dc21e0e1092e35eb793f8dcd8d7c92166819d7081d9db4c2530d3a8522e143df

Analysis

max time kernel
151s
max time network
157s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 13:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dc21e0e1092e35eb793f8dcd8d7c92166819d7081d9db4c2530d3a8522e143df.exe
Size

1.6MB
MD5

aea89e584baa3cdb4bc42f62f798ac5c
SHA1

126024decb74c300579bb844451e6a17a383d6f0
SHA256

dc21e0e1092e35eb793f8dcd8d7c92166819d7081d9db4c2530d3a8522e143df
SHA512

6faa1eaefa08f0c71fd40ce6e4379a28d8211aa53ed755d0d9106a15dce4252b7c67d80a3d5a0a379262462c2c43b97223fe2484fed0de69b77729bde0eb299e
SSDEEP

49152:nYqRvbfHLZW2Uf9SLukd3W0C1dySncCZ8W4z:/RjlW22ULuiW5xcCZEz

Score

8^/10

aspackv2 discovery evasion persistence spyware stealer trojan upx

Malware Config

Signatures

ASPack v2.12-2.42 8 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x00060000000142c8-82.dat	aspack_v212_v242
behavioral1/files/0x00060000000142c8-80.dat	aspack_v212_v242
behavioral1/files/0x00060000000142c8-112.dat	aspack_v212_v242
behavioral1/files/0x00060000000142c8-111.dat	aspack_v212_v242
behavioral1/files/0x00060000000142c8-110.dat	aspack_v212_v242
behavioral1/files/0x000400000001cc4b-139.dat	aspack_v212_v242
behavioral1/files/0x000400000001cc4b-140.dat	aspack_v212_v242
behavioral1/files/0x000400000001cc4b-141.dat	aspack_v212_v242

Downloads MZ/PE file

Drops file in Drivers directory 15 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\ksskrpr.sys	KINSTALLERS_41_61290.exe
File created	C:\Windows\system32\drivers\kusbquery.sys	KINSTALLERS_41_61290.exe
File created	C:\Windows\system32\drivers\kusbquery64.sys	KINSTALLERS_41_61290.exe
File opened for modification	C:\Windows\SysWOW64\drivers\kisknl.sys	kxescore.exe
File opened for modification	C:\Windows\SysWOW64\drivers\KAVBase.sys	KINSTALLERS_41_61290.exe
File created	C:\Windows\system32\drivers\kisknl64.sys	KINSTALLERS_41_61290.exe
File opened for modification	C:\Windows\system32\drivers\kisknl.sys	kxescore.exe
File created	C:\Windows\system32\drivers\kavbootc.sys	KINSTALLERS_41_61290.exe
File created	C:\Windows\system32\drivers\kavbootc64.sys	KINSTALLERS_41_61290.exe
File created	C:\Windows\system32\drivers\kdhacker.sys	KINSTALLERS_41_61290.exe
File created	C:\Windows\system32\drivers\kdhacker64.sys	KINSTALLERS_41_61290.exe
File created	C:\Windows\system32\drivers\kisknl.sys	KINSTALLERS_41_61290.exe
File created	C:\Windows\system32\drivers\bc.sys	KINSTALLERS_41_61290.exe
File opened for modification	C:\Windows\system32\drivers\bc.sys	KINSTALLERS_41_61290.exe
File created	C:\Windows\system32\drivers\ksapi.sys	KINSTALLERS_41_61290.exe

Executes dropped EXE 14 IoCs

pid	Process
1036	CFÔÂÓ°¸¨Öú.exe
1536	wiresion.exe
792	KINSTALLERS_41_61290.exe
1716	gamebrowser_1.0_lizhiheng_t101001.exe
1336	100004.exe
632	qh562.exe
1032	KINSTALLERS_41_61290.exe
2536	kavlog2.exe
2556	kxetray.exe
2588	kxescore.exe
2608	kislive.exe
2684	kxescore.exe
3064	kwsprotect64.exe
1232	Process not Found

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32\ = "c:\\program files (x86)\\kingsoft\\kingsoft antivirus\\kavmenu64.dll"	KINSTALLERS_41_61290.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32\ThreadingModel = "Apartment"	KINSTALLERS_41_61290.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32	KINSTALLERS_41_61290.exe

Sets file execution options in registry 2 TTPs 28 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kscan.exe	KINSTALLERS_41_61290.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ksignsp.exe	KINSTALLERS_41_61290.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kxescore.exe	KINSTALLERS_41_61290.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KXESCORE.EXE	KINSTALLERS_41_61290.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scomregsvrv8.exe	KINSTALLERS_41_61290.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kisaddin.exe	KINSTALLERS_41_61290.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISADDIN.EXE	KINSTALLERS_41_61290.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRECYCLE.EXE	KINSTALLERS_41_61290.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\krecycle.exe	KINSTALLERS_41_61290.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCOMREGSVRV8.EXE	KINSTALLERS_41_61290.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISCALL.EXE	KINSTALLERS_41_61290.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ksetupwiz.exe	KINSTALLERS_41_61290.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KSIGNSP.EXE	KINSTALLERS_41_61290.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVLOG2.EXE	KINSTALLERS_41_61290.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kdrvmgr.exe	KINSTALLERS_41_61290.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISLIVE.EXE	KINSTALLERS_41_61290.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavlog2.exe	KINSTALLERS_41_61290.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kismain.exe	KINSTALLERS_41_61290.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kxetray.exe	KINSTALLERS_41_61290.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KSETUPWIZ.EXE	KINSTALLERS_41_61290.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UNINST.EXE	KINSTALLERS_41_61290.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kiscall.exe	KINSTALLERS_41_61290.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kislive.exe	KINSTALLERS_41_61290.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISMAIN.EXE	KINSTALLERS_41_61290.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uninst.exe	KINSTALLERS_41_61290.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KDRVMGR.EXE	KINSTALLERS_41_61290.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KSCAN.EXE	KINSTALLERS_41_61290.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KXETRAY.EXE	KINSTALLERS_41_61290.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\KDHacker\ImagePath = "\\??\\c:\\program files (x86)\\kingsoft\\kingsoft antivirus\\security\\kxescan\\kdhacker64.sys"	kxescore.exe

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000600000001428e-65.dat	upx
behavioral1/files/0x000600000001428e-66.dat	upx
behavioral1/files/0x000600000001428e-68.dat	upx
behavioral1/memory/1536-74-0x0000000000400000-0x0000000000504000-memory.dmp	upx
behavioral1/files/0x000600000001428e-79.dat	upx
behavioral1/files/0x000600000001428e-76.dat	upx
behavioral1/files/0x000600000001428e-78.dat	upx
behavioral1/files/0x000600000001428e-77.dat	upx
behavioral1/files/0x000600000001435a-100.dat	upx
behavioral1/files/0x000600000001435a-98.dat	upx
behavioral1/files/0x000600000001435a-106.dat	upx
behavioral1/files/0x000600000001435a-104.dat	upx
behavioral1/files/0x000600000001435a-103.dat	upx
behavioral1/memory/980-109-0x0000000010000000-0x000000001004B000-memory.dmp	upx
behavioral1/memory/980-125-0x0000000010000000-0x000000001004B000-memory.dmp	upx
behavioral1/memory/632-126-0x0000000000180000-0x00000000001AF000-memory.dmp	upx
behavioral1/files/0x000a000000013a09-129.dat	upx
behavioral1/files/0x000a000000013a09-131.dat	upx
behavioral1/files/0x000a000000013a09-134.dat	upx
behavioral1/files/0x000a000000013a09-133.dat	upx
behavioral1/files/0x000a000000013a09-135.dat	upx
behavioral1/memory/1032-136-0x0000000000400000-0x000000000051C000-memory.dmp	upx
behavioral1/memory/1536-146-0x0000000000400000-0x0000000000504000-memory.dmp	upx
behavioral1/memory/980-150-0x0000000010000000-0x000000001004B000-memory.dmp	upx
behavioral1/memory/632-151-0x0000000000180000-0x00000000001AF000-memory.dmp	upx
behavioral1/memory/1032-216-0x0000000000400000-0x000000000051C000-memory.dmp	upx
behavioral1/memory/1032-219-0x0000000000400000-0x000000000051C000-memory.dmp	upx

