files/0x0001000000022e75-176.dat	upx
behavioral2/memory/5020-177-0x0000000000400000-0x00000000005EC000-memory.dmp	upx
behavioral2/memory/5020-287-0x0000000000400000-0x00000000005EC000-memory.dmp	upx
behavioral2/memory/5556-337-0x0000000000400000-0x0000000000521000-memory.dmp	upx
behavioral2/memory/5556-351-0x0000000000400000-0x0000000000521000-memory.dmp	upx
behavioral2/memory/5020-482-0x0000000000400000-0x00000000005EC000-memory.dmp	upx
behavioral2/memory/5556-499-0x0000000000400000-0x0000000000521000-memory.dmp	upx

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	SHCefEngine.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	SHPlayer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	SHCefEngine.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	zzaz_01.exe

Loads dropped DLL 64 IoCs

pid	Process
3404	f4c5c0bd54c2f59b13053c3033c9bf8b2ce3844a0807c7d002b2ea818c8c4ac6.exe
3404	f4c5c0bd54c2f59b13053c3033c9bf8b2ce3844a0807c7d002b2ea818c8c4ac6.exe
3404	f4c5c0bd54c2f59b13053c3033c9bf8b2ce3844a0807c7d002b2ea818c8c4ac6.exe
3404	f4c5c0bd54c2f59b13053c3033c9bf8b2ce3844a0807c7d002b2ea818c8c4ac6.exe
3404	f4c5c0bd54c2f59b13053c3033c9bf8b2ce3844a0807c7d002b2ea818c8c4ac6.exe
3404	f4c5c0bd54c2f59b13053c3033c9bf8b2ce3844a0807c7d002b2ea818c8c4ac6.exe
3404	f4c5c0bd54c2f59b13053c3033c9bf8b2ce3844a0807c7d002b2ea818c8c4ac6.exe
3404	f4c5c0bd54c2f59b13053c3033c9bf8b2ce3844a0807c7d002b2ea818c8c4ac6.exe
3404	f4c5c0bd54c2f59b13053c3033c9bf8b2ce3844a0807c7d002b2ea818c8c4ac6.exe
3404	f4c5c0bd54c2f59b13053c3033c9bf8b2ce3844a0807c7d002b2ea818c8c4ac6.exe
3404	f4c5c0bd54c2f59b13053c3033c9bf8b2ce3844a0807c7d002b2ea818c8c4ac6.exe
3404	f4c5c0bd54c2f59b13053c3033c9bf8b2ce3844a0807c7d002b2ea818c8c4ac6.exe
3404	f4c5c0bd54c2f59b13053c3033c9bf8b2ce3844a0807c7d002b2ea818c8c4ac6.exe
1392	KeLe2014Beta3.6.2Promote0326_20090195130.exe
3656	zzaz_01.exe
3656	zzaz_01.exe
3656	zzaz_01.exe
3656	zzaz_01.exe
3656	zzaz_01.exe
3656	zzaz_01.exe
3656	zzaz_01.exe
3404	f4c5c0bd54c2f59b13053c3033c9bf8b2ce3844a0807c7d002b2ea818c8c4ac6.exe
3404	f4c5c0bd54c2f59b13053c3033c9bf8b2ce3844a0807c7d002b2ea818c8c4ac6.exe
3404	f4c5c0bd54c2f59b13053c3033c9bf8b2ce3844a0807c7d002b2ea818c8c4ac6.exe
3404	f4c5c0bd54c2f59b13053c3033c9bf8b2ce3844a0807c7d002b2ea818c8c4ac6.exe
1392	KeLe2014Beta3.6.2Promote0326_20090195130.exe
1392	KeLe2014Beta3.6.2Promote0326_20090195130.exe
1392	KeLe2014Beta3.6.2Promote0326_20090195130.exe
1392	KeLe2014Beta3.6.2Promote0326_20090195130.exe
1392	KeLe2014Beta3.6.2Promote0326_20090195130.exe
1392	KeLe2014Beta3.6.2Promote0326_20090195130.exe
5020	install1078565.exe
5020	install1078565.exe
5020	install1078565.exe
5020	install1078565.exe
5020	install1078565.exe
5020	install1078565.exe
5020	install1078565.exe
5020	install1078565.exe
5020	install1078565.exe
5020	install1078565.exe
5020	install1078565.exe
5020	install1078565.exe
4684	ServiceClient.exe
4684	ServiceClient.exe
1392	KeLe2014Beta3.6.2Promote0326_20090195130.exe
1392	KeLe2014Beta3.6.2Promote0326_20090195130.exe
4684	ServiceClient.exe
1392	KeLe2014Beta3.6.2Promote0326_20090195130.exe
1392	KeLe2014Beta3.6.2Promote0326_20090195130.exe
5020	install1078565.exe
5020	install1078565.exe
5020	install1078565.exe
5020	install1078565.exe
5020	install1078565.exe
5020	install1078565.exe
5020	install1078565.exe
5020	install1078565.exe
5020	install1078565.exe
5020	install1078565.exe
2156	ServiceClient.exe
2156	ServiceClient.exe
2156	ServiceClient.exe
2156	ServiceClient.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kxesc = "\"c:\\program files (x86)\\kingsoft\\kingsoft antivirus\\kxetray.exe\" -autorun"	duba_1_235.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SHPlayer = "\"C:\\Users\\Admin\\AppData\\Roaming\\????\\7.0.18.0\\SHPlayer.exe\" /auto"	FileAssociationsTool.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	install1078565.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RSDTRAY = "\"C:\\Program Files (x86)\\Rising\\RSD\\popwndexe.exe\""	install1078565.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	zzaz_01.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LeiTing = "\"C:\\Program Files (x86)\\9377À×öªÖ®Å\u00ad\\9377À×öªÖ®Å\u00adÂÌÉ«°æ.lnk\""	zzaz_01.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	duba_1_235.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Rising\RAV\desktop.ini	install1078565.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\desktop.ini	duba_1_235.exe
File opened for modification	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\desktop.ini	duba_1_235.exe

Enumerates connected drives 3 TTPs 32 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	kxetray.exe
File opened (read-only)	\??\Z:	kxetray.exe
File opened (read-only)	\??\F:	ResideClient.exe
File opened (read-only)	\??\E:	ResideClient.exe
File opened (read-only)	\??\M:	kxetray.exe
File opened (read-only)	\??\T:	kxetray.exe
File opened (read-only)	\??\H:	kxetray.exe
File opened (read-only)	\??\L:	kxetray.exe
File opened (read-only)	\??\S:	kxetray.exe
File opened (read-only)	\??\X:	kxetray.exe
File opened (read-only)	\??\D:	kxetray.exe
File opened (read-only)	\??\F:	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File opened (read-only)	\??\F:	kxetray.exe
File opened (read-only)	\??\G:	kxetray.exe
File opened (read-only)	\??\R:	kxetray.exe
File opened (read-only)	\??\E:	kxetray.exe
File opened (read-only)	\??\P:	kxetray.exe
File opened (read-only)	\??\G:	ResideClient.exe
File opened (read-only)	\??\G:	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File opened (read-only)	\??\F:	Kele55.exe
File opened (read-only)	\??\E:	Kele55.exe
File opened (read-only)	\??\I:	kxetray.exe
File opened (read-only)	\??\N:	kxetray.exe
File opened (read-only)	\??\G:	Kele55.exe
File opened (read-only)	\??\K:	kxetray.exe
File opened (read-only)	\??\Q:	kxetray.exe
File opened (read-only)	\??\U:	kxetray.exe
File opened (read-only)	\??\Y:	kxetray.exe
File opened (read-only)	\??\E:	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File opened (read-only)	\??\J:	kxetray.exe
File opened (read-only)	\??\O:	kxetray.exe
File opened (read-only)	\??\W:	kxetray.exe

Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	install1078565.exe
File opened for modification	\??\PhysicalDrive0	ResideClient.exe
File opened for modification	\??\PhysicalDrive0	duba_1_235.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\KAVEventLog.EVT	kavlog2.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RSD\RSSetup\RsBackup.exe	install1078565.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\HOOKBASE\64\rsutils.sys	install1078565.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kupdata.exe	duba_1_235.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\ksbwdet2.dll	duba_1_235.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\ktool_update\kdownload\kav\xlmodule\download\xlbugreport.exe	kxetray.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\xlmodule\download\msvcp71.dll	kxetray.exe
File created	C:\Program Files (x86)\Kele55\ChatRoom\Skin\DefFace.bmp	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RSDK\procenv.dll	install1078565.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RSMONDEF\selfmon.dll	install1078565.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\XMLS\RSCFG.xml	install1078565.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\ksbwdt.ini	duba_1_235.exe
File opened for modification	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\ksoft_category.dat	kxetray.exe
File created	C:\Program Files (x86)\Kele55\data\LgsDatacfg.dat	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\ressrc\chs\extendimg\4.png	duba_1_235.exe
File opened for modification	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\kfcuploadinfo.dat-journal	kxescore.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\RsStub.exe	install1078565.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVBASE\RAVBASE.xml	install1078565.exe
File created	C:\Program Files (x86)\Rising\RSD\Setup.exe	install1078565.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RAV\HOOKBASE\hookbase.dll	install1078565.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\rssrv.dll	install1078565.exe
File created	C:\Program Files (x86)\Rising\RAV\RsTray.ico	install1078565.exe
File created	C:\Program Files (x86)\Rising\RAV\XMLS\RAVCONFIG.xml	install1078565.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\khistory.dll	duba_1_235.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\ksde\kisknl64.sys	duba_1_235.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RSD\RSSetup\RstoreDll.dll	install1078565.exe
File created	C:\Program Files (x86)\Kele55\AudioDecodec3.dll	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\url.ini	install1078565.exe
File created	C:\Program Files (x86)\Rising\RAV\cfgxml\adefmon.mond	install1078565.exe
File created	C:\Program Files (x86)\9377À×öªÖ®Å\uninstall.exe	zzaz_01.exe
File created	C:\Program Files (x86)\Rising\RSD\update.xml	install1078565.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAV936\chs.lag	install1078565.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\ktool_update\kdownload\data\index.txt	kxetray.exe
File created	C:\Program Files (x86)\Kele55\ChatRoom\data\FlowerData.dat	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File created	C:\Program Files (x86)\Kele55\EncWmv.dll	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVBASE\RsTray.ico	install1078565.exe
File created	C:\Program Files (x86)\Rising\RAV\msvcp90.dll	install1078565.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe.bak	duba_1_235.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\rule.krf	duba_1_235.exe
File opened for modification	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxetray.log	kxetray.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\ktool_update\kdownload\kav\data\kuefreq\kuefreq.dat.z	kxetray.exe
File created	C:\Program Files (x86)\Kele55\Skin\MercuryChatHallSkin.ggs	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\rsmain.dll	install1078565.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\Proccomm.dll	install1078565.exe
File created	C:\Program Files (x86)\Rising\RAV\XMLS\RSCOMM.xml	install1078565.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\sp3a.nlb	duba_1_235.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\floatskin\user.ini	kxetray.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\CfgDll.dll	install1078565.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RAVBASE\RAV.ico	install1078565.exe
File opened for modification	C:\Program Files (x86)\Rising\RAV\antipromotionmon.dll	install1078565.exe
File opened for modification	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\bootoptcfg.ini	kxetray.exe
File created	C:\Program Files (x86)\Kele55\Skin\LoadHtml\css\style.css	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File created	C:\Program Files (x86)\Rising\RSD\Backup\RAV\MSCRT9\msvcp90.dll	install1078565.exe
File created	C:\Program Files (x86)\Rising\RAV\XMLS\RAV936.xml	install1078565.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\bredirect.dat	duba_1_235.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\update\chupgrade.ini	kxetray.exe
File created	C:\Program Files (x86)\9377À×öªÖ®Å\LeiTing.dll	zzaz_01.exe
File created	C:\Program Files (x86)\Kele55\ChatRoom\data\fingerGuessing\fingerguessing.gif	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RSCOMM\cnt09.dll	install1078565.exe
File created	C:\Program Files (x86)\Rising\RAV\Label.dat	install1078565.exe
File created	C:\Program Files (x86)\Rising\RAV\bacore.dll	install1078565.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\krcmdmon\data\method.dat	kxetray.exe
File created	C:\Program Files (x86)\Kele55\ChatRoomUI.ocx	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File opened for modification	C:\Program Files (x86)\Rising\RSD\Backup\RAV\RSCOMM\syslay.dll	install1078565.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\wfs.dll	duba_1_235.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\msgpi.log	Kele55.exe
File opened for modification	C:\WINDOWS\gsyspd.log	ResideClient.exe
File opened for modification	C:\WINDOWS\msgpi.log	ResideClient.exe
File opened for modification	C:\WINDOWS\gsyspd.log	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File opened for modification	C:\WINDOWS\msgpi.log	KeLe2014Beta3.6.2Promote0326_20090195130.exe
File opened for modification	C:\WINDOWS\gsyspd.log	Kele55.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 10 IoCs

installer

resource	yara_rule
behavioral2/files/0x0001000000022e6f-144.dat	nsis_installer_1
behavioral2/files/0x0001000000022e6f-144.dat	nsis_installer_2
behavioral2/files/0x0001000000022e6f-146.dat	nsis_installer_1
behavioral2/files/0x0001000000022e6f-146.dat	nsis_installer_2
behavioral2/files/0x0001000000022e6f-150.dat	nsis_installer_1
behavioral2/files/0x0001000000022e6f-150.dat	nsis_installer_2
behavioral2/files/0x0001000000022e71-155.dat	nsis_installer_1
behavioral2/files/0x0001000000022e71-155.dat	nsis_installer_2
behavioral2/files/0x0001000000022e71-156.dat	nsis_installer_1
behavioral2/files/0x0001000000022e71-156.dat	nsis_installer_2