Loads dropped DLL 64 IoCs

pid	Process
1340	dc21e0e1092e35eb793f8dcd8d7c92166819d7081d9db4c2530d3a8522e143df.exe
1340	dc21e0e1092e35eb793f8dcd8d7c92166819d7081d9db4c2530d3a8522e143df.exe
1340	dc21e0e1092e35eb793f8dcd8d7c92166819d7081d9db4c2530d3a8522e143df.exe
1036	CFÔÂÓ°¸¨Öú.exe
1036	CFÔÂÓ°¸¨Öú.exe
1036	CFÔÂÓ°¸¨Öú.exe
1036	CFÔÂÓ°¸¨Öú.exe
1036	CFÔÂÓ°¸¨Öú.exe
1036	CFÔÂÓ°¸¨Öú.exe
1536	wiresion.exe
1536	wiresion.exe
1536	wiresion.exe
1036	CFÔÂÓ°¸¨Öú.exe
1036	CFÔÂÓ°¸¨Öú.exe
1036	CFÔÂÓ°¸¨Öú.exe
792	KINSTALLERS_41_61290.exe
792	KINSTALLERS_41_61290.exe
792	KINSTALLERS_41_61290.exe
1336	100004.exe
1336	100004.exe
1336	100004.exe
1036	CFÔÂÓ°¸¨Öú.exe
632	qh562.exe
632	qh562.exe
1716	gamebrowser_1.0_lizhiheng_t101001.exe
1716	gamebrowser_1.0_lizhiheng_t101001.exe
792	KINSTALLERS_41_61290.exe
1032	KINSTALLERS_41_61290.exe
1032	KINSTALLERS_41_61290.exe
1716	gamebrowser_1.0_lizhiheng_t101001.exe
1716	gamebrowser_1.0_lizhiheng_t101001.exe
1716	gamebrowser_1.0_lizhiheng_t101001.exe
1032	KINSTALLERS_41_61290.exe
1032	KINSTALLERS_41_61290.exe
1032	KINSTALLERS_41_61290.exe
1032	KINSTALLERS_41_61290.exe
1032	KINSTALLERS_41_61290.exe
1032	KINSTALLERS_41_61290.exe
1032	KINSTALLERS_41_61290.exe
1032	KINSTALLERS_41_61290.exe
1032	KINSTALLERS_41_61290.exe
1032	KINSTALLERS_41_61290.exe
1032	KINSTALLERS_41_61290.exe
1032	KINSTALLERS_41_61290.exe
1032	KINSTALLERS_41_61290.exe
1032	KINSTALLERS_41_61290.exe
1032	KINSTALLERS_41_61290.exe
1032	KINSTALLERS_41_61290.exe
2536	kavlog2.exe
2556	kxetray.exe
2556	kxetray.exe
2556	kxetray.exe
2556	kxetray.exe
2536	kavlog2.exe
2536	kavlog2.exe
2536	kavlog2.exe
2608	kislive.exe
2608	kislive.exe
2608	kislive.exe
2608	kislive.exe
2556	kxetray.exe
2588	kxescore.exe
2588	kxescore.exe
2588	kxescore.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Service 2,0,6,19 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qh562.exe"	qh562.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	KINSTALLERS_41_61290.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kxesc = "\"c:\\program files (x86)\\kingsoft\\kingsoft antivirus\\kxetray.exe\" -autorun"	KINSTALLERS_41_61290.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	gamebrowser_1.0_lizhiheng_t101001.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\desktop.ini	KINSTALLERS_41_61290.exe
File opened for modification	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\desktop.ini	KINSTALLERS_41_61290.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	kxetray.exe
File opened (read-only)	\??\H:	kxetray.exe
File opened (read-only)	\??\I:	kxetray.exe
File opened (read-only)	\??\K:	kxetray.exe
File opened (read-only)	\??\N:	kxetray.exe
File opened (read-only)	\??\O:	kxetray.exe
File opened (read-only)	\??\U:	kxetray.exe
File opened (read-only)	\??\X:	kxetray.exe
File opened (read-only)	\??\D:	kxetray.exe
File opened (read-only)	\??\L:	kxetray.exe
File opened (read-only)	\??\S:	kxetray.exe
File opened (read-only)	\??\Y:	kxetray.exe
File opened (read-only)	\??\F:	kxetray.exe
File opened (read-only)	\??\G:	kxetray.exe
File opened (read-only)	\??\M:	kxetray.exe
File opened (read-only)	\??\P:	kxetray.exe
File opened (read-only)	\??\Q:	kxetray.exe
File opened (read-only)	\??\R:	kxetray.exe
File opened (read-only)	\??\V:	kxetray.exe
File opened (read-only)	\??\J:	kxetray.exe
File opened (read-only)	\??\T:	kxetray.exe
File opened (read-only)	\??\W:	kxetray.exe
File opened (read-only)	\??\Z:	kxetray.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1768	1672	WerFault.exe	41
2228	2184	WerFault.exe	46
2336	2252	WerFault.exe	49

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\KAVEventLog.EVT	kavlog2.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\ressrc\chs\kws\icon\commentbgdangerlts.gif	KINSTALLERS_41_61290.exe
File created	\??\c:\program files (x86)\kingsoft\shoujizhushou\kmobiletray.dll	KINSTALLERS_41_61290.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\netbuyImgs\13dipanw.png	kxetray.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\netbuyImgs\abchina.png	kxetray.exe
File opened for modification	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\kxesetting.dat	kxetray.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\shoujizhushou\pubfiles.xml	KINSTALLERS_41_61290.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\broplugver.ini	KINSTALLERS_41_61290.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\wd.dat	KINSTALLERS_41_61290.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\shoujizhushou\dpinst64.exe	KINSTALLERS_41_61290.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\shoujizhushou\kmobilescan.dll	KINSTALLERS_41_61290.exe
File opened for modification	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\shoujizhushou\shoujizhushou.exe	KINSTALLERS_41_61290.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\netbuyImgs\tuanqq.png	kxetray.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kdefendpop.dll	KINSTALLERS_41_61290.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxebase.dll	KINSTALLERS_41_61290.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\defendmon.dll	KINSTALLERS_41_61290.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\kxesansp.dll	KINSTALLERS_41_61290.exe
File created	\??\c:\program files (x86)\kingsoft\shoujizhushou\msvcp80.dll	KINSTALLERS_41_61290.exe
File opened for modification	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\shoujizhushou\dpinst32.exe	KINSTALLERS_41_61290.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\netbuyImgs\guangfa.png	kxetray.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\netbuyImgs\caomeipai.png	kxetray.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\netbuyImgs\hxb.png	kxetray.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kdownloader.exe	KINSTALLERS_41_61290.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\ksesscan.dll	KINSTALLERS_41_61290.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxecore\kxecore.dll	KINSTALLERS_41_61290.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\netbuyImgs\icson.png	kxetray.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\operation\cas\kctrl.dat	KINSTALLERS_41_61290.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\netbuyImgs\02_126yx.png	kxetray.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\netbuyImgs\guomei.png	kxetray.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\module.ini	KINSTALLERS_41_61290.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\bittransport.dll	KINSTALLERS_41_61290.exe
File opened for modification	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\shoujizhushou\shoujikong.exe	KINSTALLERS_41_61290.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\netbuyImgs\jianshe.png	kxetray.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\netbuyImgs\zhongxin.png	kxetray.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\quarantine.ini	KINSTALLERS_41_61290.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\bro.cfg	KINSTALLERS_41_61290.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\apdev.dat	KINSTALLERS_41_61290.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\npkws.crx	KINSTALLERS_41_61290.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\netbuyImgs\jingdong.png	kxetray.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\netbuyImgs\kuaiqian.png	kxetray.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\netbuyImgs\w1.png	kxetray.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\shoujizhushou\ksfskin.dll	KINSTALLERS_41_61290.exe
File opened for modification	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\deflist.dat	kxetray.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\netbuyImgs\11sgyx.png	kxetray.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\netbuyImgs\dazhe.png	kxetray.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\netbuyImgs\manzuo.png	kxetray.exe
File opened for modification	\??\c:\program files (x86)\kingsoft\shoujizhushou\skin\skincfg.ini	kxetray.exe
File opened for modification	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\netbuyImgs\paipai.png	kxetray.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kavpid.kid	KINSTALLERS_41_61290.exe
File created	\??\c:\program files (x86)\kingsoft\shoujizhushou\kfmt.dat	KINSTALLERS_41_61290.exe
File opened for modification	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\shoujizhushou\kctrl.dat	KINSTALLERS_41_61290.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\netbuyImgs\ips.png	kxetray.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\netbuyImgs\justonline.png	kxetray.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\netbuyImgs\moonbasa.png	kxetray.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\netbuyImgs\hccb.png	kxetray.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kwsu.dat	KINSTALLERS_41_61290.exe
File created	\??\c:\program files (x86)\kingsoft\shoujizhushou\sjk_apk.ico	KINSTALLERS_41_61290.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\data\neybuydescrip.xml	KINSTALLERS_41_61290.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kwsshop.dat	KINSTALLERS_41_61290.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kwsui64.dll	KINSTALLERS_41_61290.exe
File created	\??\c:\program files (x86)\kingsoft\shoujizhushou\kusbcore.dll	KINSTALLERS_41_61290.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\netbuyImgs\zhifubao.png	kxetray.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\netbuyImgs\tccb.png	kxetray.exe
File created	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\shoujizhushou\drvinst32.exe	KINSTALLERS_41_61290.exe
File opened for modification	\??\c:\program files (x86)\kingsoft\kingsoft antivirus\desktop.ini	KINSTALLERS_41_61290.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 45 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4082C7C1-70F0-11ED-9D78-7225AF48583A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	wiresion.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage	wiresion.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	gamebrowser_1.0_lizhiheng_t101001.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\passport.baidu.com\ = "63"	wiresion.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\NumberOfSubdomains = "1"	wiresion.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\passport.baidu.com	wiresion.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376606247"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com	wiresion.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	wiresion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	wiresion.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	wiresion.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TypedURLs	gamebrowser_1.0_lizhiheng_t101001.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "63"	wiresion.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "63"	wiresion.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Modifies registry class 46 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD55A64C-EEB6-49A4-957C-A90873740819}	gamebrowser_1.0_lizhiheng_t101001.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD55A64C-EEB6-49A4-957C-A90873740819}\ProgID	gamebrowser_1.0_lizhiheng_t101001.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\Shellex\ContextMenuHandlers\duba_64bit	KINSTALLERS_41_61290.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}\InprocServer32\ThreadingModel = "Apartment"	KINSTALLERS_41_61290.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\Shellex\ContextMenuHandlers\duba_64bit	KINSTALLERS_41_61290.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\duba_64bit\ = "{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}"	KINSTALLERS_41_61290.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}	KINSTALLERS_41_61290.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idex = "876d65d63cee27c3b74c6de20b92c530"	KINSTALLERS_41_61290.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD55A64C-EEB6-49A4-957C-A90873740819}\LocalServer32	gamebrowser_1.0_lizhiheng_t101001.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32	KINSTALLERS_41_61290.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}	KINSTALLERS_41_61290.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}\InprocServer32\ = "c:\\program files (x86)\\kingsoft\\kingsoft antivirus\\kavmenu.dll"	KINSTALLERS_41_61290.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\duba_32bit	KINSTALLERS_41_61290.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idno = "1"	KINSTALLERS_41_61290.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\svrid	KINSTALLERS_41_61290.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}	kxetray.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD55A64C-EEB6-49A4-957C-A90873740819}\ = "Wiseadblock"	gamebrowser_1.0_lizhiheng_t101001.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\gamebrowser_1.0_lizhiheng_t101001.Wiseadblock\Clsid\ = "{FD55A64C-EEB6-49A4-957C-A90873740819}"	gamebrowser_1.0_lizhiheng_t101001.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32\ThreadingModel = "Apartment"	KINSTALLERS_41_61290.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\duba_64bit\ = "{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}"	KINSTALLERS_41_61290.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\duba_32bit\ = "{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}"	KINSTALLERS_41_61290.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	KINSTALLERS_41_61290.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{372B851C-71B6-4fd3-9A23-30A4D1FFF178}	kxetray.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\gamebrowser_1.0_lizhiheng_t101001.Wiseadblock\ = "Wiseadblock"	gamebrowser_1.0_lizhiheng_t101001.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gamebrowser_1.0_lizhiheng_t101001.Wiseadblock\Clsid	gamebrowser_1.0_lizhiheng_t101001.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	KINSTALLERS_41_61290.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}\InprocServer32	KINSTALLERS_41_61290.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\duba_32bit\ = "{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}"	KINSTALLERS_41_61290.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}	KINSTALLERS_41_61290.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD55A64C-EEB6-49A4-957C-A90873740819}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gamebrowser_1.0_lizhiheng_t101001.exe"	gamebrowser_1.0_lizhiheng_t101001.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD55A64C-EEB6-49A4-957C-A90873740819}\ProgID\ = "gamebrowser_1.0_lizhiheng_t101001.Wiseadblock"	gamebrowser_1.0_lizhiheng_t101001.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\Shellex\ContextMenuHandlers\duba_64bit	KINSTALLERS_41_61290.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}\ = "CKavMenuShell Class"	KINSTALLERS_41_61290.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\duba_32bit	KINSTALLERS_41_61290.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\duba_32bit	KINSTALLERS_41_61290.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories	KINSTALLERS_41_61290.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gamebrowser_1.0_lizhiheng_t101001.Wiseadblock	gamebrowser_1.0_lizhiheng_t101001.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}\InprocServer32\ = "c:\\program files (x86)\\kingsoft\\kingsoft antivirus\\kavmenu64.dll"	KINSTALLERS_41_61290.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\duba_32bit\ = "{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}"	KINSTALLERS_41_61290.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idno = "0"	KINSTALLERS_41_61290.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\svrid = "atsrx4yagi99k249x54mgpntyebf"	KINSTALLERS_41_61290.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}	kxescore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	gamebrowser_1.0_lizhiheng_t101001.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\duba_64bit\ = "{DDEA5705-1BB0-4C03-AC1E-8FF9716A0D51}"	KINSTALLERS_41_61290.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}	KINSTALLERS_41_61290.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	KINSTALLERS_41_61290.exe

Modifies system certificate store 2 TTPs 8 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	wiresion.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	wiresion.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	wiresion.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	wiresion.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	wiresion.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	wiresion.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	wiresion.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	wiresion.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1032	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1336	100004.exe
632	qh562.exe
632	qh562.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
1032	KINSTALLERS_41_61290.exe
1032	KINSTALLERS_41_61290.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe
980	svchost.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
468	Process not Found
468	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1336	100004.exe
Token: SeDebugPrivilege	1336	100004.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	1032	KINSTALLERS_41_61290.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	2608	kislive.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	2684	kxescore.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	1032	KINSTALLERS_41_61290.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: 33	556	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	556	AUDIODG.EXE
Token: 33	556	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	556	AUDIODG.EXE
Token: SeDebugPrivilege	980	svchost.exe
Token: 33	2684	kxescore.exe
Token: SeIncBasePriorityPrivilege	2684	kxescore.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe
Token: SeDebugPrivilege	980	svchost.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1572	iexplore.exe
1572	iexplore.exe
2556	kxetray.exe
2556	kxetray.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2556	kxetray.exe
2556	kxetray.exe

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
1036	CFÔÂÓ°¸¨Öú.exe
1036	CFÔÂÓ°¸¨Öú.exe
1536	wiresion.exe
1536	wiresion.exe
1536	wiresion.exe
1536	wiresion.exe
1716	gamebrowser_1.0_lizhiheng_t101001.exe
1716	gamebrowser_1.0_lizhiheng_t101001.exe
1716	gamebrowser_1.0_lizhiheng_t101001.exe
1572	iexplore.exe
1572	iexplore.exe
1672	IEXPLORE.EXE
1672	IEXPLORE.EXE
1572	iexplore.exe
1572	iexplore.exe
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE
2556	kxetray.exe
3064	kwsprotect64.exe
3064	kwsprotect64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 1036	1340	dc21e0e1092e35eb793f8dcd8d7c92166819d7081d9db4c2530d3a8522e143df.exe	27
PID 1340 wrote to memory of 1036	1340	dc21e0e1092e35eb793f8dcd8d7c92166819d7081d9db4c2530d3a8522e143df.exe	27
PID 1340 wrote to memory of 1036	1340	dc21e0e1092e35eb793f8dcd8d7c92166819d7081d9db4c2530d3a8522e143df.exe	27
PID 1340 wrote to memory of 1036	1340	dc21e0e1092e35eb793f8dcd8d7c92166819d7081d9db4c2530d3a8522e143df.exe	27
PID 1340 wrote to memory of 1036	1340	dc21e0e1092e35eb793f8dcd8d7c92166819d7081d9db4c2530d3a8522e143df.exe	27
PID 1340 wrote to memory of 1036	1340	dc21e0e1092e35eb793f8dcd8d7c92166819d7081d9db4c2530d3a8522e143df.exe	27
PID 1340 wrote to memory of 1036	1340	dc21e0e1092e35eb793f8dcd8d7c92166819d7081d9db4c2530d3a8522e143df.exe	27
PID 1036 wrote to memory of 1536	1036	CFÔÂÓ°¸¨Öú.exe	28
PID 1036 wrote to memory of 1536	1036	CFÔÂÓ°¸¨Öú.exe	28
PID 1036 wrote to memory of 1536	1036	CFÔÂÓ°¸¨Öú.exe	28
PID 1036 wrote to memory of 1536	1036	CFÔÂÓ°¸¨Öú.exe	28
PID 1036 wrote to memory of 1536	1036	CFÔÂÓ°¸¨Öú.exe	28
PID 1036 wrote to memory of 1536	1036	CFÔÂÓ°¸¨Öú.exe	28
PID 1036 wrote to memory of 1536	1036	CFÔÂÓ°¸¨Öú.exe	28
PID 1036 wrote to memory of 792	1036	CFÔÂÓ°¸¨Öú.exe	29
PID 1036 wrote to memory of 792	1036	CFÔÂÓ°¸¨Öú.exe	29
PID 1036 wrote to memory of 792	1036	CFÔÂÓ°¸¨Öú.exe	29
PID 1036 wrote to memory of 792	1036	CFÔÂÓ°¸¨Öú.exe	29
PID 1036 wrote to memory of 792	1036	CFÔÂÓ°¸¨Öú.exe	29
PID 1036 wrote to memory of 792	1036	CFÔÂÓ°¸¨Öú.exe	29
PID 1036 wrote to memory of 792	1036	CFÔÂÓ°¸¨Öú.exe	29
PID 1036 wrote to memory of 1716	1036	CFÔÂÓ°¸¨Öú.exe	30
PID 1036 wrote to memory of 1716	1036	CFÔÂÓ°¸¨Öú.exe	30
PID 1036 wrote to memory of 1716	1036	CFÔÂÓ°¸¨Öú.exe	30
PID 1036 wrote to memory of 1716	1036	CFÔÂÓ°¸¨Öú.exe	30
PID 1036 wrote to memory of 1716	1036	CFÔÂÓ°¸¨Öú.exe	30
PID 1036 wrote to memory of 1716	1036	CFÔÂÓ°¸¨Öú.exe	30
PID 1036 wrote to memory of 1716	1036	CFÔÂÓ°¸¨Öú.exe	30
PID 1036 wrote to memory of 1336	1036	CFÔÂÓ°¸¨Öú.exe	31
PID 1036 wrote to memory of 1336	1036	CFÔÂÓ°¸¨Öú.exe	31
PID 1036 wrote to memory of 1336	1036	CFÔÂÓ°¸¨Öú.exe	31
PID 1036 wrote to memory of 1336	1036	CFÔÂÓ°¸¨Öú.exe	31
PID 1036 wrote to memory of 1336	1036	CFÔÂÓ°¸¨Öú.exe	31
PID 1036 wrote to memory of 1336	1036	CFÔÂÓ°¸¨Öú.exe	31
PID 1036 wrote to memory of 1336	1036	CFÔÂÓ°¸¨Öú.exe	31
PID 1036 wrote to memory of 632	1036	CFÔÂÓ°¸¨Öú.exe	33
PID 1036 wrote to memory of 632	1036	CFÔÂÓ°¸¨Öú.exe	33
PID 1036 wrote to memory of 632	1036	CFÔÂÓ°¸¨Öú.exe	33
PID 1036 wrote to memory of 632	1036	CFÔÂÓ°¸¨Öú.exe	33
PID 1036 wrote to memory of 632	1036	CFÔÂÓ°¸¨Öú.exe	33
PID 1036 wrote to memory of 632	1036	CFÔÂÓ°¸¨Öú.exe	33
PID 1036 wrote to memory of 632	1036	CFÔÂÓ°¸¨Öú.exe	33
PID 1336 wrote to memory of 980	1336	100004.exe	32
PID 1336 wrote to memory of 980	1336	100004.exe	32
PID 1336 wrote to memory of 980	1336	100004.exe	32
PID 1336 wrote to memory of 980	1336	100004.exe	32
PID 1336 wrote to memory of 980	1336	100004.exe	32
PID 1336 wrote to memory of 980	1336	100004.exe	32
PID 1336 wrote to memory of 980	1336	100004.exe	32
PID 1336 wrote to memory of 980	1336	100004.exe	32
PID 1336 wrote to memory of 1492	1336	100004.exe	35
PID 1336 wrote to memory of 1492	1336	100004.exe	35
PID 1336 wrote to memory of 1492	1336	100004.exe	35
PID 1336 wrote to memory of 1492	1336	100004.exe	35
PID 1336 wrote to memory of 1492	1336	100004.exe	35
PID 1336 wrote to memory of 1492	1336	100004.exe	35
PID 1336 wrote to memory of 1492	1336	100004.exe	35
PID 1340 wrote to memory of 1572	1340	dc21e0e1092e35eb793f8dcd8d7c92166819d7081d9db4c2530d3a8522e143df.exe	36
PID 1340 wrote to memory of 1572	1340	dc21e0e1092e35eb793f8dcd8d7c92166819d7081d9db4c2530d3a8522e143df.exe	36
PID 1340 wrote to memory of 1572	1340	dc21e0e1092e35eb793f8dcd8d7c92166819d7081d9db4c2530d3a8522e143df.exe	36
PID 1340 wrote to memory of 1572	1340	dc21e0e1092e35eb793f8dcd8d7c92166819d7081d9db4c2530d3a8522e143df.exe	36
PID 1492 wrote to memory of 1032	1492	cmd.exe	38
PID 1492 wrote to memory of 1032	1492	cmd.exe	38
PID 1492 wrote to memory of 1032	1492	cmd.exe	38