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	kxetray.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	kxetray.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SHPlayer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SHPlayer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 17 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\kele55.com	Kele55.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\chat.kele55.com\ = "63"	Kele55.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	Kele55.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	Kele55.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\IESettingSync	Kele55.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	Kele55.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\kele55.com\Total = "63"	Kele55.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\IESettingSync	LTLogger.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\kele55.com\NumberOfSubdomains = "1"	Kele55.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	LTLogger.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	LTLogger.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	LTLogger.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\kele55.com	Kele55.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "63"	Kele55.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\chat.kele55.com	Kele55.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	Kele55.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	Kele55.exe

Modifies data under HKEY_USERS 52 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ravmond.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	kxescore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ravmond.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	kxescore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	kxescore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ravmond.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	kxescore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ravmond.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	kxescore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	kxescore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.wmv\ = "媒体文件(.wmv)"	FileAssociationsTool.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.3gp\Shell	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.ifox\Shell\使用搜狐影音播放\Icon = "C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.18.0\\SHPlayer.exe"	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.m3u8\shell\open	FileAssociationsTool.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{A9B9EEE8-9B80-40AA-B05B-BD3B2F6273C6}\ShellFolder\PinToNameSpaceTree	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SHImageViewer.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.18.0\\SHImageViewer.exe\" \"%1\""	FileAssociationsTool.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\.mp4\ = "SHPlayer.mp4"	FileAssociationsTool.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.3gpp\Shell\使用搜狐影音播放\Command\ = "C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.18.0\\SHPlayer.exe %1"	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.asf\Shell\使用搜狐影音播放\Icon = "C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.18.0\\SHPlayer.exe"	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.mpg\Shell\使用搜狐影音播放	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3455FF69-FE20-4E00-BE84-5256F068B715}\VersionIndependentProgID\ = "SoHuVA.SoHuDector.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.asf\DefaultIcon	FileAssociationsTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DECF57E2-63D5-4A3B-8973-1E9153BA11A9}\ProgID	KeLe2014Beta3.6.2Promote0326_20090195130.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.ram\Shell\使用搜狐影音播放\Command\ = "C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.18.0\\SHPlayer.exe %1"	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.m2ts\Shell	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SHImageViewer.exe\shell\ = "open"	FileAssociationsTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SHImageViewer.tga\shell\open\ = "使用搜狐看图打开"	SHImageViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Kele55.ChatRoomOcx.1\ = "ChatRoomOcx Control"	KeLe2014Beta3.6.2Promote0326_20090195130.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{A9B9EEE8-9B80-40AA-B05B-BD3B2F6273C6}\Instance\InitPropertyBag	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4891BA68-4A0E-435D-9082-3ED9C5F66FCD}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.m3u8\ = "SHPlayer.m3u8"	FileAssociationsTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHImageViewer.tiff\shell\open	SHImageViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHImageViewer.psd\shell\open	SHImageViewer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.m2t\Shell\使用搜狐影音播放\Command	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SHImageViewer.exe\shell	FileAssociationsTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.m2p	FileAssociationsTool.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.wmv	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.tga\Shell\使用搜狐看图打开\Command\ = "C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.18.0\\SHImageViewer.exe \"%1\""	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SHPlayer.exe\shell\open\ = "使用搜狐影音播放"	FileAssociationsTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pcx\ = "SHImageViewer.pcx"	SHImageViewer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.psd	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ifox	FileAssociationsTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SHImageViewer.bmp\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.18.0\\SHImageViewer.exe\" \"%1\""	SHImageViewer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.rm\Shell\使用搜狐影音播放\Command\ = "C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.18.0\\SHPlayer.exe %1"	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.qt	FileAssociationsTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SHImageViewer.tga\ = "图片文件(.tga)"	SHImageViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F1CF8F61-AB1D-11d4-ABBD-0050BACEC828}\RzNBMlVLLUswUDBORC1MMEVGU1UtRkg1MzAw\ProcDll = "1701205706"	install1078565.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHImageViewer.ico\shell\open\command	SHImageViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SHImageViewer.pcx\shell\ = "open"	SHImageViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.ifox\ = "媒体文件(.ifox)"	FileAssociationsTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.qt\ = "SHPlayer.bak"	FileAssociationsTool.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.rmvb\Shell\使用搜狐影音播放\Command	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.m3u\Shell\使用搜狐影音播放\Command\ = "C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.18.0\\SHPlayer.exe %1"	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.webp\Shell\使用搜狐看图打开\Command	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SoHuVA.SoHuDector\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32\ = "c:\\program files (x86)\\kingsoft\\kingsoft antivirus\\kavmenu64.dll"	duba_1_235.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.ts\shell\ = "open"	FileAssociationsTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.mkv\ = "媒体文件(.mkv)"	FileAssociationsTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.webm\shell\open\ = "使用搜狐影音播放"	FileAssociationsTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C104B2ED-79DB-445D-B13C-65A8BDE47DF9}\ = "_DChatRoomOcx"	KeLe2014Beta3.6.2Promote0326_20090195130.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\kele55room\Url Protocol = "C:\\Program Files (x86)\\Kele55\\Kele55.exe"	KeLe2014Beta3.6.2Promote0326_20090195130.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SystemFileAssociations\.m2p\Shell\使用搜狐影音播放\Command\ = "C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.18.0\\SHPlayer.exe %1"	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.mov\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.18.0\\SHPlayer.exe\" \"%1\""	FileAssociationsTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.ram\shell\open\ = "使用搜狐影音播放"	FileAssociationsTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHPlayer.wmv\shell	FileAssociationsTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SHImageViewer.crw	SHImageViewer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\.gif\ = "SHImageViewer.gif"	SHImageViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SHImageViewer.exe\shell\ = "open"	FileAssociationsTool.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}	duba_1_235.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SHPlayer.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.18.0\\SHPlayer.exe\" \"%1\""	FileAssociationsTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SHImageViewer.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\搜狐影音\\7.0.18.0\\SHImageViewer.exe\" \"%1\""	FileAssociationsTool.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\.webm\ = "SHPlayer.webm"	FileAssociationsTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pcx	SHImageViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D7DDBA5B-45A9-4B01-AFBC-75EAB53ED66B}\NumMethods\ = "28"	regsvr32.exe