C:\Users\Admin\AppData\Local\Temp\dc21e0e1092e35eb793f8dcd8d7c92166819d7081d9db4c2530d3a8522e143df.exe
"C:\Users\Admin\AppData\Local\Temp\dc21e0e1092e35eb793f8dcd8d7c92166819d7081d9db4c2530d3a8522e143df.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Users\Admin\AppData\Local\Temp\CFÔÂÓ°¸¨Öú.exe
  "C:\Users\Admin\AppData\Local\Temp\CFÔÂÓ°¸¨Öú.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1036
- - C:\Users\Admin\AppData\Local\Temp\wiresion.exe
    "C:\Users\Admin\AppData\Local\Temp\wiresion.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies Internet Explorer settings
    - Modifies system certificate store
    - Suspicious use of SetWindowsHookEx
    PID:1536
- - C:\Users\Admin\AppData\Local\Temp\KINSTALLERS_41_61290.exe
    "C:\Users\Admin\AppData\Local\Temp\KINSTALLERS_41_61290.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:792
  - - C:\Users\Admin\AppData\Local\Temp\kingsoftkonline\KINSTALLERS_41_61290.exe
      "C:\Users\Admin\AppData\Local\Temp\kingsoftkonline\KINSTALLERS_41_61290.exe" /s
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      Registers COM server for autorun
      Sets file execution options in registry
      Loads dropped DLL
      Adds Run key to start application
      Drops desktop.ini file(s)
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1032
    - - \??\c:\program files (x86)\kingsoft\kingsoft antivirus\kavlog2.exe
        
        "c:\program files (x86)\kingsoft\kingsoft antivirus\kavlog2.exe" -install
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2536
    - - \??\c:\program files (x86)\kingsoft\kingsoft antivirus\kislive.exe
        
        "c:\program files (x86)\kingsoft\kingsoft antivirus\kislive.exe" /autorun /std /skipcs3
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2608
    - - \??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe
        
        "c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe" /start kxescore
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2588
    - - \??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxetray.exe
        
        "c:\program files (x86)\kingsoft\kingsoft antivirus\kxetray.exe" /autorun
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        Drops file in Program Files directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2556
      - \??\c:\program files (x86)\kingsoft\kingsoft antivirus\kwsprotect64.exe
        
        "c:\program files (x86)\kingsoft\kingsoft antivirus\kwsprotect64.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3064
- - C:\Users\Admin\AppData\Local\Temp\gamebrowser_1.0_lizhiheng_t101001.exe
    "C:\Users\Admin\AppData\Local\Temp\gamebrowser_1.0_lizhiheng_t101001.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:1716
  - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
      4⤵
      PID:2184
    - - C:\Program Files\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
        5⤵
        
        PID:2200
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 312
        5⤵
        Program crash
        
        PID:2228
- - C:\Users\Admin\AppData\Local\Temp\100004.exe
    "C:\Users\Admin\AppData\Local\Temp\100004.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1336
  - - C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe -k ImgSvc
      4⤵
      Modifies Internet Explorer settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:980
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\6798.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1492
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 1.0.0.1 -n
        5⤵
        Runs ping.exe
        
        PID:1032
- - C:\Users\Admin\AppData\Local\Temp\qh562.exe
    "C:\Users\Admin\AppData\Local\Temp\qh562.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:632
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.yxdown.com/ads/88.html
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:1572
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1572 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1672
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 972
      4⤵
      Program crash
      PID:1768
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1572 CREDAT:275460 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2252
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 1088
      4⤵
      Program crash
      PID:2336

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x460
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:556

\??\c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe
"c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe" /service kxescore
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Sets service image path in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2684

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\kingsoft\kingsoft antivirus\kavlog2.exe

Filesize
490KB

MD5
9b773fe403c07b1126c48784e51fe223

SHA1
6f0bdd3b5bfd2cab7a859bf395f57728f808b776

SHA256
99fe3741defcff0910dc415e382c6a58c8fd84617c7b219c2160aa8f54ffa7d1

SHA512
13a898b86bb0990181655e9de35f48fe418b3238bdc00f917cca727fcdbfbc661d3cee95da06b32970d259a6e3e1b70e0df02cf75ed530397154a55627a6dbf1

Download Submit
C:\Program Files (x86)\kingsoft\kingsoft antivirus\kxetray.exe

Filesize
1.2MB

MD5
593a7177f156c406753edfc59fd0fa17

SHA1
93d9c1e294779cdfe14be6d9659831b5d396c008

SHA256
bfbf5845aa4a3e62ca308fda905e7469bc0b9a21c03b02c5e5bdeaedfe3e508b

SHA512
444aedd05fa9034a7801a3df6f41d23d4dcab84e89289f7f2df1cc1dcec74e38703c22ac65e88559159adc70055a6f4e22e1e934d6266667e522952b4499d395

Download Submit
C:\Users\Admin\AppData\Local\Temp\100004.exe

Filesize
164KB

MD5
5f2b117fc1e25d9106adb8a1c4f91100

SHA1
eb7bf762f7e9a26d8776151be141cbf4bdc47431

SHA256
2dbdcddf1fb86e54ab972b45ce80f5efb2aad1d47c0253f9c5fba9fee0869344

SHA512
6c17b0b36159af00b38d1266430d7b40934e459f317bbf5e79f672f41003102a16aadbc611c6d6009664916112b2ecda5a997683f50e9a1db92bf38ab5439f69

Download Submit
C:\Users\Admin\AppData\Local\Temp\100004.exe

Filesize
164KB

MD5
5f2b117fc1e25d9106adb8a1c4f91100

SHA1
eb7bf762f7e9a26d8776151be141cbf4bdc47431

SHA256
2dbdcddf1fb86e54ab972b45ce80f5efb2aad1d47c0253f9c5fba9fee0869344

SHA512
6c17b0b36159af00b38d1266430d7b40934e459f317bbf5e79f672f41003102a16aadbc611c6d6009664916112b2ecda5a997683f50e9a1db92bf38ab5439f69

Download Submit
C:\Users\Admin\AppData\Local\Temp\6798.bat

Filesize
139B

MD5
d7396e40868d73454e58fb02b95a6dc0

SHA1
427a73026e82931ddbc3a535b45d71e04fa6fa0e

SHA256
e2a4096b5dcdd2405239953e60ea67ae21542011b9ae34b5406d059e16642537

SHA512
7fda87ffeb13d0ca6d32ad8715651e18b901e677870451dfcd64efb061367bcec7c5e8a22cd3fe8393fbae0dc65dd239c774b66d1482569f8c244e9eaf3fc250

Download Submit
C:\Users\Admin\AppData\Local\Temp\CFÔÂÓ°¸¨Öú.exe

Filesize
1.6MB

MD5
1ffcd2a1e7108325a14843177d9e5fb2

SHA1
abe3c3b150f2a6b6e6414adacf7f0262beaac88d

SHA256
079af3610fc3461abc16b96aefb71d2ea00650e91413af4732bb5cc992f8c919

SHA512
2abb090078904d7dc306cf114a0dcbfcb25d49301ffa3877aab68337505ea78c982fde4df497dccc49f7c7a39b5b975bf15b54eb4a95bef1bb7494522bc989dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\CFÔÂÓ°¸¨Öú.exe

Filesize
1.6MB

MD5
1ffcd2a1e7108325a14843177d9e5fb2

SHA1
abe3c3b150f2a6b6e6414adacf7f0262beaac88d

SHA256
079af3610fc3461abc16b96aefb71d2ea00650e91413af4732bb5cc992f8c919

SHA512
2abb090078904d7dc306cf114a0dcbfcb25d49301ffa3877aab68337505ea78c982fde4df497dccc49f7c7a39b5b975bf15b54eb4a95bef1bb7494522bc989dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\KINSTALLERS_41_61290.exe

Filesize
58KB

MD5
9ecaacff7e457daf105b7636990894b7

SHA1
bb32605d694d43e612118aacb3aabb1ba075d792

SHA256
8ff0f987b41dbff6397f12e09f557f5906addc0c42d88e6438fccc48a67f766d

SHA512
9561dafaa3e602d6a2378f1d3b64fe618635466286fc00519ab6ba467beb6a20a2fd07ef81ce2ad0ae6927b02ff64e74c4fce39f37f5a8c16be292efb83f9937

Download Submit
C:\Users\Admin\AppData\Local\Temp\KINSTALLERS_41_61290.exe

Filesize
58KB

MD5
9ecaacff7e457daf105b7636990894b7

SHA1
bb32605d694d43e612118aacb3aabb1ba075d792

SHA256
8ff0f987b41dbff6397f12e09f557f5906addc0c42d88e6438fccc48a67f766d

SHA512
9561dafaa3e602d6a2378f1d3b64fe618635466286fc00519ab6ba467beb6a20a2fd07ef81ce2ad0ae6927b02ff64e74c4fce39f37f5a8c16be292efb83f9937

Download Submit
C:\Users\Admin\AppData\Local\Temp\gamebrowser_1.0_lizhiheng_t101001.exe

Filesize
696KB

MD5
34bfd5c2c0b1a33088041b7b664547fc

SHA1
9b66d1125f000c013bf7fbbb7e476ad86b12fe45

SHA256
f0a764e79e5c134d5a69116cd7f924a6d9f07004f37352a7d2c1ab2dce07882e

SHA512
3b3f19b98127602e3772c70073e3ef924d878789939710078f97715d275690b3d8d8dc34426a693e1f61b91fc645227bc6226e7c922afa84ec1816ba5d9204d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\gamebrowser_1.0_lizhiheng_t101001.exe

Filesize
696KB

MD5
34bfd5c2c0b1a33088041b7b664547fc

SHA1
9b66d1125f000c013bf7fbbb7e476ad86b12fe45

SHA256
f0a764e79e5c134d5a69116cd7f924a6d9f07004f37352a7d2c1ab2dce07882e

SHA512
3b3f19b98127602e3772c70073e3ef924d878789939710078f97715d275690b3d8d8dc34426a693e1f61b91fc645227bc6226e7c922afa84ec1816ba5d9204d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\kingsoftkonline\KINSTALLERS_41_61290.exe

Filesize
18.6MB

MD5
17a5fa01284ef8399c1580068558309a

SHA1
f744acb56cfc0212fbf8ef650fca9c1c645c0adf

SHA256
c832fc639f4ad9ea2430950d6faff924943da80725b4c31f9b8188a94017b288

SHA512
0e7d46e265e19faf051277f5ee0c0e8ab8bdc3eb49068872496667623a2147f2c9bf043f121770fdca477b5a6cc634414bcce5076676b6e9b5c30ea445e5ce30

Download Submit
C:\Users\Admin\AppData\Local\Temp\kingsoftkonline\KINSTALLERS_41_61290.exe

Filesize
18.6MB

MD5
17a5fa01284ef8399c1580068558309a

SHA1
f744acb56cfc0212fbf8ef650fca9c1c645c0adf

SHA256
c832fc639f4ad9ea2430950d6faff924943da80725b4c31f9b8188a94017b288

SHA512
0e7d46e265e19faf051277f5ee0c0e8ab8bdc3eb49068872496667623a2147f2c9bf043f121770fdca477b5a6cc634414bcce5076676b6e9b5c30ea445e5ce30

Download Submit
C:\Users\Admin\AppData\Local\Temp\qh562.exe

Filesize
59KB

MD5
44c3de360a309aba151ae9d1cc2b6773

SHA1
0704ce76d5ab8b747b9319ba928aad5c0e1510d7

SHA256
4b0d92abe91c80afe1acf4ea2a7c04af43db0bb4a5e845e936580f4d56679c84

SHA512
1ac16f1e71c037ed121691f07ecf1949b9a12decbd18446eda0fd512a2389b6ba9b9c39f365f08b7edc7c65865516d98eafc7f1a9a2b9958ef5ad22a086ffff7

Download Submit
C:\Users\Admin\AppData\Local\Temp\qh562.exe

Filesize
59KB

MD5
44c3de360a309aba151ae9d1cc2b6773

SHA1
0704ce76d5ab8b747b9319ba928aad5c0e1510d7

SHA256
4b0d92abe91c80afe1acf4ea2a7c04af43db0bb4a5e845e936580f4d56679c84

SHA512
1ac16f1e71c037ed121691f07ecf1949b9a12decbd18446eda0fd512a2389b6ba9b9c39f365f08b7edc7c65865516d98eafc7f1a9a2b9958ef5ad22a086ffff7

Download Submit
C:\Users\Admin\AppData\Local\Temp\wiresion.exe

Filesize
466KB

MD5
34c896e9d15df09c31badd1be5e0086f

SHA1
fe2438b5652ca75a46349fd3dc37ee89818b8336

SHA256
7f400f1e9073952352581ddf3b2822998b9a2912495c945b21ca625d52d676dd

SHA512
3a72f6e828f05ac9a5032f7063b52b687c4234e768c5b130e826405312e6e2dbcd003f8abf10da46692f4f563219dbfb66e9ed8d8b86cdad0f28141bbaebe00e

Download Submit
C:\Users\Admin\AppData\Local\Temp\wiresion.exe

Filesize
466KB

MD5
34c896e9d15df09c31badd1be5e0086f

SHA1
fe2438b5652ca75a46349fd3dc37ee89818b8336

SHA256
7f400f1e9073952352581ddf3b2822998b9a2912495c945b21ca625d52d676dd

SHA512
3a72f6e828f05ac9a5032f7063b52b687c4234e768c5b130e826405312e6e2dbcd003f8abf10da46692f4f563219dbfb66e9ed8d8b86cdad0f28141bbaebe00e

Download Submit
\??\c:\program files (x86)\kingsoft\kingsoft antivirus\MSVCR80.dll

Filesize
612KB

MD5
e4fece18310e23b1d8fee993e35e7a6f

SHA1
9fd3a7f0522d36c2bf0e64fc510c6eea3603b564

SHA256
02bdde38e4c6bd795a092d496b8d6060cdbe71e22ef4d7a204e3050c1be44fa9

SHA512
2fb5f8d63a39ba5e93505df3a643d14e286fe34b11984cbed4b88e8a07517c03efb3a7bf9d61cf1ec73b0a20d83f9e6068e61950a61d649b8d36082bb034ddfc

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kavlog2.exe

Filesize
490KB

MD5
9b773fe403c07b1126c48784e51fe223

SHA1
6f0bdd3b5bfd2cab7a859bf395f57728f808b776

SHA256
99fe3741defcff0910dc415e382c6a58c8fd84617c7b219c2160aa8f54ffa7d1

SHA512
13a898b86bb0990181655e9de35f48fe418b3238bdc00f917cca727fcdbfbc661d3cee95da06b32970d259a6e3e1b70e0df02cf75ed530397154a55627a6dbf1

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kavlog2.exe

Filesize
490KB

MD5
9b773fe403c07b1126c48784e51fe223

SHA1
6f0bdd3b5bfd2cab7a859bf395f57728f808b776

SHA256
99fe3741defcff0910dc415e382c6a58c8fd84617c7b219c2160aa8f54ffa7d1

SHA512
13a898b86bb0990181655e9de35f48fe418b3238bdc00f917cca727fcdbfbc661d3cee95da06b32970d259a6e3e1b70e0df02cf75ed530397154a55627a6dbf1

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kavmenu.dll

Filesize
43KB

MD5
d32bef39d9e1439a1331e806cdf18f9f

SHA1
cc853d2fc89e779b541835d035fd05fa7cc339f2

SHA256
25bba853799d7681bcbe8258a7777d8faf7e0a41645cbaa1fc702c4e222fd712

SHA512
b0f7182a5e14d946ee69ce6f24271db08acfc457a0e71eb9dd242d812fd3c3210f382d9b3117ed9594ba43d9994324eb2b840214bfbbacbb78a77d6b81a04a17

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kismain.exe

Filesize
48KB

MD5
4c4f23290c3be3b0316c76879a6e2a7f

SHA1
1cd2667fe62b42b2476ea6da22b93c565369dc0f

SHA256
1ca3e7064d9dd86c42f62286b958db26065272fccd9fb37416b64981e2d28de0

SHA512
8e14538656a778411746917c545a964485683c403684bde4a2ee0d09c1760ca00f1d10cf2cb0e875edc624ba0bbe3636f68b24fdf50aeb26d482dda9c4b9ae3a

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kismain.exe

Filesize
48KB

MD5
4c4f23290c3be3b0316c76879a6e2a7f

SHA1
1cd2667fe62b42b2476ea6da22b93c565369dc0f

SHA256
1ca3e7064d9dd86c42f62286b958db26065272fccd9fb37416b64981e2d28de0

SHA512
8e14538656a778411746917c545a964485683c403684bde4a2ee0d09c1760ca00f1d10cf2cb0e875edc624ba0bbe3636f68b24fdf50aeb26d482dda9c4b9ae3a

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\krecycle.exe

Filesize
466KB

MD5
5de709d7b66526520395c869a09e7398

SHA1
5a3413ec8b6b240bf3c6163458d104ac79618b0e

SHA256
c2a92dd073d393bd934bda4192dd76803dbc3b9d20b7ba02b1454ff4b31aac2f

SHA512
634f47b809aacb1f53fcbaacaf304c1f65dd133c761b9614b110574d1392205cbfec06272cdc28f6276dcbe1d4f82d7f2fe97a3f233bf419352e7365efaaf93e

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kxescore.exe

Filesize
164KB

MD5
5caa87154c5e49499b03341fe0a9203e

SHA1
276aa388cac4acf4abe2c309d6526c80883c8d94

SHA256
0d7d445b6c864c3c8e3a4e92a10ef5b8d5b40737aa58126fb836aacd993cfdf6

SHA512
211eab4d0a645fdf2a5f7eb8971d8f08ce00c9b6b127b79ef6afd40481ff0cc17205785d4befecc03a1d4258fc54bc924e5ad572f7b94ffa3a98d931a48b657e