Modifies system certificate store 2 TTPs 12 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 5c000000010000000400000000080000040000000100000010000000a7f2e41606411150306b9ce3b49cb0c9030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d467e0000000100000008000000000063f58926d7011d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf6708140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d86200000001000000200000006fff78e400a70c11011cd85977c459fb5af96a3df0540820d0f4b8607875e58f090000000100000022000000302006082b06010505070303060a2b0601040182370a030406082b060105050703080b000000010000002a0000005300650063007400690067006f0020002800550054004e0020004f0062006a00650063007400290000000f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb190000000100000010000000e843ac3b52ec8c297fa948c9b1fb281920000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8	kxescore.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	kxetray.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 190000000100000010000000e843ac3b52ec8c297fa948c9b1fb28190f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb0b000000010000002a0000005300650063007400690067006f0020002800550054004e0020004f0062006a0065006300740029000000090000000100000022000000302006082b06010505070303060a2b0601040182370a030406082b060105050703086200000001000000200000006fff78e400a70c11011cd85977c459fb5af96a3df0540820d0f4b8607875e58f140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d81d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf67087e0000000100000008000000000063f58926d701030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d46040000000100000010000000a7f2e41606411150306b9ce3b49cb0c920000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8	kxescore.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2\Blob = 5c0000000100000004000000000400007e0000000100000008000000000010c51e92d201620000000100000020000000e7685634efacf69ace939a6b255b7b4fabef42935b50a265acb5cb6027e44e7009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030119000000010000001000000091161b894b117ecdc257628db460cc04030000000100000014000000742c3192e607e424eb4549542be1bbc53e6174e21d000000010000001000000027b3517667331ce2c1e74002b5ff2298140000000100000014000000e27f7bd877d5df9e0a3f9eb4cb0e2ea9efdb69770b000000010000004600000056006500720069005300690067006e00200043006c006100730073002000330020005000750062006c006900630020005000720069006d00610072007900200043004100000004000000010000001000000010fc635df6263e0df325be5f79cd67670f0000000100000010000000d7c63be0837dbabf881d4fbf5f986ad853000000010000002400000030223020060a2b0601040182375e010130123010060a2b0601040182373c0101030200c07a000000010000000e000000300c060a2b0601040182375e010268000000010000000800000000003db65bd9d5012000000001000000400200003082023c308201a5021070bae41d10d92934b638ca7b03ccbabf300d06092a864886f70d0101020500305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479301e170d3936303132393030303030305a170d3238303830313233353935395a305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f7269747930819f300d06092a864886f70d010101050003818d0030818902818100c95c599ef21b8a0114b410df0440dbe357af6a45408f840c0bd133d9d911cfee02581f25f72aa84405aaec031f787f9e93b99a00aa237dd6ac85a26345c77227ccf44cc67571d239ef4f42f075df0a90c68e206f980ff8ac235f702936a4c986e7b19a20cb53a585e73dbe7d9afe244533dc7615ed0fa271644c652e816845a70203010001300d06092a864886f70d010102050003818100bb4c122bcf2c26004f1413dda6fbfc0a11848cf3281c67922f7cb6c5fadff0e895bc1d8f6c2ca851cc73d8a4c053f04ed626c076015781925e21f1d1b1ffe7d02158cd6917e3441c9c194439895cdc9c000f568d0299eda290454ce4bb10a43df032030ef1cef8e8c9518ce6629fe69fc07db7729cc9363a6b9f4ea8ff640d64	kxescore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46	kxescore.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 0f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb0b000000010000002a0000005300650063007400690067006f0020002800550054004e0020004f0062006a0065006300740029000000090000000100000022000000302006082b06010505070303060a2b0601040182370a030406082b060105050703086200000001000000200000006fff78e400a70c11011cd85977c459fb5af96a3df0540820d0f4b8607875e58f140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d81d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf67087e0000000100000008000000000063f58926d701030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d4620000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8	kxescore.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 040000000100000010000000a7f2e41606411150306b9ce3b49cb0c9030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d467e0000000100000008000000000063f58926d7011d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf6708140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d86200000001000000200000006fff78e400a70c11011cd85977c459fb5af96a3df0540820d0f4b8607875e58f090000000100000022000000302006082b06010505070303060a2b0601040182370a030406082b060105050703080b000000010000002a0000005300650063007400690067006f0020002800550054004e0020004f0062006a00650063007400290000000f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb20000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8	kxescore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B94294BF91EA8FB64BE61097C7FB001359B676CB	kxetray.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B94294BF91EA8FB64BE61097C7FB001359B676CB\Blob = 0f000000010000001400000044cb4357ecb773b9ac3a3b0b1e45ab6bc45c2f1c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703085300000001000000230000003021301f06092b06010401829b510230123010060a2b0601040182373c0101030200c06200000001000000200000004b22d5a6aec99f3cdb79aa5ec06838479cd5ecba7164f7f22dc1d65f63d85708140000000100000014000000e166cf0ed1f1b34bb7062014fe8712d5f6fefb3e1d000000010000001000000051541f96c328dd7ac3ef2bdce753ac470b000000010000000e00000057006f005300690067006e0000007e000000010000000800000000c00c0f7f39d30168000000010000000800000000800c13c1b9d401030000000100000014000000b94294bf91ea8fb64be61097c7fb001359b676cb20000000010000007a050000308205763082035ea00302010202105e68d61171946350560068f33ec9c591300d06092a864886f70d01010505003055310b300906035504061302434e311a3018060355040a1311576f5369676e204341204c696d69746564312a30280603550403132143657274696669636174696f6e20417574686f72697479206f6620576f5369676e301e170d3039303830383031303030315a170d3339303830383031303030315a3055310b300906035504061302434e311a3018060355040a1311576f5369676e204341204c696d69746564312a30280603550403132143657274696669636174696f6e20417574686f72697479206f6620576f5369676e30820222300d06092a864886f70d01010105000382020f003082020a0282020100bdca8dacb8911556977b6b5c7ac2de6bd9a1b0c31023faa7a1b2cc31fa3ed9a6296f163de06bf8b8405fdb39a8007a8ba04d547dc22278fc8e09b8a885d7cc95974b74d89e7ef000e40e89ae4928441a1099320f258853a40db30f1208160b0371271c7fe1dbd2fd6768c4055d0a0e5d70d7d897a0bc53419a918df49e36667a7e56c1905fe6b1682036a48c242c2c470b59766630b5bedeed8ff89dd3bb0130e6f2f30ee02c9280f385f9288ab4542e9aedf776fc156816eb4a6ceb2e128fd4cffe0cc75c1d0b7e0532be5eb0092a42d5c94e90b3590dbb7a7ecdd5085ab47fd81c6911f9270f7b06af5483187be1dd547a51686e77fcc6bf524a6646a1b2671abba34f77a0be5dfffc560b43727790ca9ef9f239f50da9f4ead7e7b3102f30423721cc3070c986980fcc584d83bb7de51aa5378db6ac3297003a6371241e9e37c4ff74d437c0e2fe88466011dd083f5036abb87aa495626a6eb0ca6a215a69f3f3fb1d703995f3a76ea68189a188c53b71caa352ee83bbfda077f4e46fe742db6d4a998a3448bc17dce4800822b6f231c03f043eeb9f2079d6b80664640231d7a9cd52fb84456909002adc558bc406464bc04a1d095b3928fda9abce00f92e484b26e6304ca558cab444824fe7911e33c3b093ff11fc81d2ca1f7129dd764f9225af1d81b70f2f8cc306cc2f27a34ae40e99ba7c1e451f7faa194596fdfc3d0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414e166cf0ed1f1b34bb7062014fe8712d5f6fefb3e300d06092a864886f70d01010505000382020100a8cb7240b276c17e7bfcad64e3327bcc3cb65d46d3f52ce2705dc82ed8067d98d10b21a0895924019df9af097d0a238234d5fc7c7299b9a3d754f4ea52700ec5f5d63be13a0932e6213993bdb315ea4f6af4f58b3f2f7c8d582ec5e139a03ec73d4a739e407ac02b61a967c9f324b9b36d552c5a1d9e2572ce0badaac755620bbefb63b3614423a3cbe11a0ef79a064dded4234e21965b395b571d2f5d085e0979ff7c97b54d83ae0dd6e6a379e033d099960230a73effd2a3433f055a06ea4402da7cf848d033a9f907c795e1f53ef55d71baf295a974886159e3bfca5a13ba72b48c5d3687e9a6c53c13bfded04426eeb7ec2e70fad79db7ace5c5405ae6d76c7b2cc3569b47cd0bcefa1bb421d7b766b8f425308b5c0db9ea67b2f46daed5a19e4fd89fe92702b01d06d68fe3fb48129f7f11a1103e4c513a96b0d113f1c7d826ae3aca91c4699ddf012964516f68da14ec084197908dd0b280f2cfc23dbf9168c580671ec4601355d56199577cba950f61493aca75bcc90a933f670e12f228e2311bc05716df087c19c17e0f1f851e0a367c5b7e27bc7abfe0dbf4da52bdde0c547031914395c8bcf03edd097e306450ed7f01a433674d684fbe15efb0f60211a21b13253adcc259f1e35c46bb672c0246ea1e48a6e65bd9b5bc51a29296dbaac63722a6fecc2074a32da92e6bcbc0821121b59379ee4486bed71ee41efb	kxetray.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	kxetray.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2	kxescore.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	kxetray.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2156	ServiceClient.exe
2156	ServiceClient.exe
2548	popwndexe.exe
2548	popwndexe.exe
5020	install1078565.exe
4260	msedge.exe
4260	msedge.exe
1328	msedge.exe
1328	msedge.exe
2156	ServiceClient.exe
2156	ServiceClient.exe
3420	ResideClient.exe
3420	ResideClient.exe
2156	ServiceClient.exe
2156	ServiceClient.exe
3420	ResideClient.exe
3420	ResideClient.exe
2156	ServiceClient.exe
2156	ServiceClient.exe
3420	ResideClient.exe
3420	ResideClient.exe
2156	ServiceClient.exe
2156	ServiceClient.exe
3420	ResideClient.exe
3420	ResideClient.exe
2156	ServiceClient.exe
2156	ServiceClient.exe
3420	ResideClient.exe
3420	ResideClient.exe
5212	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
5212	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
5212	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
5212	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
5212	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
5212	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
5212	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
5212	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
5212	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
5212	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
5212	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
5212	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
5212	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
5212	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
5212	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
5212	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
5212	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
5212	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
5212	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
5212	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
5212	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
5212	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
5212	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
5212	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
5212	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
5212	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
5212	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
5212	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
5212	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
5212	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
5212	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
5212	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
5212	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
5212	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
5212	SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe

Suspicious behavior: LoadsDriver 10 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	2836	RsMgrSvc.exe
Token: SeDebugPrivilege	5020	install1078565.exe
Token: SeDebugPrivilege	5556	duba_1_235.exe
Token: SeDebugPrivilege	2240	kislive.exe
Token: SeDebugPrivilege	5556	duba_1_235.exe
Token: SeDebugPrivilege	3500	kxescore.exe
Token: SeDebugPrivilege	5224	kxetray.exe
Token: 33	5980	ravmond.exe
Token: SeIncBasePriorityPrivilege	5980	ravmond.exe
Token: SeDebugPrivilege	3500	kxescore.exe
Token: SeDebugPrivilege	3500	kxescore.exe
Token: 33	5980	ravmond.exe
Token: SeIncBasePriorityPrivilege	5980	ravmond.exe
Token: 33	5980	ravmond.exe
Token: SeIncBasePriorityPrivilege	5980	ravmond.exe
Token: SeDebugPrivilege	5224	kxetray.exe
Token: SeDebugPrivilege	5224	kxetray.exe
Token: 33	5980	ravmond.exe
Token: SeIncBasePriorityPrivilege	5980	ravmond.exe
Token: 33	5980	ravmond.exe
Token: SeIncBasePriorityPrivilege	5980	ravmond.exe
Token: SeDebugPrivilege	5224	kxetray.exe
Token: 33	5980	ravmond.exe
Token: SeIncBasePriorityPrivilege	5980	ravmond.exe
Token: SeDebugPrivilege	5224	kxetray.exe
Token: 33	5980	ravmond.exe
Token: SeIncBasePriorityPrivilege	5980	ravmond.exe
Token: 33	5980	ravmond.exe
Token: SeIncBasePriorityPrivilege	5980	ravmond.exe
Token: SeDebugPrivilege	5224	kxetray.exe
Token: 33	3500	kxescore.exe
Token: SeIncBasePriorityPrivilege	3500	kxescore.exe
Token: 33	5980	ravmond.exe
Token: SeIncBasePriorityPrivilege	5980	ravmond.exe
Token: 33	5980	ravmond.exe
Token: SeIncBasePriorityPrivilege	5980	ravmond.exe
Token: SeDebugPrivilege	5224	kxetray.exe
Token: 33	5980	ravmond.exe
Token: SeIncBasePriorityPrivilege	5980	ravmond.exe
Token: 33	5980	ravmond.exe
Token: SeIncBasePriorityPrivilege	5980	ravmond.exe
Token: 33	5980	ravmond.exe
Token: SeIncBasePriorityPrivilege	5980	ravmond.exe
Token: SeDebugPrivilege	5224	kxetray.exe
Token: 33	5980	ravmond.exe
Token: SeIncBasePriorityPrivilege	5980	ravmond.exe
Token: 33	5980	ravmond.exe
Token: SeIncBasePriorityPrivilege	5980	ravmond.exe
Token: 33	5980	ravmond.exe
Token: SeIncBasePriorityPrivilege	5980	ravmond.exe
Token: 33	5224	kxetray.exe
Token: SeIncBasePriorityPrivilege	5224	kxetray.exe
Token: 33	5980	ravmond.exe
Token: SeIncBasePriorityPrivilege	5980	ravmond.exe
Token: SeDebugPrivilege	5224	kxetray.exe
Token: 33	5980	ravmond.exe
Token: SeIncBasePriorityPrivilege	5980	ravmond.exe
Token: 33	5980	ravmond.exe
Token: SeIncBasePriorityPrivilege	5980	ravmond.exe
Token: 33	5980	ravmond.exe
Token: SeIncBasePriorityPrivilege	5980	ravmond.exe
Token: SeDebugPrivilege	5224	kxetray.exe
Token: 33	5980	ravmond.exe
Token: SeIncBasePriorityPrivilege	5980	ravmond.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
5224	kxetray.exe
5224	kxetray.exe
5224	kxetray.exe
2368	SHPlayer.exe
2368	SHPlayer.exe
5224	kxetray.exe
5224	kxetray.exe
5224	kxetray.exe
5224	kxetray.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
5224	kxetray.exe
5224	kxetray.exe
2368	SHPlayer.exe
2368	SHPlayer.exe