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kxetray.exe

Filesize
1.2MB

MD5
593a7177f156c406753edfc59fd0fa17

SHA1
93d9c1e294779cdfe14be6d9659831b5d396c008

SHA256
bfbf5845aa4a3e62ca308fda905e7469bc0b9a21c03b02c5e5bdeaedfe3e508b

SHA512
444aedd05fa9034a7801a3df6f41d23d4dcab84e89289f7f2df1cc1dcec74e38703c22ac65e88559159adc70055a6f4e22e1e934d6266667e522952b4499d395

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\kxetray.exe

Filesize
1.2MB

MD5
593a7177f156c406753edfc59fd0fa17

SHA1
93d9c1e294779cdfe14be6d9659831b5d396c008

SHA256
bfbf5845aa4a3e62ca308fda905e7469bc0b9a21c03b02c5e5bdeaedfe3e508b

SHA512
444aedd05fa9034a7801a3df6f41d23d4dcab84e89289f7f2df1cc1dcec74e38703c22ac65e88559159adc70055a6f4e22e1e934d6266667e522952b4499d395

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\security\kavbootc.sys

Filesize
26KB

MD5
a16b3c62473f0eb6b25d3fe01d94d20a

SHA1
574228836ef2bd07d128108ee2cbb372cbf7a4a8

SHA256
e115909cb4707f1895e69ef9e608ff8ee10fead21ac1c6c7b3148fc998e2355d

SHA512
a07bd7312bda0062b5e45d84b3494a3912a014ae4c50e69f57895f5625c14498bd38104087020b51f745be3ff2a86bb0c27313c6dbb8969765ffe28225ca3fb6

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\security\kavbootc.sys

Filesize
26KB

MD5
a16b3c62473f0eb6b25d3fe01d94d20a

SHA1
574228836ef2bd07d128108ee2cbb372cbf7a4a8

SHA256
e115909cb4707f1895e69ef9e608ff8ee10fead21ac1c6c7b3148fc998e2355d

SHA512
a07bd7312bda0062b5e45d84b3494a3912a014ae4c50e69f57895f5625c14498bd38104087020b51f745be3ff2a86bb0c27313c6dbb8969765ffe28225ca3fb6

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\security\ksde\kisknl.sys

Filesize
177KB

MD5
633eb9d80d2d9db7eaeb6860bc6bec6e

SHA1
442daec6ff786e64cc0cecd2a581bd50fedf905a

SHA256
0ca2860e25746409b786db01104e823d5d2386b726602f09fdae885e7bdb389c

SHA512
6b0f47ceba0ae4f61c4b5c3ec2435e6d36fb9bb74a220ce4da1e3d9233d5136d795c69949093f46c0249d806383c32e729db27eccd00bd9b5dc7f40a074126c7

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\security\ksde\kisknl.sys

Filesize
177KB

MD5
633eb9d80d2d9db7eaeb6860bc6bec6e

SHA1
442daec6ff786e64cc0cecd2a581bd50fedf905a

SHA256
0ca2860e25746409b786db01104e823d5d2386b726602f09fdae885e7bdb389c

SHA512
6b0f47ceba0ae4f61c4b5c3ec2435e6d36fb9bb74a220ce4da1e3d9233d5136d795c69949093f46c0249d806383c32e729db27eccd00bd9b5dc7f40a074126c7

Download Submit
\Program Files (x86)\kingsoft\kingsoft antivirus\uni0nst.exe

Filesize
1.0MB

MD5
6107de5d840803f1145620cb74c5407d

SHA1
050699ad40120f10cb936b276b4627868bcf3dab

SHA256
28a11841a177031a608140e21626fd44b029c54659c9d40dc63e30b38058c625

SHA512
e6346be1171094386ddde18ad4736bfff7d75c312d58e8fc942a262edc15435b2fa79a9c515984dc8a2086ccefae8d1c071e30ddc12c2a4905bd27497b199f2a

Download Submit
\Users\Admin\AppData\Local\Temp\100004.exe

Filesize
164KB

MD5
5f2b117fc1e25d9106adb8a1c4f91100

SHA1
eb7bf762f7e9a26d8776151be141cbf4bdc47431

SHA256
2dbdcddf1fb86e54ab972b45ce80f5efb2aad1d47c0253f9c5fba9fee0869344

SHA512
6c17b0b36159af00b38d1266430d7b40934e459f317bbf5e79f672f41003102a16aadbc611c6d6009664916112b2ecda5a997683f50e9a1db92bf38ab5439f69

Download Submit
\Users\Admin\AppData\Local\Temp\100004.exe

Filesize
164KB

MD5
5f2b117fc1e25d9106adb8a1c4f91100

SHA1
eb7bf762f7e9a26d8776151be141cbf4bdc47431

SHA256
2dbdcddf1fb86e54ab972b45ce80f5efb2aad1d47c0253f9c5fba9fee0869344

SHA512
6c17b0b36159af00b38d1266430d7b40934e459f317bbf5e79f672f41003102a16aadbc611c6d6009664916112b2ecda5a997683f50e9a1db92bf38ab5439f69

Download Submit
\Users\Admin\AppData\Local\Temp\100004.exe

Filesize
164KB

MD5
5f2b117fc1e25d9106adb8a1c4f91100

SHA1
eb7bf762f7e9a26d8776151be141cbf4bdc47431

SHA256
2dbdcddf1fb86e54ab972b45ce80f5efb2aad1d47c0253f9c5fba9fee0869344

SHA512
6c17b0b36159af00b38d1266430d7b40934e459f317bbf5e79f672f41003102a16aadbc611c6d6009664916112b2ecda5a997683f50e9a1db92bf38ab5439f69

Download Submit
\Users\Admin\AppData\Local\Temp\100004.exe

Filesize
164KB

MD5
5f2b117fc1e25d9106adb8a1c4f91100

SHA1
eb7bf762f7e9a26d8776151be141cbf4bdc47431

SHA256
2dbdcddf1fb86e54ab972b45ce80f5efb2aad1d47c0253f9c5fba9fee0869344

SHA512
6c17b0b36159af00b38d1266430d7b40934e459f317bbf5e79f672f41003102a16aadbc611c6d6009664916112b2ecda5a997683f50e9a1db92bf38ab5439f69

Download Submit
\Users\Admin\AppData\Local\Temp\100004.exe

Filesize
164KB

MD5
5f2b117fc1e25d9106adb8a1c4f91100

SHA1
eb7bf762f7e9a26d8776151be141cbf4bdc47431

SHA256
2dbdcddf1fb86e54ab972b45ce80f5efb2aad1d47c0253f9c5fba9fee0869344

SHA512
6c17b0b36159af00b38d1266430d7b40934e459f317bbf5e79f672f41003102a16aadbc611c6d6009664916112b2ecda5a997683f50e9a1db92bf38ab5439f69

Download Submit
\Users\Admin\AppData\Local\Temp\CFÔÂÓ°¸¨Öú.exe

Filesize
1.6MB

MD5
1ffcd2a1e7108325a14843177d9e5fb2

SHA1
abe3c3b150f2a6b6e6414adacf7f0262beaac88d

SHA256
079af3610fc3461abc16b96aefb71d2ea00650e91413af4732bb5cc992f8c919

SHA512
2abb090078904d7dc306cf114a0dcbfcb25d49301ffa3877aab68337505ea78c982fde4df497dccc49f7c7a39b5b975bf15b54eb4a95bef1bb7494522bc989dd

Download Submit
\Users\Admin\AppData\Local\Temp\CFÔÂÓ°¸¨Öú.exe

Filesize
1.6MB

MD5
1ffcd2a1e7108325a14843177d9e5fb2

SHA1
abe3c3b150f2a6b6e6414adacf7f0262beaac88d

SHA256
079af3610fc3461abc16b96aefb71d2ea00650e91413af4732bb5cc992f8c919

SHA512
2abb090078904d7dc306cf114a0dcbfcb25d49301ffa3877aab68337505ea78c982fde4df497dccc49f7c7a39b5b975bf15b54eb4a95bef1bb7494522bc989dd

Download Submit
\Users\Admin\AppData\Local\Temp\CFÔÂÓ°¸¨Öú.exe

Filesize
1.6MB

MD5
1ffcd2a1e7108325a14843177d9e5fb2

SHA1
abe3c3b150f2a6b6e6414adacf7f0262beaac88d

SHA256
079af3610fc3461abc16b96aefb71d2ea00650e91413af4732bb5cc992f8c919

SHA512
2abb090078904d7dc306cf114a0dcbfcb25d49301ffa3877aab68337505ea78c982fde4df497dccc49f7c7a39b5b975bf15b54eb4a95bef1bb7494522bc989dd

Download Submit
\Users\Admin\AppData\Local\Temp\CFÔÂÓ°¸¨Öú.exe

Filesize
1.6MB

MD5
1ffcd2a1e7108325a14843177d9e5fb2

SHA1
abe3c3b150f2a6b6e6414adacf7f0262beaac88d

SHA256
079af3610fc3461abc16b96aefb71d2ea00650e91413af4732bb5cc992f8c919

SHA512
2abb090078904d7dc306cf114a0dcbfcb25d49301ffa3877aab68337505ea78c982fde4df497dccc49f7c7a39b5b975bf15b54eb4a95bef1bb7494522bc989dd

Download Submit
\Users\Admin\AppData\Local\Temp\CFÔÂÓ°¸¨Öú.exe

Filesize
1.6MB

MD5
1ffcd2a1e7108325a14843177d9e5fb2

SHA1
abe3c3b150f2a6b6e6414adacf7f0262beaac88d

SHA256
079af3610fc3461abc16b96aefb71d2ea00650e91413af4732bb5cc992f8c919

SHA512
2abb090078904d7dc306cf114a0dcbfcb25d49301ffa3877aab68337505ea78c982fde4df497dccc49f7c7a39b5b975bf15b54eb4a95bef1bb7494522bc989dd