Suspicious use of SetWindowsHookEx 24 IoCs

pid	Process
4684	ServiceClient.exe
2156	ServiceClient.exe
3420	ResideClient.exe
4544	Kele55.exe
4608	Update.exe
3968	Update.exe
4544	Kele55.exe
4544	Kele55.exe
4544	Kele55.exe
3416	LTLogger.exe
3416	LTLogger.exe
5584	FileAssociationsTool.exe
5800	FileAssociationsTool.exe
5512	FileAssociationsTool.exe
3496	FileAssociationsTool.exe
5624	kwsprotect64.exe
5624	kwsprotect64.exe
5224	kxetray.exe
5224	kxetray.exe
2616	FileAssociationsTool.exe
6068	FileAssociationsTool.exe
5404	FileAssociationsTool.exe
5224	kxetray.exe
3452	FileAssociationsTool.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 4336	3404	f4c5c0bd54c2f59b13053c3033c9bf8b2ce3844a0807c7d002b2ea818c8c4ac6.exe	82
PID 3404 wrote to memory of 4336	3404	f4c5c0bd54c2f59b13053c3033c9bf8b2ce3844a0807c7d002b2ea818c8c4ac6.exe	82
PID 3404 wrote to memory of 4336	3404	f4c5c0bd54c2f59b13053c3033c9bf8b2ce3844a0807c7d002b2ea818c8c4ac6.exe	82
PID 3404 wrote to memory of 1392	3404	f4c5c0bd54c2f59b13053c3033c9bf8b2ce3844a0807c7d002b2ea818c8c4ac6.exe	84
PID 3404 wrote to memory of 1392	3404	f4c5c0bd54c2f59b13053c3033c9bf8b2ce3844a0807c7d002b2ea818c8c4ac6.exe	84
PID 3404 wrote to memory of 1392	3404	f4c5c0bd54c2f59b13053c3033c9bf8b2ce3844a0807c7d002b2ea818c8c4ac6.exe	84
PID 3404 wrote to memory of 3656	3404	f4c5c0bd54c2f59b13053c3033c9bf8b2ce3844a0807c7d002b2ea818c8c4ac6.exe	85
PID 3404 wrote to memory of 3656	3404	f4c5c0bd54c2f59b13053c3033c9bf8b2ce3844a0807c7d002b2ea818c8c4ac6.exe	85
PID 3404 wrote to memory of 3656	3404	f4c5c0bd54c2f59b13053c3033c9bf8b2ce3844a0807c7d002b2ea818c8c4ac6.exe	85
PID 1392 wrote to memory of 3508	1392	KeLe2014Beta3.6.2Promote0326_20090195130.exe	86
PID 1392 wrote to memory of 3508	1392	KeLe2014Beta3.6.2Promote0326_20090195130.exe	86
PID 1392 wrote to memory of 3508	1392	KeLe2014Beta3.6.2Promote0326_20090195130.exe	86
PID 3404 wrote to memory of 5020	3404	f4c5c0bd54c2f59b13053c3033c9bf8b2ce3844a0807c7d002b2ea818c8c4ac6.exe	87
PID 3404 wrote to memory of 5020	3404	f4c5c0bd54c2f59b13053c3033c9bf8b2ce3844a0807c7d002b2ea818c8c4ac6.exe	87
PID 3404 wrote to memory of 5020	3404	f4c5c0bd54c2f59b13053c3033c9bf8b2ce3844a0807c7d002b2ea818c8c4ac6.exe	87
PID 1392 wrote to memory of 4684	1392	KeLe2014Beta3.6.2Promote0326_20090195130.exe	88
PID 1392 wrote to memory of 4684	1392	KeLe2014Beta3.6.2Promote0326_20090195130.exe	88
PID 1392 wrote to memory of 4684	1392	KeLe2014Beta3.6.2Promote0326_20090195130.exe	88
PID 4684 wrote to memory of 1404	4684	ServiceClient.exe	90
PID 4684 wrote to memory of 1404	4684	ServiceClient.exe	90
PID 4684 wrote to memory of 1404	4684	ServiceClient.exe	90
PID 1404 wrote to memory of 2864	1404	net.exe	92
PID 1404 wrote to memory of 2864	1404	net.exe	92
PID 1404 wrote to memory of 2864	1404	net.exe	92
PID 3404 wrote to memory of 1328	3404	f4c5c0bd54c2f59b13053c3033c9bf8b2ce3844a0807c7d002b2ea818c8c4ac6.exe	95
PID 3404 wrote to memory of 1328	3404	f4c5c0bd54c2f59b13053c3033c9bf8b2ce3844a0807c7d002b2ea818c8c4ac6.exe	95
PID 1328 wrote to memory of 4276	1328	msedge.exe	96
PID 1328 wrote to memory of 4276	1328	msedge.exe	96
PID 2156 wrote to memory of 3420	2156	ServiceClient.exe	97
PID 2156 wrote to memory of 3420	2156	ServiceClient.exe	97
PID 2156 wrote to memory of 3420	2156	ServiceClient.exe	97
PID 1392 wrote to memory of 4544	1392	KeLe2014Beta3.6.2Promote0326_20090195130.exe	99
PID 1392 wrote to memory of 4544	1392	KeLe2014Beta3.6.2Promote0326_20090195130.exe	99
PID 1392 wrote to memory of 4544	1392	KeLe2014Beta3.6.2Promote0326_20090195130.exe	99
PID 4544 wrote to memory of 4608	4544	Kele55.exe	100
PID 4544 wrote to memory of 4608	4544	Kele55.exe	100
PID 4544 wrote to memory of 4608	4544	Kele55.exe	100
PID 5020 wrote to memory of 2548	5020	install1078565.exe	101
PID 5020 wrote to memory of 2548	5020	install1078565.exe	101
PID 5020 wrote to memory of 2548	5020	install1078565.exe	101
PID 3404 wrote to memory of 4428	3404	f4c5c0bd54c2f59b13053c3033c9bf8b2ce3844a0807c7d002b2ea818c8c4ac6.exe	103
PID 3404 wrote to memory of 4428	3404	f4c5c0bd54c2f59b13053c3033c9bf8b2ce3844a0807c7d002b2ea818c8c4ac6.exe	103
PID 3404 wrote to memory of 4428	3404	f4c5c0bd54c2f59b13053c3033c9bf8b2ce3844a0807c7d002b2ea818c8c4ac6.exe	103
PID 1328 wrote to memory of 216	1328	msedge.exe	104
PID 1328 wrote to memory of 216	1328	msedge.exe	104
PID 1328 wrote to memory of 216	1328	msedge.exe	104
PID 1328 wrote to memory of 216	1328	msedge.exe	104
PID 1328 wrote to memory of 216	1328	msedge.exe	104
PID 1328 wrote to memory of 216	1328	msedge.exe	104
PID 1328 wrote to memory of 216	1328	msedge.exe	104
PID 1328 wrote to memory of 216	1328	msedge.exe	104
PID 1328 wrote to memory of 216	1328	msedge.exe	104
PID 1328 wrote to memory of 216	1328	msedge.exe	104
PID 1328 wrote to memory of 216	1328	msedge.exe	104
PID 1328 wrote to memory of 216	1328	msedge.exe	104
PID 1328 wrote to memory of 216	1328	msedge.exe	104
PID 1328 wrote to memory of 216	1328	msedge.exe	104
PID 1328 wrote to memory of 216	1328	msedge.exe	104
PID 1328 wrote to memory of 216	1328	msedge.exe	104
PID 1328 wrote to memory of 216	1328	msedge.exe	104
PID 1328 wrote to memory of 216	1328	msedge.exe	104
PID 1328 wrote to memory of 216	1328	msedge.exe	104
PID 1328 wrote to memory of 216	1328	msedge.exe	104
PID 1328 wrote to memory of 216	1328	msedge.exe	104

C:\Users\Admin\AppData\Local\Temp\f4c5c0bd54c2f59b13053c3033c9bf8b2ce3844a0807c7d002b2ea818c8c4ac6.exe
"C:\Users\Admin\AppData\Local\Temp\f4c5c0bd54c2f59b13053c3033c9bf8b2ce3844a0807c7d002b2ea818c8c4ac6.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C copy /b "KeLe2014Beta3.6.2Promote0326_20090195130.exe" + "C:\Windows\Fonts\SIMSUN.TTC" "KeLe2014Beta3.6.2Promote0326_20090195130.exe"
  2⤵
  PID:4336
- C:\Users\Admin\AppData\Local\Temp\nsnC336.tmp\KeLe2014Beta3.6.2Promote0326_20090195130.exe
  KeLe2014Beta3.6.2Promote0326_20090195130.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1392
- - C:\Users\Admin\AppData\Local\Temp\nsvEE4F.tmp\GGExit.exe
    "C:\Users\Admin\AppData\Local\Temp\nsvEE4F.tmp\GGExit.exe" 5
    3⤵
    - Executes dropped EXE
    PID:3508
- - C:\Program Files (x86)\Kele55\ServiceClient.exe
    "C:\Program Files (x86)\Kele55\ServiceClient.exe" -i
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4684
  - - C:\Windows\SysWOW64\net.exe
      net start GuaGua-Service
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1404
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start GuaGua-Service
        5⤵
        
        PID:2864
- - C:\Program Files (x86)\Kele55\Kele55.exe
    "C:\Program Files (x86)\Kele55\Kele55.exe" -autorunroom
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Windows directory
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4544
  - - C:\Program Files (x86)\Kele55\Update.exe
      "C:\Program Files (x86)\Kele55\Update.exe" 4.358 1
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4608
  - - C:\Program Files (x86)\Kele55\Update.exe
      "C:\Program Files (x86)\Kele55\Update.exe" 4.358
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3968
- C:\Users\Admin\AppData\Local\Temp\nsnC336.tmp\zzaz_01.exe
  zzaz_01.exe
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  PID:3656
- - C:\Program Files (x86)\9377À×öªÖ®Å\LTLogger.exe
    "C:\Program Files (x86)\9377À×öªÖ®Å\LTLogger.exe" "C:\Program Files (x86)\9377À×öªÖ®Å\LeiTing.dll" 2
    3⤵
    - Executes dropped EXE
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:3416
- C:\Users\Admin\AppData\Local\Temp\nsnC336.tmp\install1078565.exe
  install1078565.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Writes to the Master Boot Record (MBR)
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Program Files (x86)\Rising\RSD\popwndexe.exe
    "C:\Program Files (x86)\Rising\RSD\popwndexe.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2548
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s RavExt64.dll
    3⤵
    PID:5704
- - C:\Program Files (x86)\Rising\RAV\ravmond.exe
    "C:\Program Files (x86)\Rising\RAV\ravmond.exe" -srv setup /SLIENCE
    3⤵
    - Executes dropped EXE
    PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://zhihuiweihai.net/ZjRjNWMwYmQ1NGMyZjU5YjEzMDUzYzMwMzNjOWJmOGIyY2UzODQ0YTA4MDdjN2QwMDJiMmVhODE4YzhjNGFjNi5leGU=/40.html
  2⤵
  - Adds Run key to start application
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9091746f8,0x7ff909174708,0x7ff909174718
    3⤵
    PID:4276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,15902437961028758985,13043754044089944455,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
    3⤵
    PID:216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,15902437961028758985,13043754044089944455,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,15902437961028758985,13043754044089944455,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
    3⤵
    PID:2600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15902437961028758985,13043754044089944455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
    3⤵
    PID:3696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15902437961028758985,13043754044089944455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
    3⤵
    PID:4804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2108,15902437961028758985,13043754044089944455,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5052 /prefetch:8
    3⤵
    PID:4036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15902437961028758985,13043754044089944455,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
    3⤵
    PID:3128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15902437961028758985,13043754044089944455,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3616 /prefetch:1
    3⤵
    PID:3464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2108,15902437961028758985,13043754044089944455,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5776 /prefetch:8
    3⤵
    PID:220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15902437961028758985,13043754044089944455,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
    3⤵
    PID:3708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15902437961028758985,13043754044089944455,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
    3⤵
    PID:3520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15902437961028758985,13043754044089944455,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
    3⤵
    PID:1936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15902437961028758985,13043754044089944455,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
    3⤵
    PID:5668
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    PID:3708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x1c4,0x204,0x228,0x1bc,0x22c,0x7ff7bbd85460,0x7ff7bbd85470,0x7ff7bbd85480
      4⤵
      PID:5576
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,15902437961028758985,13043754044089944455,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5004 /prefetch:8
    3⤵
    PID:5392
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,15902437961028758985,13043754044089944455,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5004 /prefetch:8
    3⤵
    PID:7016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2108,15902437961028758985,13043754044089944455,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4492 /prefetch:8
    3⤵
    - Executes dropped EXE
    PID:7104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15902437961028758985,13043754044089944455,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
    3⤵
    PID:2808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2108,15902437961028758985,13043754044089944455,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1708 /prefetch:8
    3⤵
    PID:376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,15902437961028758985,13043754044089944455,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1428 /prefetch:2
    3⤵
    PID:2080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C copy /b "2345Explorer_329242_silence.exe" + "C:\Windows\Fonts\SIMSUN.TTC" "2345Explorer_329242_silence.exe"
  2⤵
  PID:4428
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C copy /b "SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe" + "C:\Windows\Fonts\SIMSUN.TTC" "SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe"
  2⤵
  PID:2240
- C:\Users\Admin\AppData\Local\Temp\nsnC336.tmp\SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
  SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
  2⤵
  - Executes dropped EXE
  - Registers COM server for autorun
  - Sets DLL path for service in the registry
  - Checks computer location settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5212
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHBHO.dll"
    3⤵
    PID:5696
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHIEPlugin.dll"
    3⤵
    - Modifies registry class
    PID:5848
- - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\syspin.exe
    C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\syspin.exe "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHPlayer.exe" c:5386
    3⤵
    - Executes dropped EXE
    PID:1412
- - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe
    "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe" /EnableAutoRun
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetWindowsHookEx
    PID:5584
- - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe
    "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe" /ModifyMainShortcut
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:5800
- - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe
    "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe" /F
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:5512
- - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe
    "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe" /TSet
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:3496
- - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHImageViewer.exe
    "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHImageViewer.exe" /AddAssoc
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:6092
- - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe
    "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe" /ChangeSohuVARunToSHplayerRun
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2616
- - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe
    "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe" /ReleaseSWF
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:6068
- - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe
    "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe" /InstallSuccess 0
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5404
- - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe
    "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\FileAssociationsTool.exe" /PreventPinning "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\搜狐影音\卸载搜狐影音.lnk"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:3452
- - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHPlayer.exe
    C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHPlayer.exe /auto
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2368
  - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe
      "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe" --type=gpu-process --field-trial-handle=2500,4117774573288999034,5042153881081934749,131072 --disable-features=BlockInsecurePrivateNetworkRequests --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.18.0" --lang=en-US --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --gpu-preferences=UAAAAAAAAADgAAAIAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-27\21-09-50.log" --mojo-platform-channel-handle=2488 /prefetch:2
      4⤵
      Executes dropped EXE
      PID:6316
    - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\CrashSubmit.exe
        
        C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\CrashSubmit.exe player,C:\Users\Admin\Documents\搜狐影音\log\dump\SHCefEngine\SHCefEngine_7.0.18.0_88ad69b7-427c-489a-bd85-9c839a21f156_20221127_210952.dmp,C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-27\21-09-52.log,
        5⤵
        Executes dropped EXE
        
        PID:6600
  - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe
      "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2500,4117774573288999034,5042153881081934749,131072 --disable-features=BlockInsecurePrivateNetworkRequests --lang=en-US --service-sandbox-type=utility --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.18.0" --lang=en-US --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-27\21-09-50.log" --mojo-platform-channel-handle=3408 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:6580
  - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe
      "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2500,4117774573288999034,5042153881081934749,131072 --disable-features=BlockInsecurePrivateNetworkRequests --lang=en-US --service-sandbox-type=none --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.18.0" --lang=en-US --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-27\21-09-50.log" --mojo-platform-channel-handle=3552 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:6616
  - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe
      "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe" --type=gpu-process --field-trial-handle=2500,4117774573288999034,5042153881081934749,131072 --disable-features=BlockInsecurePrivateNetworkRequests --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.18.0" --lang=en-US --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --gpu-preferences=UAAAAAAAAADgAAAIAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-27\21-09-50.log" --mojo-platform-channel-handle=4640 /prefetch:2
      4⤵
      Executes dropped EXE
      PID:6160
    - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\CrashSubmit.exe
        
        C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\CrashSubmit.exe player,C:\Users\Admin\Documents\搜狐影音\log\dump\SHCefEngine\SHCefEngine_7.0.18.0_117680b7-d9cb-4e26-9a60-42a2fd83996a_20221127_210956.dmp,C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-27\21-09-56.log,
        5⤵
        Executes dropped EXE
        
        PID:6356
  - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe
      "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.18.0" --disable-extensions --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-27\21-09-50.log" --field-trial-handle=2500,4117774573288999034,5042153881081934749,131072 --disable-features=BlockInsecurePrivateNetworkRequests --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --mojo-platform-channel-handle=4788 /prefetch:1
      4⤵
      Executes dropped EXE
      Checks computer location settings
      PID:4272
  - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe
      "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.18.0" --disable-extensions --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-27\21-09-50.log" --field-trial-handle=2500,4117774573288999034,5042153881081934749,131072 --disable-features=BlockInsecurePrivateNetworkRequests --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=3 --mojo-platform-channel-handle=4552 /prefetch:1
      4⤵
      Executes dropped EXE
      Checks computer location settings
      PID:5560
  - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe
      "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe" --type=gpu-process --field-trial-handle=2500,4117774573288999034,5042153881081934749,131072 --disable-features=BlockInsecurePrivateNetworkRequests --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.18.0" --lang=en-US --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --gpu-preferences=UAAAAAAAAADgAAAIAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-27\21-09-50.log" --mojo-platform-channel-handle=4820 /prefetch:2
      4⤵
      PID:7104
    - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\CrashSubmit.exe
        
        C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\CrashSubmit.exe player,C:\Users\Admin\Documents\搜狐影音\log\dump\SHCefEngine\SHCefEngine_7.0.18.0_dc1da8fb-4b94-4828-bb02-c4a7f886508f_20221127_210957.dmp,C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-27\21-09-57.log,
        5⤵
        Executes dropped EXE
        
        PID:3356
  - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe
      "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe" --type=gpu-process --field-trial-handle=2500,4117774573288999034,5042153881081934749,131072 --disable-features=BlockInsecurePrivateNetworkRequests --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.18.0" --lang=en-US --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --gpu-preferences=UAAAAAAAAADgAAAIAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-27\21-09-50.log" --mojo-platform-channel-handle=4648 /prefetch:2
      4⤵
      Executes dropped EXE
      PID:6604
  - - C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe
      "C:\Users\Admin\AppData\Roaming\搜狐影音\7.0.18.0\SHCefEngine.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2500,4117774573288999034,5042153881081934749,131072 --disable-features=BlockInsecurePrivateNetworkRequests --lang=en-US --service-sandbox-type=audio --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 ifox/7.0.18.0" --lang=en-US --user-data-dir="C:\Users\Admin\Documents\搜狐影音\web\user-data" --log-file="C:\Users\Admin\Documents\搜狐影音\log\SHCefEngine\2022-11-27\21-09-50.log" --mojo-platform-channel-handle=5396 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:6824
- C:\Users\Admin\AppData\Local\Temp\nsnC336.tmp\duba_1_235.exe
  duba_1_235.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Registers COM server for autorun
  - Sets file execution options in registry
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Writes to the Master Boot Record (MBR)
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:5556
- - \??\c:\program files (x86)\kingsoft\kingsoft antivirus\kavlog2.exe
    "c:\program files (x86)\kingsoft\kingsoft antivirus\kavlog2.exe" -install
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:4784
- - \??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxetray.exe
    "c:\program files (x86)\kingsoft\kingsoft antivirus\kxetray.exe" /autorun /hidefloatwin /silentinstrcmd
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Modifies system certificate store
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:5224
  - - \??\c:\program files (x86)\kingsoft\kingsoft antivirus\kwsprotect64.exe
      "kwsprotect64.exe" (null)
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5624
- - \??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe
    "c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe" /start kxescore
    3⤵
    - Executes dropped EXE
    PID:5256
- - \??\c:\program files (x86)\kingsoft\kingsoft antivirus\kislive.exe
    "c:\program files (x86)\kingsoft\kingsoft antivirus\kislive.exe" /autorun /std /skipcs3
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2240

C:\Program Files (x86)\Kele55\ServiceClient.exe
"C:\Program Files (x86)\Kele55\ServiceClient.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Program Files (x86)\Kele55\ResideClient.exe
  ResideClient.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Writes to the Master Boot Record (MBR)
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3420

C:\Program Files (x86)\Rising\RSD\RsMgrSvc.exe
"C:\Program Files (x86)\Rising\RSD\RsMgrSvc.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2280

C:\Program Files (x86)\Rising\RAV\ravmond.exe
"C:\Program Files (x86)\Rising\RAV\ravmond.exe"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5980

\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe
"c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe" /service kxescore
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Sets service image path in registry
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:3500

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs shsp
1⤵
- Modifies data under HKEY_USERS
PID:4232

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4e8 0x4e0
1⤵
PID:5760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Kele55\ChatRoomUI.ocx

Filesize
33KB

MD5
a50b61d2a7ea450615f817419bcad8ed

SHA1
12b85bb0e9695f25866a7bcedcffa72fe7e9ef75

SHA256
82b62d74cc6be6b9925ada79f56952385c8dfe800ad8f6dd375fa090bd371c05

SHA512
3a13d880278aa155454254c67622b40608a1628dd31550aa14b24ed5739e71ef9bf7b1d3ea28fe7968e234337728600dc19f63a621c39f3b9936ad4adb214b2f

Download Submit
C:\Program Files (x86)\Kele55\ChatRoomUI.ocx

Filesize
33KB

MD5
a50b61d2a7ea450615f817419bcad8ed

SHA1
12b85bb0e9695f25866a7bcedcffa72fe7e9ef75

SHA256
82b62d74cc6be6b9925ada79f56952385c8dfe800ad8f6dd375fa090bd371c05

SHA512
3a13d880278aa155454254c67622b40608a1628dd31550aa14b24ed5739e71ef9bf7b1d3ea28fe7968e234337728600dc19f63a621c39f3b9936ad4adb214b2f

Download Submit
C:\Program Files (x86)\Kele55\MFC71U.DLL

Filesize
1.0MB

MD5
03df065a8dba0d71993fd8090e397d5d

SHA1
296f0ca29ea4103942384fa13e9b8c745b77da48

SHA256
68174cec32d3170389fe538c10328596db724488259727eed54e401c8f411ba4

SHA512
650ad429c391bfbab69e387e396e9da2613ec800e5f15c14df4acb25525036c3aec4bba41e966ec0e3842fd69dd6feaf7f4c6b4beb32758644e59d6fb5674ebe

Download Submit
C:\Program Files (x86)\Kele55\MFC71u.dll

Filesize
1.0MB

MD5
03df065a8dba0d71993fd8090e397d5d

SHA1
296f0ca29ea4103942384fa13e9b8c745b77da48

SHA256
68174cec32d3170389fe538c10328596db724488259727eed54e401c8f411ba4

SHA512
650ad429c391bfbab69e387e396e9da2613ec800e5f15c14df4acb25525036c3aec4bba41e966ec0e3842fd69dd6feaf7f4c6b4beb32758644e59d6fb5674ebe

Download Submit
C:\Program Files (x86)\Kele55\MFC71u.dll

Filesize
1.0MB

MD5
03df065a8dba0d71993fd8090e397d5d

SHA1
296f0ca29ea4103942384fa13e9b8c745b77da48

SHA256
68174cec32d3170389fe538c10328596db724488259727eed54e401c8f411ba4

SHA512
650ad429c391bfbab69e387e396e9da2613ec800e5f15c14df4acb25525036c3aec4bba41e966ec0e3842fd69dd6feaf7f4c6b4beb32758644e59d6fb5674ebe

Download Submit
C:\Program Files (x86)\Kele55\MSVCR71.dll

Filesize
345KB

MD5
ebb3e701588a92c36b4c902a3976e58a

SHA1
83cec9f2b486eb7d000aa0d716246ab044c2bf2e

SHA256
63ce7639ee0f0c16b7cf45c3f73b698887260bc3225cb25c26a97e2b09d92c3e

SHA512
23887dc229f6753100a06f9a6d3ea391d5b50778e6b239f6592675e53300fc8b4eb95796bbcf4123271213384ccf0773a1e2a09f8c68c2b58f2e6f074c7e53ac

Download Submit
C:\Program Files (x86)\Kele55\RecommendInfo.dll

Filesize
141KB

MD5
c5b6f976be3dc938a24d3ef537ed6d92

SHA1
db6a17965a8b7e1fccbfe4273cbcd8da8e7607c5

SHA256
5e4c0c1f19aee6de56b711b0fe7b9ed4e83f9b47bde01b7944bbc77211e5aa0b

SHA512
90dabcd921b4022916127f1a115b8b434883c80afc5a78660f5957aae0984b6c1ea2e2996ffdb88ee099425a00b14f2e57efd8e28eeb6bd01acc77ee811c2c73

Download Submit
C:\Program Files (x86)\Kele55\RecommendInfo.dll

Filesize
141KB

MD5
c5b6f976be3dc938a24d3ef537ed6d92

SHA1
db6a17965a8b7e1fccbfe4273cbcd8da8e7607c5

SHA256
5e4c0c1f19aee6de56b711b0fe7b9ed4e83f9b47bde01b7944bbc77211e5aa0b

SHA512
90dabcd921b4022916127f1a115b8b434883c80afc5a78660f5957aae0984b6c1ea2e2996ffdb88ee099425a00b14f2e57efd8e28eeb6bd01acc77ee811c2c73