Download Submit
\Users\Admin\AppData\Local\Temp\KINSTALLERS_41_61290.exe

Filesize
58KB

MD5
9ecaacff7e457daf105b7636990894b7

SHA1
bb32605d694d43e612118aacb3aabb1ba075d792

SHA256
8ff0f987b41dbff6397f12e09f557f5906addc0c42d88e6438fccc48a67f766d

SHA512
9561dafaa3e602d6a2378f1d3b64fe618635466286fc00519ab6ba467beb6a20a2fd07ef81ce2ad0ae6927b02ff64e74c4fce39f37f5a8c16be292efb83f9937

Download Submit
\Users\Admin\AppData\Local\Temp\KINSTALLERS_41_61290.exe

Filesize
58KB

MD5
9ecaacff7e457daf105b7636990894b7

SHA1
bb32605d694d43e612118aacb3aabb1ba075d792

SHA256
8ff0f987b41dbff6397f12e09f557f5906addc0c42d88e6438fccc48a67f766d

SHA512
9561dafaa3e602d6a2378f1d3b64fe618635466286fc00519ab6ba467beb6a20a2fd07ef81ce2ad0ae6927b02ff64e74c4fce39f37f5a8c16be292efb83f9937

Download Submit
\Users\Admin\AppData\Local\Temp\KINSTALLERS_41_61290.exe

Filesize
58KB

MD5
9ecaacff7e457daf105b7636990894b7

SHA1
bb32605d694d43e612118aacb3aabb1ba075d792

SHA256
8ff0f987b41dbff6397f12e09f557f5906addc0c42d88e6438fccc48a67f766d

SHA512
9561dafaa3e602d6a2378f1d3b64fe618635466286fc00519ab6ba467beb6a20a2fd07ef81ce2ad0ae6927b02ff64e74c4fce39f37f5a8c16be292efb83f9937

Download Submit
\Users\Admin\AppData\Local\Temp\KINSTALLERS_41_61290.exe

Filesize
58KB

MD5
9ecaacff7e457daf105b7636990894b7

SHA1
bb32605d694d43e612118aacb3aabb1ba075d792

SHA256
8ff0f987b41dbff6397f12e09f557f5906addc0c42d88e6438fccc48a67f766d

SHA512
9561dafaa3e602d6a2378f1d3b64fe618635466286fc00519ab6ba467beb6a20a2fd07ef81ce2ad0ae6927b02ff64e74c4fce39f37f5a8c16be292efb83f9937

Download Submit
\Users\Admin\AppData\Local\Temp\gamebrowser_1.0_lizhiheng_t101001.exe

Filesize
696KB

MD5
34bfd5c2c0b1a33088041b7b664547fc

SHA1
9b66d1125f000c013bf7fbbb7e476ad86b12fe45

SHA256
f0a764e79e5c134d5a69116cd7f924a6d9f07004f37352a7d2c1ab2dce07882e

SHA512
3b3f19b98127602e3772c70073e3ef924d878789939710078f97715d275690b3d8d8dc34426a693e1f61b91fc645227bc6226e7c922afa84ec1816ba5d9204d0

Download Submit
\Users\Admin\AppData\Local\Temp\gamebrowser_1.0_lizhiheng_t101001.exe

Filesize
696KB

MD5
34bfd5c2c0b1a33088041b7b664547fc

SHA1
9b66d1125f000c013bf7fbbb7e476ad86b12fe45

SHA256
f0a764e79e5c134d5a69116cd7f924a6d9f07004f37352a7d2c1ab2dce07882e

SHA512
3b3f19b98127602e3772c70073e3ef924d878789939710078f97715d275690b3d8d8dc34426a693e1f61b91fc645227bc6226e7c922afa84ec1816ba5d9204d0

Download Submit
\Users\Admin\AppData\Local\Temp\gamebrowser_1.0_lizhiheng_t101001.exe

Filesize
696KB

MD5
34bfd5c2c0b1a33088041b7b664547fc

SHA1
9b66d1125f000c013bf7fbbb7e476ad86b12fe45

SHA256
f0a764e79e5c134d5a69116cd7f924a6d9f07004f37352a7d2c1ab2dce07882e

SHA512
3b3f19b98127602e3772c70073e3ef924d878789939710078f97715d275690b3d8d8dc34426a693e1f61b91fc645227bc6226e7c922afa84ec1816ba5d9204d0

Download Submit
\Users\Admin\AppData\Local\Temp\kingsoftkonline\KINSTALLERS_41_61290.exe

Filesize
18.6MB

MD5
17a5fa01284ef8399c1580068558309a

SHA1
f744acb56cfc0212fbf8ef650fca9c1c645c0adf

SHA256
c832fc639f4ad9ea2430950d6faff924943da80725b4c31f9b8188a94017b288

SHA512
0e7d46e265e19faf051277f5ee0c0e8ab8bdc3eb49068872496667623a2147f2c9bf043f121770fdca477b5a6cc634414bcce5076676b6e9b5c30ea445e5ce30

Download Submit
\Users\Admin\AppData\Local\Temp\kingsoftkonline\KINSTALLERS_41_61290.exe

Filesize
18.6MB

MD5
17a5fa01284ef8399c1580068558309a

SHA1
f744acb56cfc0212fbf8ef650fca9c1c645c0adf

SHA256
c832fc639f4ad9ea2430950d6faff924943da80725b4c31f9b8188a94017b288

SHA512
0e7d46e265e19faf051277f5ee0c0e8ab8bdc3eb49068872496667623a2147f2c9bf043f121770fdca477b5a6cc634414bcce5076676b6e9b5c30ea445e5ce30

Download Submit
\Users\Admin\AppData\Local\Temp\kingsoftkonline\KINSTALLERS_41_61290.exe

Filesize
18.6MB

MD5
17a5fa01284ef8399c1580068558309a

SHA1
f744acb56cfc0212fbf8ef650fca9c1c645c0adf

SHA256
c832fc639f4ad9ea2430950d6faff924943da80725b4c31f9b8188a94017b288

SHA512
0e7d46e265e19faf051277f5ee0c0e8ab8bdc3eb49068872496667623a2147f2c9bf043f121770fdca477b5a6cc634414bcce5076676b6e9b5c30ea445e5ce30

Download Submit
\Users\Admin\AppData\Local\Temp\nsj3056.tmp\AdvSplash.dll

Filesize
6KB

MD5
a1bba35c752b36f575350cb7ddf238e4

SHA1
9603b691ae71d4fbc7a14dbb837bd97cecac8aab

SHA256
0667863d71a3021ab844069b6dd0485f874bf638af478ab11c6fb8b7d6c834b6

SHA512
eb5d3498dd994bec42a437cf91343665d3c35bfe3f6277a7393af6a0b8348772c3166d9be48955edddf6ef79fa508ec8d4f96d7d5df37ecdc52c90042e0a2967

Download Submit
\Users\Admin\AppData\Local\Temp\qh562.exe

Filesize
59KB

MD5
44c3de360a309aba151ae9d1cc2b6773

SHA1
0704ce76d5ab8b747b9319ba928aad5c0e1510d7

SHA256
4b0d92abe91c80afe1acf4ea2a7c04af43db0bb4a5e845e936580f4d56679c84

SHA512
1ac16f1e71c037ed121691f07ecf1949b9a12decbd18446eda0fd512a2389b6ba9b9c39f365f08b7edc7c65865516d98eafc7f1a9a2b9958ef5ad22a086ffff7

Download Submit
\Users\Admin\AppData\Local\Temp\qh562.exe

Filesize
59KB

MD5
44c3de360a309aba151ae9d1cc2b6773

SHA1
0704ce76d5ab8b747b9319ba928aad5c0e1510d7

SHA256
4b0d92abe91c80afe1acf4ea2a7c04af43db0bb4a5e845e936580f4d56679c84

SHA512
1ac16f1e71c037ed121691f07ecf1949b9a12decbd18446eda0fd512a2389b6ba9b9c39f365f08b7edc7c65865516d98eafc7f1a9a2b9958ef5ad22a086ffff7

Download Submit
\Users\Admin\AppData\Local\Temp\qh562.exe

Filesize
59KB

MD5
44c3de360a309aba151ae9d1cc2b6773

SHA1
0704ce76d5ab8b747b9319ba928aad5c0e1510d7

SHA256
4b0d92abe91c80afe1acf4ea2a7c04af43db0bb4a5e845e936580f4d56679c84

SHA512
1ac16f1e71c037ed121691f07ecf1949b9a12decbd18446eda0fd512a2389b6ba9b9c39f365f08b7edc7c65865516d98eafc7f1a9a2b9958ef5ad22a086ffff7

Download Submit
\Users\Admin\AppData\Local\Temp\wiresion.exe

Filesize
466KB

MD5
34c896e9d15df09c31badd1be5e0086f

SHA1
fe2438b5652ca75a46349fd3dc37ee89818b8336

SHA256
7f400f1e9073952352581ddf3b2822998b9a2912495c945b21ca625d52d676dd

SHA512
3a72f6e828f05ac9a5032f7063b52b687c4234e768c5b130e826405312e6e2dbcd003f8abf10da46692f4f563219dbfb66e9ed8d8b86cdad0f28141bbaebe00e

Download Submit
\Users\Admin\AppData\Local\Temp\wiresion.exe

Filesize
466KB

MD5
34c896e9d15df09c31badd1be5e0086f

SHA1
fe2438b5652ca75a46349fd3dc37ee89818b8336

SHA256
7f400f1e9073952352581ddf3b2822998b9a2912495c945b21ca625d52d676dd

SHA512
3a72f6e828f05ac9a5032f7063b52b687c4234e768c5b130e826405312e6e2dbcd003f8abf10da46692f4f563219dbfb66e9ed8d8b86cdad0f28141bbaebe00e

Download Submit
\Users\Admin\AppData\Local\Temp\wiresion.exe

Filesize
466KB

MD5
34c896e9d15df09c31badd1be5e0086f

SHA1
fe2438b5652ca75a46349fd3dc37ee89818b8336

SHA256
7f400f1e9073952352581ddf3b2822998b9a2912495c945b21ca625d52d676dd

SHA512
3a72f6e828f05ac9a5032f7063b52b687c4234e768c5b130e826405312e6e2dbcd003f8abf10da46692f4f563219dbfb66e9ed8d8b86cdad0f28141bbaebe00e

Download Submit
\Users\Admin\AppData\Local\Temp\wiresion.exe

Filesize
466KB

MD5
34c896e9d15df09c31badd1be5e0086f

SHA1
fe2438b5652ca75a46349fd3dc37ee89818b8336

SHA256
7f400f1e9073952352581ddf3b2822998b9a2912495c945b21ca625d52d676dd

SHA512
3a72f6e828f05ac9a5032f7063b52b687c4234e768c5b130e826405312e6e2dbcd003f8abf10da46692f4f563219dbfb66e9ed8d8b86cdad0f28141bbaebe00e

Download Submit
\Users\Admin\AppData\Local\Temp\wiresion.exe

Filesize
466KB

MD5
34c896e9d15df09c31badd1be5e0086f

SHA1
fe2438b5652ca75a46349fd3dc37ee89818b8336

SHA256
7f400f1e9073952352581ddf3b2822998b9a2912495c945b21ca625d52d676dd

SHA512
3a72f6e828f05ac9a5032f7063b52b687c4234e768c5b130e826405312e6e2dbcd003f8abf10da46692f4f563219dbfb66e9ed8d8b86cdad0f28141bbaebe00e

Download Submit
\Users\Admin\AppData\Roaming\gamebrowser\higamebrowser.exe

Filesize
696KB

MD5
34bfd5c2c0b1a33088041b7b664547fc

SHA1
9b66d1125f000c013bf7fbbb7e476ad86b12fe45

SHA256
f0a764e79e5c134d5a69116cd7f924a6d9f07004f37352a7d2c1ab2dce07882e

SHA512
3b3f19b98127602e3772c70073e3ef924d878789939710078f97715d275690b3d8d8dc34426a693e1f61b91fc645227bc6226e7c922afa84ec1816ba5d9204d0

Download Submit
\Users\Admin\AppData\Roaming\gamebrowser\higamebrowser.exe

Filesize
696KB

MD5
34bfd5c2c0b1a33088041b7b664547fc

SHA1
9b66d1125f000c013bf7fbbb7e476ad86b12fe45

SHA256
f0a764e79e5c134d5a69116cd7f924a6d9f07004f37352a7d2c1ab2dce07882e

SHA512
3b3f19b98127602e3772c70073e3ef924d878789939710078f97715d275690b3d8d8dc34426a693e1f61b91fc645227bc6226e7c922afa84ec1816ba5d9204d0

Download Submit
\Users\Admin\AppData\Roaming\gamebrowser\higamebrowser.exe

Filesize
696KB

MD5
34bfd5c2c0b1a33088041b7b664547fc

SHA1
9b66d1125f000c013bf7fbbb7e476ad86b12fe45

SHA256
f0a764e79e5c134d5a69116cd7f924a6d9f07004f37352a7d2c1ab2dce07882e

SHA512
3b3f19b98127602e3772c70073e3ef924d878789939710078f97715d275690b3d8d8dc34426a693e1f61b91fc645227bc6226e7c922afa84ec1816ba5d9204d0

Download Submit
memory/632-147-0x0000000000150000-0x000000000017F000-memory.dmp

Filesize
188KB

Download
memory/632-151-0x0000000000180000-0x00000000001AF000-memory.dmp

Filesize
188KB

Download
memory/632-126-0x0000000000180000-0x00000000001AF000-memory.dmp

Filesize
188KB

Download
memory/632-121-0x0000000000150000-0x000000000017F000-memory.dmp

Filesize
188KB

Download
memory/632-120-0x0000000000150000-0x000000000017F000-memory.dmp

Filesize
188KB

Download
memory/632-148-0x0000000000150000-0x000000000017F000-memory.dmp

Filesize
188KB

Download
memory/980-150-0x0000000010000000-0x000000001004B000-memory.dmp

Filesize
300KB

Download
memory/980-102-0x0000000000090000-0x00000000000B8000-memory.dmp

Filesize
160KB

Download
memory/980-123-0x0000000000090000-0x00000000000B8000-memory.dmp

Filesize
160KB

Download
memory/980-109-0x0000000010000000-0x000000001004B000-memory.dmp

Filesize
300KB

Download
memory/980-125-0x0000000010000000-0x000000001004B000-memory.dmp

Filesize
300KB

Download
memory/1032-162-0x00000000006D0000-0x00000000006DA000-memory.dmp

Filesize
40KB

Download
memory/1032-219-0x0000000000400000-0x000000000051C000-memory.dmp

Filesize
1.1MB

Download
memory/1032-161-0x00000000006D0000-0x00000000006DA000-memory.dmp

Filesize
40KB

Download
memory/1032-216-0x0000000000400000-0x000000000051C000-memory.dmp

Filesize
1.1MB

Download
memory/1032-164-0x0000000004010000-0x0000000004058000-memory.dmp

Filesize
288KB

Download
memory/1032-138-0x0000000000240000-0x000000000035C000-memory.dmp

Filesize
1.1MB

Download
memory/1032-137-0x0000000000240000-0x000000000035C000-memory.dmp

Filesize
1.1MB

Download
memory/1032-136-0x0000000000400000-0x000000000051C000-memory.dmp

Filesize
1.1MB

Download
memory/1032-163-0x0000000004010000-0x0000000004058000-memory.dmp

Filesize
288KB

Download
memory/1036-72-0x0000000003340000-0x0000000003444000-memory.dmp

Filesize
1.0MB

Download
memory/1036-73-0x0000000003340000-0x0000000003444000-memory.dmp

Filesize
1.0MB

Download
memory/1336-115-0x0000000000290000-0x00000000002BC000-memory.dmp

Filesize
176KB

Download
memory/1336-114-0x00000000770A0000-0x0000000077220000-memory.dmp

Filesize
1.5MB

Download
memory/1340-54-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/1536-149-0x0000000000970000-0x0000000000A74000-memory.dmp

Filesize
1.0MB

Download
memory/1536-74-0x0000000000400000-0x0000000000504000-memory.dmp

Filesize
1.0MB

Download
memory/1536-146-0x0000000000400000-0x0000000000504000-memory.dmp

Filesize
1.0MB

Download
memory/1536-122-0x0000000000970000-0x0000000000A74000-memory.dmp

Filesize
1.0MB

Download
memory/1716-127-0x0000000000B60000-0x0000000000D57000-memory.dmp

Filesize
2.0MB

Download
memory/1716-145-0x0000000004D20000-0x0000000004D30000-memory.dmp

Filesize
64KB

Download
memory/1716-144-0x0000000004780000-0x0000000004790000-memory.dmp

Filesize
64KB

Download
memory/1716-124-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/2556-182-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2556-229-0x0000000003010000-0x00000000030FE000-memory.dmp

Filesize
952KB

Download
memory/2556-215-0x0000000002A10000-0x0000000002A8E000-memory.dmp

Filesize
504KB

Download
memory/2556-234-0x00000000048C0000-0x00000000048F7000-memory.dmp

Filesize
220KB

Download
memory/2556-232-0x00000000047D0000-0x00000000048B3000-memory.dmp

Filesize
908KB

Download
memory/2556-231-0x00000000033B0000-0x00000000034EE000-memory.dmp

Filesize
1.2MB

Download
memory/2556-214-0x0000000002A11000-0x0000000002A71000-memory.dmp

Filesize
384KB

Download
memory/2556-226-0x0000000002E10000-0x0000000002E66000-memory.dmp

Filesize
344KB

Download
memory/2556-228-0x0000000002F70000-0x0000000003009000-memory.dmp

Filesize
612KB

Download
memory/2556-224-0x0000000002AF0000-0x0000000002E0F000-memory.dmp

Filesize
3.1MB

Download
memory/2608-190-0x0000000002990000-0x0000000002ACE000-memory.dmp

Filesize
1.2MB

Download
memory/2608-183-0x0000000002130000-0x000000000214A000-memory.dmp

Filesize
104KB

Download
memory/2684-220-0x0000000003CA0000-0x0000000003D12000-memory.dmp

Filesize
456KB

Download
memory/2684-203-0x0000000001260000-0x000000000127A000-memory.dmp

Filesize
104KB

Download
memory/2684-185-0x00000000000C0000-0x00000000000CE000-memory.dmp

Filesize
56KB

Download
memory/2684-208-0x0000000003060000-0x00000000030D4000-memory.dmp

Filesize
464KB

Download
memory/2684-206-0x0000000002F20000-0x0000000002FCD000-memory.dmp

Filesize
692KB

Download
memory/2684-217-0x0000000003300000-0x000000000334D000-memory.dmp

Filesize
308KB

Download
memory/2684-204-0x0000000002490000-0x0000000002529000-memory.dmp

Filesize
612KB

Download
memory/2684-210-0x0000000002B90000-0x0000000002BE6000-memory.dmp

Filesize
344KB

Download
memory/2684-222-0x0000000001990000-0x00000000019A9000-memory.dmp

Filesize
100KB

Download
memory/2684-201-0x00000000013B0000-0x00000000013F1000-memory.dmp

Filesize
260KB

Download
memory/2684-200-0x0000000001240000-0x0000000001252000-memory.dmp

Filesize
72KB

Download
memory/2684-199-0x0000000000C21000-0x0000000000C2C000-memory.dmp

Filesize
44KB

Download
memory/2684-197-0x0000000002DF0000-0x0000000002F1B000-memory.dmp

Filesize
1.2MB

Download
memory/2684-188-0x0000000000BF0000-0x0000000000C1B000-memory.dmp

Filesize
172KB

Download
memory/2684-186-0x0000000000B70000-0x0000000000B9A000-memory.dmp

Filesize
168KB

Download