Download Submit
C:\Program Files (x86)\Kele55\ServiceClient.exe

Filesize
113KB

MD5
f73dfe587bb6dfb7a3fb792757daa066

SHA1
d48e893245b1b55f73730fd887a0a02ba1d65486

SHA256
84736855ef4b0143d1fe4c97953d70c85d5ffd442ff1e83fd417b22441ec0771

SHA512
6ac4ce1169a3132cf788bd81811e5fc7ca40e61ae327b0be13dc43cb7c9a94aa60bd9f8723559a4801d21298d59ebed8db004d91b2efb5648d48e6177b034df1

Download Submit
C:\Program Files (x86)\Kele55\ServiceClient.exe

Filesize
113KB

MD5
f73dfe587bb6dfb7a3fb792757daa066

SHA1
d48e893245b1b55f73730fd887a0a02ba1d65486

SHA256
84736855ef4b0143d1fe4c97953d70c85d5ffd442ff1e83fd417b22441ec0771

SHA512
6ac4ce1169a3132cf788bd81811e5fc7ca40e61ae327b0be13dc43cb7c9a94aa60bd9f8723559a4801d21298d59ebed8db004d91b2efb5648d48e6177b034df1

Download Submit
C:\Program Files (x86)\Kele55\msvcp71.dll

Filesize
493KB

MD5
e5d08ef3e7b1d377b0e8c5417c959811

SHA1
e35cf02aa4a1a4b4abc11a4ca5f742f58b79758b

SHA256
b70e7e0b3102cefe3c19f9e9c9067947d5ff97f533694124e110cf77617601b8

SHA512
764cdae4d9414e550adee64884e70a8cbd7078b2c3b6b8a58e2dba9a093f949d1a4cfb6158a33f487c48b81b21dbc9af57b7c9809b35ffabf0148d139f998f2f

Download Submit
C:\Program Files (x86)\Kele55\msvcr71.dll

Filesize
345KB

MD5
ebb3e701588a92c36b4c902a3976e58a

SHA1
83cec9f2b486eb7d000aa0d716246ab044c2bf2e

SHA256
63ce7639ee0f0c16b7cf45c3f73b698887260bc3225cb25c26a97e2b09d92c3e

SHA512
23887dc229f6753100a06f9a6d3ea391d5b50778e6b239f6592675e53300fc8b4eb95796bbcf4123271213384ccf0773a1e2a09f8c68c2b58f2e6f074c7e53ac

Download Submit
C:\Program Files (x86)\Kele55\msvcr71.dll

Filesize
345KB

MD5
ebb3e701588a92c36b4c902a3976e58a

SHA1
83cec9f2b486eb7d000aa0d716246ab044c2bf2e

SHA256
63ce7639ee0f0c16b7cf45c3f73b698887260bc3225cb25c26a97e2b09d92c3e

SHA512
23887dc229f6753100a06f9a6d3ea391d5b50778e6b239f6592675e53300fc8b4eb95796bbcf4123271213384ccf0773a1e2a09f8c68c2b58f2e6f074c7e53ac

Download Submit
C:\Program Files (x86)\Kele55\msvcr71.dll

Filesize
345KB

MD5
ebb3e701588a92c36b4c902a3976e58a

SHA1
83cec9f2b486eb7d000aa0d716246ab044c2bf2e

SHA256
63ce7639ee0f0c16b7cf45c3f73b698887260bc3225cb25c26a97e2b09d92c3e

SHA512
23887dc229f6753100a06f9a6d3ea391d5b50778e6b239f6592675e53300fc8b4eb95796bbcf4123271213384ccf0773a1e2a09f8c68c2b58f2e6f074c7e53ac

Download Submit
C:\Program Files (x86)\Kele55\msvcr71.dll

Filesize
345KB

MD5
ebb3e701588a92c36b4c902a3976e58a

SHA1
83cec9f2b486eb7d000aa0d716246ab044c2bf2e

SHA256
63ce7639ee0f0c16b7cf45c3f73b698887260bc3225cb25c26a97e2b09d92c3e

SHA512
23887dc229f6753100a06f9a6d3ea391d5b50778e6b239f6592675e53300fc8b4eb95796bbcf4123271213384ccf0773a1e2a09f8c68c2b58f2e6f074c7e53ac

Download Submit
C:\Program Files (x86)\Kele55\msvcr71.dll

Filesize
345KB

MD5
ebb3e701588a92c36b4c902a3976e58a

SHA1
83cec9f2b486eb7d000aa0d716246ab044c2bf2e

SHA256
63ce7639ee0f0c16b7cf45c3f73b698887260bc3225cb25c26a97e2b09d92c3e

SHA512
23887dc229f6753100a06f9a6d3ea391d5b50778e6b239f6592675e53300fc8b4eb95796bbcf4123271213384ccf0773a1e2a09f8c68c2b58f2e6f074c7e53ac

Download Submit
C:\Program Files (x86)\Kele55\msvcr71.dll

Filesize
345KB

MD5
ebb3e701588a92c36b4c902a3976e58a

SHA1
83cec9f2b486eb7d000aa0d716246ab044c2bf2e

SHA256
63ce7639ee0f0c16b7cf45c3f73b698887260bc3225cb25c26a97e2b09d92c3e

SHA512
23887dc229f6753100a06f9a6d3ea391d5b50778e6b239f6592675e53300fc8b4eb95796bbcf4123271213384ccf0773a1e2a09f8c68c2b58f2e6f074c7e53ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\RsdSfxTmp\CfgDll.dll

Filesize
264KB

MD5
4bf3b0c552a575f4a0d09bf74e4083dd

SHA1
1d995c98685471e7b7df3ac1df5426b7c8a4a1de

SHA256
539b021a0c3d445c9d2f054e0a33d0e8497893c321732c3f2a41d912384fde90

SHA512
15021142825e15efbee778df625bcbaae9587d1e41b23ac142b2b82c2c2b6592d61635f3a35ed10c8615ef29acdd44a8a3d52949202dc90a2058fc9666a30317

Download Submit
C:\Users\Admin\AppData\Local\Temp\RsdSfxTmp\CfgDll.dll

Filesize
264KB

MD5
4bf3b0c552a575f4a0d09bf74e4083dd

SHA1
1d995c98685471e7b7df3ac1df5426b7c8a4a1de

SHA256
539b021a0c3d445c9d2f054e0a33d0e8497893c321732c3f2a41d912384fde90

SHA512
15021142825e15efbee778df625bcbaae9587d1e41b23ac142b2b82c2c2b6592d61635f3a35ed10c8615ef29acdd44a8a3d52949202dc90a2058fc9666a30317

Download Submit
C:\Users\Admin\AppData\Local\Temp\RsdSfxTmp\CfgDll.dll

Filesize
264KB

MD5
4bf3b0c552a575f4a0d09bf74e4083dd

SHA1
1d995c98685471e7b7df3ac1df5426b7c8a4a1de

SHA256
539b021a0c3d445c9d2f054e0a33d0e8497893c321732c3f2a41d912384fde90

SHA512
15021142825e15efbee778df625bcbaae9587d1e41b23ac142b2b82c2c2b6592d61635f3a35ed10c8615ef29acdd44a8a3d52949202dc90a2058fc9666a30317

Download Submit
C:\Users\Admin\AppData\Local\Temp\RsdSfxTmp\CfgDll.dll

Filesize
264KB

MD5
4bf3b0c552a575f4a0d09bf74e4083dd

SHA1
1d995c98685471e7b7df3ac1df5426b7c8a4a1de

SHA256
539b021a0c3d445c9d2f054e0a33d0e8497893c321732c3f2a41d912384fde90

SHA512
15021142825e15efbee778df625bcbaae9587d1e41b23ac142b2b82c2c2b6592d61635f3a35ed10c8615ef29acdd44a8a3d52949202dc90a2058fc9666a30317

Download Submit
C:\Users\Admin\AppData\Local\Temp\RsdSfxTmp\RsAppMgr.dll

Filesize
62KB

MD5
1f35136daa23c794a9561b46db35d5a5

SHA1
c70934be177b81bcc8f5d0e925a9c4b16cf2778e

SHA256
1a5b02c7eb208459cba7795c286c4df00de1eee2fa5f5ad9caebdf385f568851

SHA512
ec6bd64f525687c8ec772770c2e754dbb64b64f2b11c40a4799a641df2c0faee63c4cc7df3e1a935ce2496c68003297c3e66371c47fd285206dba27e396a7d6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RsdSfxTmp\RsAppMgr.dll

Filesize
62KB

MD5
1f35136daa23c794a9561b46db35d5a5

SHA1
c70934be177b81bcc8f5d0e925a9c4b16cf2778e

SHA256
1a5b02c7eb208459cba7795c286c4df00de1eee2fa5f5ad9caebdf385f568851

SHA512
ec6bd64f525687c8ec772770c2e754dbb64b64f2b11c40a4799a641df2c0faee63c4cc7df3e1a935ce2496c68003297c3e66371c47fd285206dba27e396a7d6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RsdSfxTmp\comx3.dll

Filesize
182KB

MD5
92aa0e6a0be8766a98a74f05d202d4c3

SHA1
ea14ee946d61b014c2d0e463c454387d7f2fe527

SHA256
152ce57d1b6fbc784373f770a4dbe9812f6b1abeec549276e9f9747719d439f3

SHA512
d7cc56b0d521859c50c80bc403f3cdf987252f28b6f7928302f83b9e7923c1dd3c3f4b12aa31b8cf9e9ff296ce213cd5c6f1500bf69c1adc1b07c38b66a06d3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RsdSfxTmp\comx3.dll

Filesize
182KB

MD5
92aa0e6a0be8766a98a74f05d202d4c3

SHA1
ea14ee946d61b014c2d0e463c454387d7f2fe527

SHA256
152ce57d1b6fbc784373f770a4dbe9812f6b1abeec549276e9f9747719d439f3

SHA512
d7cc56b0d521859c50c80bc403f3cdf987252f28b6f7928302f83b9e7923c1dd3c3f4b12aa31b8cf9e9ff296ce213cd5c6f1500bf69c1adc1b07c38b66a06d3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RsdSfxTmp\ravbase\RavSetup.dll

Filesize
1.0MB

MD5
844b13a33adcc21e08e66d93f5606067

SHA1
6216dcb8866083f07aefc677bf3580a2017d381e

SHA256
4ed07f391753f1c285f1f54d894e23acb897acc9703b4e57c5b4d159ff60e6b6

SHA512
8a8bb03a7461b7989dbe392cd98931d3f4eaf847cc634093d3c6b8d159f6dbb0be994b15badd462a89035c7ee46eb48111a5b4ca1b7dcbf054aeef38158f9253

Download Submit
C:\Users\Admin\AppData\Local\Temp\RsdSfxTmp\rscomm\Proccomm.dll

Filesize
158KB

MD5
7ae91c40093e829a971616b1e2f9113e

SHA1
a6b4e970be9e2821bcc7ec8c1e77304a15f58e3e

SHA256
608cba4e01124a099758295103ba0e5f8d2665874d78b9e3aeb45f7d6c7c2264

SHA512
242b1f46c6367f2b318460aafdc400340e01047ca5f6256e3f53977dc44c8d74f97d085551b39937e2e8b9848cf4fb409c7387fb20da6a5fed2cccebb70065ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\RsdSfxTmp\rslang.dll

Filesize
134KB

MD5
af1b1fca64556fab4ce9c09e1dac4b96

SHA1
c4c6c9ab878bc779ddfcf45c6175bcc67a20f8ce

SHA256
6340dbb7152c32a54e55a12c054d06e6e98add697a2e5be5929806fec306b643

SHA512
2feb1881bedc73b4e69bec79889fb03940b9165a62083f729682803e85e547fe848451f5cc94779f1746eba19cbc2bf26e5d60c7876b491d28bed5b4f1601945

Download Submit
C:\Users\Admin\AppData\Local\Temp\RsdSfxTmp\syslay.dll

Filesize
98KB

MD5
6a2ad6ba7dece95286bc5eef92c62b28

SHA1
61148917a206bf38c5f110eff5c9382ab940ff80

SHA256
bf46b98b27b82a666c2f22fc66c569f3566f33a638c9f5929d25cf071a5024bf

SHA512
81c6b8f7ce8a758255203eb0603ef5de8e4ffd1db290199c17b821a3731cf055cd007afa343fda44d6a43b21a4c8190abee83abe20e4677991541f68baeb22d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\RsdSfxTmp\syslay.dll

Filesize
98KB

MD5
6a2ad6ba7dece95286bc5eef92c62b28

SHA1
61148917a206bf38c5f110eff5c9382ab940ff80

SHA256
bf46b98b27b82a666c2f22fc66c569f3566f33a638c9f5929d25cf071a5024bf

SHA512
81c6b8f7ce8a758255203eb0603ef5de8e4ffd1db290199c17b821a3731cf055cd007afa343fda44d6a43b21a4c8190abee83abe20e4677991541f68baeb22d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnC336.tmp\Base64.dll

Filesize
4KB

MD5
f0e3845fefd227d7f1101850410ec849

SHA1
3067203fafd4237be0c186ddab7029dfcbdfb53e

SHA256
7c688940e73022bf526f07cc922a631a1b1db78a19439af6bafbff2a3b46d554

SHA512
584ae5a0d1c1639ba4e2187d0c8a0ac7e54c0be0a266029c4689d81c0c64a7f80e7d918da0df5c6344f9f7a114f30d8f2feda253b29e813bae086604731a3d8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnC336.tmp\Base64.dll

Filesize
4KB

MD5
f0e3845fefd227d7f1101850410ec849

SHA1
3067203fafd4237be0c186ddab7029dfcbdfb53e

SHA256
7c688940e73022bf526f07cc922a631a1b1db78a19439af6bafbff2a3b46d554

SHA512
584ae5a0d1c1639ba4e2187d0c8a0ac7e54c0be0a266029c4689d81c0c64a7f80e7d918da0df5c6344f9f7a114f30d8f2feda253b29e813bae086604731a3d8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnC336.tmp\ExecCmd.dll

Filesize
4KB

MD5
b9380b0bea8854fd9f93cc1fda0dfeac

SHA1
edb8d58074e098f7b5f0d158abedc7fc53638618

SHA256
1f4bd9c9376fe1b6913baeca7fb6df6467126f27c9c2fe038206567232a0e244

SHA512
45c3ab0f2bce53b75e72e43bac747dc0618342a3f498be8e2eb62a6db0b137fcdb1735da83051b14824996b5287109aa831e5859d6f21f0ed21b76b3d335418c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnC336.tmp\ExecCmd.dll

Filesize
4KB

MD5
b9380b0bea8854fd9f93cc1fda0dfeac

SHA1
edb8d58074e098f7b5f0d158abedc7fc53638618

SHA256
1f4bd9c9376fe1b6913baeca7fb6df6467126f27c9c2fe038206567232a0e244

SHA512
45c3ab0f2bce53b75e72e43bac747dc0618342a3f498be8e2eb62a6db0b137fcdb1735da83051b14824996b5287109aa831e5859d6f21f0ed21b76b3d335418c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnC336.tmp\Inetc.dll

Filesize
20KB

MD5
50fdadda3e993688401f6f1108fabdb4

SHA1
04a9ae55d0fb726be49809582cea41d75bf22a9a

SHA256
6d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6

SHA512
e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnC336.tmp\Inetc.dll

Filesize
20KB

MD5
50fdadda3e993688401f6f1108fabdb4

SHA1
04a9ae55d0fb726be49809582cea41d75bf22a9a

SHA256
6d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6

SHA512
e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnC336.tmp\KeLe2014Beta3.6.2Promote0326_20090195130.exe

Filesize
31.9MB

MD5
acc0cc73d338150acfa35ea47ae7de9b

SHA1
d2f594a2a606e7a8576e7b55f7ca585c72e850d9

SHA256
68cc7f928e1656c83d486b59d3fffffd0ad51624f0e95fd88f1c806a1080ad8f

SHA512
cae4c9d67699e237c832cc738e1cc156eba19c529ff3a30b457e6ec2a16ebc331afac6a9c4aff5043decc577928fe174c8accb8ea7ebe3667644cffc105d45c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnC336.tmp\KeLe2014Beta3.6.2Promote0326_20090195130.exe

Filesize
31.9MB

MD5
acc0cc73d338150acfa35ea47ae7de9b

SHA1
d2f594a2a606e7a8576e7b55f7ca585c72e850d9

SHA256
68cc7f928e1656c83d486b59d3fffffd0ad51624f0e95fd88f1c806a1080ad8f

SHA512
cae4c9d67699e237c832cc738e1cc156eba19c529ff3a30b457e6ec2a16ebc331afac6a9c4aff5043decc577928fe174c8accb8ea7ebe3667644cffc105d45c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnC336.tmp\KeLe2014Beta3.6.2Promote0326_20090195130.exe

Filesize
31.9MB

MD5
acc0cc73d338150acfa35ea47ae7de9b

SHA1
d2f594a2a606e7a8576e7b55f7ca585c72e850d9

SHA256
68cc7f928e1656c83d486b59d3fffffd0ad51624f0e95fd88f1c806a1080ad8f

SHA512
cae4c9d67699e237c832cc738e1cc156eba19c529ff3a30b457e6ec2a16ebc331afac6a9c4aff5043decc577928fe174c8accb8ea7ebe3667644cffc105d45c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnC336.tmp\NSISdl.dll

Filesize
14KB

MD5
254f13dfd61c5b7d2119eb2550491e1d

SHA1
5083f6804ee3475f3698ab9e68611b0128e22fd6

SHA256
fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28

SHA512
fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnC336.tmp\NSISdl.dll

Filesize
14KB

MD5
254f13dfd61c5b7d2119eb2550491e1d

SHA1
5083f6804ee3475f3698ab9e68611b0128e22fd6

SHA256
fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28

SHA512
fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnC336.tmp\NSISdl.dll

Filesize
14KB

MD5
254f13dfd61c5b7d2119eb2550491e1d

SHA1
5083f6804ee3475f3698ab9e68611b0128e22fd6

SHA256
fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28

SHA512
fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnC336.tmp\NSISdl.dll

Filesize
14KB

MD5
254f13dfd61c5b7d2119eb2550491e1d

SHA1
5083f6804ee3475f3698ab9e68611b0128e22fd6

SHA256
fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28

SHA512
fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnC336.tmp\NSISdl.dll

Filesize
14KB

MD5
254f13dfd61c5b7d2119eb2550491e1d

SHA1
5083f6804ee3475f3698ab9e68611b0128e22fd6

SHA256
fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28

SHA512
fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnC336.tmp\NSISdl.dll

Filesize
14KB

MD5
254f13dfd61c5b7d2119eb2550491e1d

SHA1
5083f6804ee3475f3698ab9e68611b0128e22fd6

SHA256
fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28

SHA512
fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnC336.tmp\NSISdl.dll

Filesize
14KB

MD5
254f13dfd61c5b7d2119eb2550491e1d

SHA1
5083f6804ee3475f3698ab9e68611b0128e22fd6

SHA256
fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28

SHA512
fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnC336.tmp\NSISdl.dll

Filesize
14KB

MD5
254f13dfd61c5b7d2119eb2550491e1d

SHA1
5083f6804ee3475f3698ab9e68611b0128e22fd6

SHA256
fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28

SHA512
fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnC336.tmp\NSISdl.dll

Filesize
14KB

MD5
254f13dfd61c5b7d2119eb2550491e1d

SHA1
5083f6804ee3475f3698ab9e68611b0128e22fd6

SHA256
fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28

SHA512
fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnC336.tmp\NSISdl.dll

Filesize
14KB

MD5
254f13dfd61c5b7d2119eb2550491e1d

SHA1
5083f6804ee3475f3698ab9e68611b0128e22fd6

SHA256
fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28

SHA512
fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnC336.tmp\System.dll

Filesize
11KB

MD5
00a0194c20ee912257df53bfe258ee4a

SHA1
d7b4e319bc5119024690dc8230b9cc919b1b86b2

SHA256
dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

SHA512
3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnC336.tmp\install1078565.exe

Filesize
4.4MB

MD5
63ba39f98e28fad9bef7cd57672fc028

SHA1
ab5059718c8483f91e543eb9206746318bc8d006

SHA256
8491c297a332fb2085322e8f06d9ca5ff4fa0d0c0e5ea0bccf1cb5abeab8a122

SHA512
c7b22fba53d252e47966ffe1f5d26129f23ad555366ef6a9e8573eb66b71ff0bc5d93a28563ba9ff589e7f88fb73a3259ed704af62e1ac3d30d198238379f5c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnC336.tmp\install1078565.exe

Filesize
4.4MB

MD5
63ba39f98e28fad9bef7cd57672fc028

SHA1
ab5059718c8483f91e543eb9206746318bc8d006

SHA256
8491c297a332fb2085322e8f06d9ca5ff4fa0d0c0e5ea0bccf1cb5abeab8a122

SHA512
c7b22fba53d252e47966ffe1f5d26129f23ad555366ef6a9e8573eb66b71ff0bc5d93a28563ba9ff589e7f88fb73a3259ed704af62e1ac3d30d198238379f5c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnC336.tmp\zzaz_01.exe

Filesize
1.3MB

MD5
d8f51e267c90056d984fc877e68f15be

SHA1
605340922bc4651d8ec0d058bd166d18f684bc26

SHA256
5c01bc659b439e6a9b174848669ef39cf09ffa55860c5cf6a711763ff687e619

SHA512
ebe9c38743c6c283ef316647d08d11cae2154b2f56fe9519b17f9e2c7f2de5a7defa122f2ee444d3291711f392d658f1581d58818bdb1d119c4ab9a20512e881

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnC336.tmp\zzaz_01.exe

Filesize
1.3MB

MD5
d8f51e267c90056d984fc877e68f15be

SHA1
605340922bc4651d8ec0d058bd166d18f684bc26

SHA256
5c01bc659b439e6a9b174848669ef39cf09ffa55860c5cf6a711763ff687e619

SHA512
ebe9c38743c6c283ef316647d08d11cae2154b2f56fe9519b17f9e2c7f2de5a7defa122f2ee444d3291711f392d658f1581d58818bdb1d119c4ab9a20512e881

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoF738.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoF738.tmp\inetc.dll

Filesize
21KB

MD5
4b2ac1ce1a2d71e9655a92afb8f8c76b

SHA1
8d5086a8195e95d72667d6c7707778750ead5cdc

SHA256
b7481b29387fbc83ea24684919fec44eedb054d70dc7d4af81394f22184d1142

SHA512
b988bbc1d34e270736c073d2a2be7650c41f7d70d58671115665e48f19e8a8826f6c6e2d340ca7c82d6dd86e9c045acb9658bd4865ffd2ef71b596a7bd993ea4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoF738.tmp\inetc.dll

Filesize
21KB

MD5
4b2ac1ce1a2d71e9655a92afb8f8c76b

SHA1
8d5086a8195e95d72667d6c7707778750ead5cdc

SHA256
b7481b29387fbc83ea24684919fec44eedb054d70dc7d4af81394f22184d1142

SHA512
b988bbc1d34e270736c073d2a2be7650c41f7d70d58671115665e48f19e8a8826f6c6e2d340ca7c82d6dd86e9c045acb9658bd4865ffd2ef71b596a7bd993ea4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoF738.tmp\inetc.dll

Filesize
21KB

MD5
4b2ac1ce1a2d71e9655a92afb8f8c76b

SHA1
8d5086a8195e95d72667d6c7707778750ead5cdc

SHA256
b7481b29387fbc83ea24684919fec44eedb054d70dc7d4af81394f22184d1142

SHA512
b988bbc1d34e270736c073d2a2be7650c41f7d70d58671115665e48f19e8a8826f6c6e2d340ca7c82d6dd86e9c045acb9658bd4865ffd2ef71b596a7bd993ea4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoF738.tmp\inetc.dll

Filesize
21KB

MD5
4b2ac1ce1a2d71e9655a92afb8f8c76b

SHA1
8d5086a8195e95d72667d6c7707778750ead5cdc

SHA256
b7481b29387fbc83ea24684919fec44eedb054d70dc7d4af81394f22184d1142

SHA512
b988bbc1d34e270736c073d2a2be7650c41f7d70d58671115665e48f19e8a8826f6c6e2d340ca7c82d6dd86e9c045acb9658bd4865ffd2ef71b596a7bd993ea4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoF738.tmp\ip.dll

Filesize
16KB

MD5
4df6320e8281512932a6e86c98de2c17

SHA1
ae6336192d27874f9cd16cd581f1c091850cf494

SHA256
7744a495ceacf8584d4f6786699e94a09935a94929d4861142726562af53faa4

SHA512
7c468de59614f506a2ce8445ef00267625e5a8e483913cdd18636cea543be0ca241891e75979a55bb67eecc11a7ac0649b48b55a10e9a01362a0250839462d3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoF738.tmp\ip.dll

Filesize
16KB

MD5
4df6320e8281512932a6e86c98de2c17

SHA1
ae6336192d27874f9cd16cd581f1c091850cf494

SHA256
7744a495ceacf8584d4f6786699e94a09935a94929d4861142726562af53faa4

SHA512
7c468de59614f506a2ce8445ef00267625e5a8e483913cdd18636cea543be0ca241891e75979a55bb67eecc11a7ac0649b48b55a10e9a01362a0250839462d3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvEE4F.tmp\GGExit.exe

Filesize
54KB

MD5
14607f1d7790612a9ca212f4ab8f605a

SHA1
060450216bc1daeb380562f65358300f594f0b86

SHA256
e36913e299219488cae06555019aceb086d66d8d1d5024b9405933d4b3abec67

SHA512
611895f78dab311ace1ab14a5dd630e230b9884c5acf95232ccc13c75805c3da26d3d26304c3e341a85834d05dc1826394305fcefa5f2839bdf88f4c0ce9c868

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvEE4F.tmp\GGExit.exe

Filesize
54KB

MD5
14607f1d7790612a9ca212f4ab8f605a

SHA1
060450216bc1daeb380562f65358300f594f0b86

SHA256
e36913e299219488cae06555019aceb086d66d8d1d5024b9405933d4b3abec67

SHA512
611895f78dab311ace1ab14a5dd630e230b9884c5acf95232ccc13c75805c3da26d3d26304c3e341a85834d05dc1826394305fcefa5f2839bdf88f4c0ce9c868

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvEE4F.tmp\System.dll

Filesize
10KB

MD5
2b54369538b0fb45e1bb9f49f71ce2db

SHA1
c20df42fda5854329e23826ba8f2015f506f7b92

SHA256
761dcdf12f41d119f49dbdca9bcab3928bbdfd8edd67e314d54689811f9d3e2f

SHA512
25e4898e3c082632dfd493756c4cc017decbef43ffa0b68f36d037841a33f2a1721f30314a85597ac30c7ecc99b7257ea43f3a903744179578a9c65fcf57a8b7

Download Submit
memory/216-269-0x0000000000000000-mapping.dmp

Download
memory/220-297-0x0000000000000000-mapping.dmp

Download
memory/1328-243-0x0000000000000000-mapping.dmp

Download
memory/1392-188-0x0000000002180000-0x00000000021D6000-memory.dmp

Filesize
344KB

Download
memory/1392-145-0x0000000000000000-mapping.dmp

Download
memory/1392-183-0x0000000000781000-0x0000000000784000-memory.dmp

Filesize
12KB

Download
memory/1404-226-0x0000000000000000-mapping.dmp

Download
memory/1412-420-0x0000000000000000-mapping.dmp

Download
memory/1412-426-0x0000000000400000-0x00000000005A7000-memory.dmp

Filesize
1.7MB

Download
memory/1412-434-0x00000000005F0000-0x00000000005F3000-memory.dmp

Filesize
12KB

Download
memory/1412-446-0x0000000000400000-0x00000000005A7000-memory.dmp

Filesize
1.7MB

Download
memory/1936-303-0x0000000000000000-mapping.dmp

Download
memory/2156-244-0x0000000000580000-0x00000000005D6000-memory.dmp

Filesize
344KB

Download
memory/2156-242-0x0000000000581000-0x00000000005BA000-memory.dmp

Filesize
228KB

Download
memory/2240-304-0x0000000000000000-mapping.dmp

Download
memory/2240-366-0x0000000000000000-mapping.dmp

Download
memory/2368-491-0x0000000000000000-mapping.dmp

Download
memory/2548-266-0x0000000000000000-mapping.dmp

Download
memory/2600-279-0x0000000000000000-mapping.dmp

Download
memory/2616-474-0x0000000000000000-mapping.dmp

Download
memory/2836-257-0x0000000000DB0000-0x0000000000DC9000-memory.dmp

Filesize
100KB

Download
memory/2864-230-0x0000000000000000-mapping.dmp

Download
memory/3128-292-0x0000000000000000-mapping.dmp

Download
memory/3404-135-0x0000000002801000-0x0000000002804000-memory.dmp

Filesize
12KB

Download
memory/3404-140-0x0000000002801000-0x0000000002804000-memory.dmp

Filesize
12KB

Download
memory/3416-290-0x0000000000000000-mapping.dmp

Download
memory/3420-251-0x0000000000000000-mapping.dmp

Download
memory/3420-252-0x00000000005A0000-0x00000000005F6000-memory.dmp

Filesize
344KB

Download
memory/3452-488-0x0000000000000000-mapping.dmp

Download
memory/3464-294-0x0000000000000000-mapping.dmp

Download
memory/3496-461-0x0000000000000000-mapping.dmp

Download
memory/3508-157-0x0000000000000000-mapping.dmp

Download
memory/3520-301-0x0000000000000000-mapping.dmp

Download
memory/3656-151-0x0000000000000000-mapping.dmp

Download
memory/3656-164-0x00000000007C1000-0x00000000007C4000-memory.dmp

Filesize
12KB

Download
memory/3656-167-0x00000000007C1000-0x00000000007C4000-memory.dmp

Filesize
12KB

Download
memory/3696-284-0x0000000000000000-mapping.dmp

Download
memory/3708-299-0x0000000000000000-mapping.dmp

Download
memory/3708-500-0x0000000000000000-mapping.dmp

Download
memory/3968-271-0x0000000000000000-mapping.dmp

Download
memory/3968-273-0x0000000000470000-0x00000000004C6000-memory.dmp

Filesize
344KB

Download
memory/4036-289-0x0000000000000000-mapping.dmp

Download
memory/4260-270-0x0000000000000000-mapping.dmp

Download
memory/4272-526-0x0000000000000000-mapping.dmp

Download
memory/4276-250-0x0000000000000000-mapping.dmp

Download
memory/4336-143-0x0000000000000000-mapping.dmp

Download
memory/4428-267-0x0000000000000000-mapping.dmp

Download
memory/4544-258-0x0000000000BE0000-0x0000000000C36000-memory.dmp

Filesize
344KB

Download
memory/4544-272-0x00000000028D0000-0x000000000290A000-memory.dmp

Filesize
232KB

Download
memory/4544-295-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/4544-276-0x0000000004360000-0x000000000441F000-memory.dmp

Filesize
764KB

Download
memory/4544-256-0x0000000000000000-mapping.dmp

Download
memory/4544-280-0x0000000004A60000-0x0000000004A87000-memory.dmp

Filesize
156KB

Download
memory/4544-261-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/4608-263-0x0000000000000000-mapping.dmp

Download
memory/4608-264-0x0000000000660000-0x00000000006B6000-memory.dmp

Filesize
344KB

Download
memory/4684-220-0x0000000000A20000-0x0000000000A76000-memory.dmp

Filesize
344KB

Download
memory/4684-209-0x0000000000000000-mapping.dmp

Download
memory/4784-363-0x0000000000000000-mapping.dmp

Download
memory/4804-286-0x0000000000000000-mapping.dmp

Download
memory/5020-310-0x0000000000961000-0x0000000000978000-memory.dmp

Filesize
92KB

Download
memory/5020-234-0x00000000038E1000-0x00000000038F8000-memory.dmp

Filesize
92KB

Download
memory/5020-247-0x00000000038E0000-0x0000000003957000-memory.dmp

Filesize
476KB

Download
memory/5020-248-0x00000000038E1000-0x000000000394D000-memory.dmp

Filesize
432KB

Download
memory/5020-177-0x0000000000400000-0x00000000005EC000-memory.dmp

Filesize
1.9MB

Download
memory/5020-194-0x00000000024E0000-0x0000000002524000-memory.dmp

Filesize
272KB

Download
memory/5020-305-0x00000000005F0000-0x0000000000615000-memory.dmp

Filesize
148KB

Download
memory/5020-307-0x0000000000960000-0x0000000000984000-memory.dmp

Filesize
144KB

Download
memory/5020-171-0x0000000000000000-mapping.dmp

Download
memory/5020-311-0x0000000000961000-0x0000000000978000-memory.dmp

Filesize
92KB

Download
memory/5020-482-0x0000000000400000-0x00000000005EC000-memory.dmp

Filesize
1.9MB

Download
memory/5020-246-0x00000000038E1000-0x0000000003942000-memory.dmp

Filesize
388KB

Download
memory/5020-241-0x00000000038E1000-0x00000000038F8000-memory.dmp

Filesize
92KB

Download
memory/5020-249-0x000000000394D000-0x0000000003958000-memory.dmp

Filesize
44KB

Download
memory/5020-231-0x00000000038E0000-0x0000000003904000-memory.dmp

Filesize
144KB

Download
memory/5020-235-0x00000000038E1000-0x00000000038F8000-memory.dmp

Filesize
92KB

Download
memory/5020-228-0x0000000003000000-0x000000000302C000-memory.dmp

Filesize
176KB

Download
memory/5020-208-0x0000000002FB0000-0x0000000002FC9000-memory.dmp

Filesize
100KB

Download
memory/5020-237-0x00000000038E1000-0x00000000038F8000-memory.dmp

Filesize
92KB

Download
memory/5020-287-0x0000000000400000-0x00000000005EC000-memory.dmp

Filesize
1.9MB

Download
memory/5020-238-0x00000000038E1000-0x00000000038F8000-memory.dmp

Filesize
92KB

Download
memory/5020-240-0x00000000038E1000-0x00000000038F8000-memory.dmp

Filesize
92KB

Download
memory/5020-204-0x0000000002550000-0x000000000257E000-memory.dmp

Filesize
184KB

Download
memory/5212-329-0x0000000000000000-mapping.dmp

Download
memory/5224-364-0x0000000000000000-mapping.dmp

Download
memory/5256-365-0x0000000000000000-mapping.dmp

Download
memory/5404-483-0x0000000000000000-mapping.dmp

Download
memory/5512-460-0x0000000000000000-mapping.dmp

Download
memory/5556-499-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/5556-351-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/5556-337-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/5556-336-0x0000000000000000-mapping.dmp

Download
memory/5560-523-0x0000000000000000-mapping.dmp

Download
memory/5576-501-0x0000000000000000-mapping.dmp

Download
memory/5584-447-0x0000000000000000-mapping.dmp

Download
memory/5624-467-0x0000000000000000-mapping.dmp

Download
memory/5668-346-0x0000000000000000-mapping.dmp

Download
memory/5696-348-0x0000000000000000-mapping.dmp

Download
memory/5704-347-0x0000000000000000-mapping.dmp

Download
memory/5800-457-0x0000000000000000-mapping.dmp

Download
memory/5848-352-0x0000000000000000-mapping.dmp

Download
memory/5948-353-0x0000000000000000-mapping.dmp

Download
memory/6068-481-0x0000000000000000-mapping.dmp

Download
memory/6092-462-0x0000000000000000-mapping.dmp

Download
memory/6160-522-0x0000000000000000-mapping.dmp

Download
memory/6316-503-0x0000000000000000-mapping.dmp

Download
memory/6356-527-0x0000000000000000-mapping.dmp

Download
memory/6580-507-0x0000000000000000-mapping.dmp

Download
memory/6600-508-0x0000000000000000-mapping.dmp

Download
memory/6616-509-0x0000000000000000-mapping.dmp

Download
memory/7016-514-0x0000000000000000-mapping.dmp

Download